Microsoft issues 'highly unusual' Windows XP patch to fix massive

Adjust Comment Print

Who perpetrated this wave of attacks remains unknown.

"Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful", said Phillip Misner, principal security group manager for the Microsoft Security Response Center, in a post this morning.

NHS Digital, which oversees United Kingdom hospital cybersecurity, says the attack used the Wanna Decryptor variant of malware, which infects and locks computers while the attackers demand a ransom.

Jakub Kroustek of the security firm Avast said in a blog post update around 2000 GMT, "We are now seeing more than 75,000 detections... in 99 countries". In the past 10 hours, Kaspersky Lab stated that the attacks hit 74 countries.

This extends to not grumbling when your system administrator at work takes the network down periodically to update systems, which usually includes installing new and often software patches.

Cybersecurity experts identified the malware as a variant of the ransomware known as Wcry or WannaCry.

But Alan Woodward, visiting professor of computing at the University of Surrey, said he did not believe it was a targeted attack.

Indeed, while FedEx Corp. reported that its Windows computers were "experiencing interference" from malware - it wouldn't say if it had been hit by the ransomware - other impacts in the USA were not readily apparent on Saturday.

In the UK, National Health Service organizations are just some of its victims. It initially said 16 NHS organizations had reported being hit, and more reports came in as the day went on.

Collapsed tunnel sealed at US nuclear site after accident
About six Hanford employees discovered the tunnel collapse Tuesday morning and an emergency was declared about 8:30 a.m. Lawyers for the Energy Department have said no evidence has been provided showing workers have been harmed by vapors.

Since ransomware can be spread by emails, users should be wary of any unsolicited emails or emails from addresses they may not know. The national railway said it was attacked but operations were unaffected.

Images appeared on victims' screens demanding payment of $300 (275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!"

It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message. The malware was able to spread thanks to flaws in old versions of Windows that were originally used by the NSA to hack into PCs before being made public by the Shadow Brokers group last month.

Security experts said the attack appeared to be caused by a self-replicating piece of software that enters companies and organisations when employees click on email attachments, then spreads quickly internally from computer to computer when employees share documents and other files.

But unlike other ransomware, Wana Decryptor has been built to spread quickly. As a result, nothing will happen on new systems running the infected file unless that system requires proxy access to the Internet. Companies like Deutsche Bahn, the German transport giant; Telefónica, a Spanish telecommunications firm; and Renault, the French automaker, said that some of their systems had been affected, though no major outages had yet been reported across the region's transports or telecom networks.

"Ambulances are being diverted to neighboring hospitals", the spokesman said.

Two employees at St Bartholomew's Hospital, which is part of Barts Health, told AFP that all the computers in the hospital had been turned off. The world owes its gratitude to a Proofpoint cybersecurity researcher going by the Twitter account @malwaretechblog.

"It seems a lot like the actors responsible for this are fairly amateur because of the implementation that they used for the kill switch", Huss told CNN.

"What we are trying to do is make people aware of that and ensure that they download the required patch and that they keep software updated by downloading patches as they are required".

Comments