{"id":16662,"date":"2019-06-04T00:52:36","date_gmt":"2019-06-04T00:52:36","guid":{"rendered":"https:\/\/www.lifeandnews.com\/articles\/?p=16662"},"modified":"2019-06-05T03:05:55","modified_gmt":"2019-06-05T03:05:55","slug":"hackers-seek-ransoms-from-baltimore-and-communities-across-the-us","status":"publish","type":"post","link":"https:\/\/www.lifeandnews.com\/articles\/hackers-seek-ransoms-from-baltimore-and-communities-across-the-us\/","title":{"rendered":"Hackers seek ransoms from Baltimore and communities across the US"},"content":{"rendered":"<p><span><a href=\"https:\/\/theconversation.com\/profiles\/richard-forno-173226\">Richard Forno<\/a>, <em><a href=\"http:\/\/theconversation.com\/institutions\/university-of-maryland-baltimore-county-1667\">University of Maryland, Baltimore County<\/a><\/em><\/span><\/p>\n<p>The people of Baltimore are beginning their fifth week under an <a href=\"https:\/\/www.governing.com\/topics\/public-justice-safety\/gov-cyber-attack-security-ransomware-baltimore-bitcoin.html\">electronic siege<\/a> that has prevented residents from <a href=\"https:\/\/www.baltimoresun.com\/maryland\/baltimore-city\/bs-md-ci-open-baltimore-ransomware-20190513-story.html\">obtaining<\/a> building permits and business licenses \u2013 and even <a href=\"https:\/\/www.npr.org\/2019\/05\/21\/725118702\/ransomware-cyberattacks-on-baltimore-put-city-services-offline\">buying or selling homes<\/a>. A year after hackers <a href=\"https:\/\/www.baltimoresun.com\/news\/maryland\/crime\/bs-md-ci-hack-folo-20180328-story.html\">disrupted<\/a> the city\u2019s emergency services dispatch system, city workers throughout the city are unable to, among other things, use their government email accounts or conduct <a href=\"https:\/\/www.baltimoresun.com\/maryland\/baltimore-city\/bs-md-ci-property-deeds-20190524-story.html\">routine city business<\/a>.  <\/p>\n<p>In this attack, a type of malicious software called ransomware has encrypted key files, rendering them unusable until the city pays the unknown attackers 13 bitcoin, or about US$76,280. But even if the city were to pay up, there is no guarantee that its files would all be recovered; many ransomware attacks <a href=\"https:\/\/cyber-edge.com\/wp-content\/uploads\/2019\/03\/CyberEdge-2019-CDR-Report.pdf#page=14\">end with the data lost<\/a>, whether the ransom is paid or not.<\/p>\n<p>Similar attacks in recent years have <a href=\"https:\/\/www.telegraph.co.uk\/technology\/2018\/10\/11\/wannacry-cyber-attack-cost-nhs-92m-19000-appointments-cancelled\/\">crippled<\/a> the United Kingdom\u2019s National Health Service, <a href=\"https:\/\/www.wired.com\/story\/notpetya-cyberattack-ukraine-russia-code-crashed-the-world\/\">shipping giant Maersk<\/a> and <a href=\"https:\/\/www.recordedfuture.com\/state-local-government-ransomware-attacks\/\">local, county and state governments across the U.S.<\/a> and <a href=\"https:\/\/www.thespec.com\/news-story\/8902484-opp-warn-of-ransomware-attacks-on-municipal-governments\/\">Canada<\/a>.<\/p>\n<p><iframe loading=\"lazy\" id=\"lkvX4\" class=\"tc-infographic-datawrapper\" src=\"https:\/\/datawrapper.dwcdn.net\/lkvX4\/1\/\" height=\"400px\" width=\"100%\" style=\"border: none\" frameborder=\"0\"><\/iframe><\/p>\n<p>These types of attacks are becoming more frequent and gaining more media attention. Speaking as a career cybersecurity professional, the technical aspects of incidents like this are but one part of a much bigger picture. Every user of technology must consider not only threats and vulnerabilities, but also operational processes, potential points of failure and how they use technology on a daily basis. Thinking ahead, and taking protective steps, can help reduce the effects of cybersecurity incidents on both individuals and organizations.<\/p>\n<h2>Understanding cyberattack tools<\/h2>\n<p>Software designed to attack other computers is nothing new. Nations, private companies, individual researchers and criminals continue developing these types of programs, for a wide range of <a href=\"https:\/\/theconversation.com\/america-is-dropping-cyberbombs-but-how-do-they-work-58476\">purposes<\/a>, including digital warfare and intelligence gathering, as well as extortion by ransomware.<\/p>\n<p>Many malware efforts begin as a normal and crucial function of cybersecurity: identifying software and hardware vulnerabilities that could be exploited by an attacker. Security researchers then work to close that vulnerability. By contrast, malware developers, criminal or otherwise, will figure out how to get through that opening undetected, to explore and potentially wreak havoc in a target\u2019s systems.<\/p>\n<p>Sometimes a <a href=\"https:\/\/theconversation.com\/what-are-software-vulnerabilities-and-why-are-there-so-many-of-them-77930\">single weakness is enough<\/a> to give an intruder the access they want. But other times attackers will use multiple vulnerabilities in combination to infiltrate a system, take control, steal data and modify or delete information \u2013 while trying to hide any evidence of their activity from security programs and personnel. The challenge is so great that <a href=\"https:\/\/www.rsaconference.com\/writable\/presentations\/file_upload\/spo1-t11_combatting-advanced-cybersecurity-threats-with-ai-and-machine-learning_copy1.pdf\">artificial intelligence and machine learning systems<\/a> are now also being incorporated to help with cybersecurity activities.<\/p>\n<p>There\u2019s some question about the role the federal government <a href=\"https:\/\/cybersecpolitics.blogspot.com\/2019\/05\/baltimore-is-not-eternalblue.html\">may have played<\/a> in this situation, because one of the hacking tools the attackers <a href=\"https:\/\/www.nytimes.com\/2019\/05\/31\/us\/nsa-baltimore-ransomware.html\">reportedly<\/a> used in Baltimore was <a href=\"https:\/\/money.cnn.com\/2016\/01\/12\/technology\/nsa-michael-hayden-us-hacker-thief\/index.html\">developed<\/a> by the U.S. National Security Agency, which the <a href=\"https:\/\/www.nytimes.com\/2019\/05\/31\/us\/nsa-baltimore-ransomware.html\">NSA has denied<\/a>. However, hacking tools stolen from the NSA in 2017 by the hacker group <a href=\"https:\/\/www.theatlantic.com\/technology\/archive\/2017\/05\/shadow-brokers\/527778\/\">Shadow Brokers<\/a> were used to launch <a href=\"http:\/\/www.cyberdefensemagazine.com\/at-least-3-different-groups-have-been-leveraging-the-nsa-eternalblue-exploit-whats-went-wrong\">similar attacks<\/a> within months of those tools being posted on the internet. Certainly, those tools should never have been stolen from the NSA \u2013 and should have been better protected. <\/p>\n<p>But my views are more complicated than that: As a citizen, I recognize the NSA\u2019s mandate to research and develop advanced tools to protect the country and fulfill its national security mission. However, <a href=\"https:\/\/theconversation.com\/should-spies-use-secret-software-vulnerabilities-77770\">like many cybersecurity professionals<\/a>, I remain conflicted: When the government discovers a new technology vulnerability but doesn\u2019t tell the maker of the affected hardware or software until after it\u2019s used to cause havoc or disclosed by a leak, everyone is at risk.<\/p>\n<p><iframe loading=\"lazy\" id=\"Yj50Z\" class=\"tc-infographic-datawrapper\" src=\"https:\/\/datawrapper.dwcdn.net\/Yj50Z\/1\/\" height=\"400px\" width=\"100%\" style=\"border: none\" frameborder=\"0\"><\/iframe><\/p>\n<h2>Baltimore\u2019s situation<\/h2>\n<p>The <a href=\"https:\/\/www.govtech.com\/security\/Estimates-Put-Baltimores-Ransomware-Recovery-at-18-2-M.html\">estimated $18 million cost of recovery<\/a> in Baltimore is money the city likely doesn\u2019t have readily available. Recent research by some of my colleagues at the University of Maryland, Baltimore County, shows that many state and <a href=\"https:\/\/doi.org\/10.1111\/puar.13028\">local governments remain woefully underprepared<\/a> and underfunded to adequately, let alone proactively, deal with cybersecurity\u2019s many challenges. <\/p>\n<p>It is concerning that the ransomware attack in Baltimore exploited a vulnerability that has been publicly <a href=\"https:\/\/gizmodo.com\/you-need-to-patch-your-older-windows-pcs-right-now-to-p-1835158876\">known<\/a> about \u2013 with an available fix \u2013 <a href=\"http:\/\/fortune.com\/2019\/06\/01\/baltimore-nsa-ransowmare-microsoft-windows-eternalblue\/\">for over two years<\/a>. NSA had developed an exploit (code-named EternalBlue) for this discovered security weakness but didn\u2019t alert Microsoft about this critical security vulnerability until early 2017 \u2013 and only after the Shadow Brokers had stolen the NSA\u2019s tool to attack it. Soon after, Microsoft <a href=\"https:\/\/blogs.technet.microsoft.com\/msrc\/2017\/04\/14\/protecting-customers-and-evaluating-risk\/\">issued a software security update<\/a> to fix this key flaw in its Windows operating system.<\/p>\n<p>Admittedly, it can be very complex to manage software updates for a large organization. But given the media coverage at the time about the unauthorized disclosure of many NSA hacking tools and the vulnerabilities they targeted, it\u2019s unclear why Baltimore\u2019s information technology staff didn\u2019t ensure the city\u2019s computers received that particular security update immediately. And while it\u2019s not necessarily fair to <a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2019\/05\/nsa-deflects-blame-baltimore-ransomware-attack\/157376\/\">blame the NSA<\/a> for the Baltimore incident, it is entirely fair to say that the knowledge and techniques behind the tools of digital warfare are out in the world; we must learn to live with them and adapt accordingly.<\/p>\n<p><iframe loading=\"lazy\" id=\"g2C5x\" class=\"tc-infographic-datawrapper\" src=\"https:\/\/datawrapper.dwcdn.net\/g2C5x\/1\/\" height=\"400px\" width=\"100%\" style=\"border: none\" frameborder=\"0\"><\/iframe><\/p>\n<h2>Compounding problems<\/h2>\n<p>In a global society where people, companies and governments are increasingly dependent on computers, digital weaknesses have the power to seriously disrupt or destroy everyday actions and functions.<\/p>\n<p>Even trying to develop workarounds when a crisis hits can be challenging. Baltimore city employees who were blocked from using the city\u2019s email system tried to set up free Gmail accounts to at least get some work done. But they were initially blocked by <a href=\"https:\/\/www.theverge.com\/2019\/5\/23\/18637638\/google-gmail-baltimore-ransomware-attacks\">Google\u2019s automated security systems<\/a>, which identified them as <a href=\"https:\/\/www.baltimoresun.com\/maryland\/baltimore-city\/bs-md-ci-gmail-accounts-20190523-story.html\">potentially fraudulent<\/a>. <\/p>\n<p>Making matters worse, when Baltimore\u2019s online services went down, <a href=\"https:\/\/www.baltimoresun.com\/maryland\/baltimore-city\/bs-md-ci-city-agencies-ransomware-20190509-story.html\">parts<\/a> of the city\u2019s municipal phone system couldn\u2019t handle the resulting increase in calls attempting to compensate. This underscores the need to not only focus on technology products themselves but also the policies, procedures and capabilities needed to ensure individuals and\/or organizations can remain at least minimally functional when under duress, whether by cyberattack, technology failures or acts of nature.<\/p>\n<h2>Protecting yourself, and your livelihood<\/h2>\n<p>The first step to <a href=\"https:\/\/theconversation.com\/its-easier-to-defend-against-ransomware-than-you-might-think-57258\">fighting a ransomware attack<\/a> is to regularly back up your data \u2013 which also provides protection against hardware failures, theft and other problems. To deal with ransomware, though, it\u2019s particularly important to keep a few versions of your backups over time \u2013 don\u2019t just rewrite the same files on a backup drive over and over. <\/p>\n<p>That\u2019s because when you get hit, you\u2019ll want to determine when you were infected and restore files from a backup made before that time. Otherwise, you\u2019ll just be recovering infected data, and not actually fixing your problem. Yes, you might lose some data, but not everything \u2013 and presumably only your most recent work, which you\u2019ll probably remember and recreate easily enough.<\/p>\n<p>And of course, following <a href=\"https:\/\/theconversation.com\/its-easier-to-defend-against-ransomware-than-you-might-think-57258\">some of cybersecurity\u2019s best practices<\/a> \u2013 even just the basics \u2013 can help prevent, or at least minimize, the possibility of ransomware crippling you or your organization. Doing things like running current antivirus software, <a href=\"https:\/\/theconversation.com\/the-petya-ransomware-attack-shows-how-many-people-still-dont-install-software-updates-77667\">keeping all software updated<\/a>, using <a href=\"https:\/\/theconversation.com\/using-truly-secure-passwords-6-essential-reads-84092\">strong passwords<\/a> and <a href=\"https:\/\/theconversation.com\/the-age-of-hacking-brings-a-return-to-the-physical-key-73094\">multifactor authentication<\/a>, and not blindly trusting random devices or email attachments you encounter are just some of the steps everyone should take to be a good digital citizen.<\/p>\n<p>It\u2019s also worth making plans to work around potential failures that might befall your email provider, internet service provider and power company, not to mention the software we rely on. Whether they\u2019re attacked or <a href=\"https:\/\/gizmodo.com\/major-google-outage-hits-youtube-g-suite-and-third-pa-1835189852\">simply fail<\/a>, their absence can disrupt your life.<\/p>\n<p>In this way, ransomware incidents serve as an important reminder that cybersecurity is not just limited to protecting digital bits and bytes in cyberspace. Rather, it should force everyone to think broadly and holistically about their relationship with technology and the processes that govern its role and use in our lives. And, it should make people consider how they might function without parts of it at both work and home, because it\u2019s a matter of when, not if, problems will occur.<!-- Below is The Conversation's page counter tag. Please DO NOT REMOVE. --><img loading=\"lazy\" src=\"https:\/\/counter.theconversation.com\/content\/118089\/count.gif?distributor=republish-lightbox-basic\" alt=\"The Conversation\" width=\"1\" height=\"1\" style=\"border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important; text-shadow: none !important\" \/><!-- End of code. If you don't see any code above, please get new code from the Advanced tab after you click the republish button. The page counter does not collect any personal data. More info: http:\/\/theconversation.com\/republishing-guidelines --><\/p>\n<p><span><a href=\"https:\/\/theconversation.com\/profiles\/richard-forno-173226\">Richard Forno<\/a>, Senior Lecturer, Cybersecurity &#038; Internet Researcher, <em><a href=\"http:\/\/theconversation.com\/institutions\/university-of-maryland-baltimore-county-1667\">University of Maryland, Baltimore County<\/a><\/em><\/span><\/p>\n<p>This article is republished from <a href=\"http:\/\/theconversation.com\">The Conversation<\/a> under a Creative Commons license. Read the <a href=\"https:\/\/theconversation.com\/hackers-seek-ransoms-from-baltimore-and-communities-across-the-us-118089\">original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Richard Forno, University of Maryland, Baltimore County The people of Baltimore are beginning their fifth week under an electronic siege that has prevented residents from obtaining building permits and business licenses \u2013 and even buying or selling homes. A year after hackers disrupted the city\u2019s emergency services dispatch system, city workers throughout the city are [&hellip;]<\/p>\n","protected":false},"author":44,"featured_media":16657,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3410],"tags":[6420,612,1815,2376,6419],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/16662"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=16662"}],"version-history":[{"count":1,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/16662\/revisions"}],"predecessor-version":[{"id":16663,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/16662\/revisions\/16663"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/16657"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=16662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=16662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=16662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}