Current Cybercrime Threats Originate In Espionage

The recent ransomware attack that brought down MRI scanners in the UK, railroad ticket machines in Germany, interior ministry computers in Russia and parts of the FedEx network in the US is bound to cause a backlash against spy agencies' cyber warfare capabilities. 

It shows that services such as the US National Security Agency hoard weapons that, by their very nature, target civilian infrastructure.

The WannaCry attack wasn't a big-time nation-state operation, though it's likely that it may have originated in Russia. Last year 75 percent of crypto ransomware, malware that encrypts files on the target machine to force its owner to pay a ransom in exchange for their decryption--originated from the Russian-speaking hacker underworld. 

The largest number of WannaCry attacks occurred in Russia and Ukraine. The hackers weren't playing some political interference game: They were after money, in bitcoin. Researchers who tracked the bitcoin addresses hardwired into the malware found that tens of thousands of dollars had been paid before the spread of the virus was halted by a cybersecurity expert who accidentally found a flaw in WannaCry.

That flaw, apparently the result of the hackers' rather clumsy attempt to prevent their malware from being analysed, shows the attack wasn't highly sophisticated. Its main element was developed by the NSA, not the hackers, a vulnerability code-named Eternalblue, which allowed the agency to commandeer old pre-Windows 10 versions of the Microsoft operating system. 

The NSA code was released in April by a hacking group calling itself Shadow Brokers, which had apparently failed to find a buyer for a large trove of NSA cyber-weapons.

After the recent leaks of hacking tools from the NSA and the Central Intelligence Agency, cyber espionage critics, including NSA whistle-blower Edward Snowden and WikiLeaks founder Julian Assange, have criticised the agencies for hoarding vulnerabilities for their own use instead of flagging them to companies like Microsoft in the interest of public safety. Following the WannaCry attack, one of the biggest in history, Microsoft itself has joined the ranks of the critics. In a strongly worded blog post, Brad Smith, the company's president and chief legal officer, wrote:
"Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen. And this most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today--nation-state action and organized criminal action."

Microsoft and its peers shouldn't count on the NSA to hand over information about vulnerabilities; spies will be spies. Given the current regulatory environment, it's the responsibility of these companies themselves, with their enormous financial resources, to track down these gaps in the security of their products, paying to acquire information if necessary. Smith, however, is right when he calls for a Digital Geneva Convention that would protect civilians against nation-states' cyber wars, just as the Fourth Geneva Convention defends civilians in time of conventional war.

How the NSA planned to use Eternalblue in the first place is a good question. The fact that it only works against old Windows systems shows that it is specifically directed against civilian infrastructure such as public sector networks that are often administered cheaply by overworked, less qualified information technology professionals on obsolete hardware with software that won't run on Windows 10. The newest version of the Microsoft operating system now holds 26 percent of the global market. The share of Windows 7, released in 2009, is 48.5 percent, and 7 percent of the world's Internet-connected computers still use 16-year-old Windows XP. 

No matter how Microsoft pushes the newest system to customers (the upgrades are free), some systems stick with the old versions because they can't afford the switching effort in terms of the time required and the old hardware's insufficiency. Expensive MRI machines used by the British National Health Service are a good example; medical equipment everywhere is likely to run antiquated systems, and it's exposed to attacks delivered through the Internet.

The Russian interior ministry's computers affected by the WannaCry virus aren't military-use machines; they're old computers in police stations and service centers, the ones that are always the last to get an upgrade. For the German railroads, too, switching all the ticket terminals to Windows 10 is not exactly a priority.

It's easy to say everyone should be vigilant, install every patch released and preferably never miss an operating system update. Certainly many institutions and companies under-invest in this area. These civilian systems, however, will always lag behind, and that's why the NSA thinks old Windows vulnerabilities are worth hoarding.

It's tempting for an intelligence service to find ways to shut down an adversary's power grid or hospital system or to hack traffic lights in a big city to cause chaos. But that's as unethical as shooting or torturing the civilians in war. It should be illegal to develop such weapons, just as it is to produce nerve gas for military uses. Intelligence agencies should be legally required to give up any cyber weapons that don't specifically target the military capabilities of adversary states.

It would be naive to believe that would rule out the use of such cyber weapons. But it will improve intelligence services' accountability and, at the very least, force them to take better care of any dark stuff that comes into their hands.

As it is, if they have a piece of malware, it's highly likely that even small-time criminals will have it too.

NWAOnline

You Might Also Read: 

Government Sponsored Cyber-insecurity Is A Gift For Hackers:

WikiLeaks Has Published The CIA’s Secrets For Infecting Windows:

The CIA Has Lost Control Of Its Cyber Weapon Documents:

 

« Mathematical Analysis Suggests Marlowe And Shakespeare Co-Wrote
EU’s New Data Rules Are 1 Year Away »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Dionach

Dionach

Dionach are a certified information security specialists who provide Penetration Testing, IT Security Auditing and Information Security Consultancy.

CyberSift

CyberSift

CyberSift is a cyber security provider. We develop threat detection software which needs no infrastructure changes as it integrates with almost any security tool.

Duo Security

Duo Security

Duo combines security expertise with a user-centered philosophy to provide two-factor authentication, endpoint remediation and secure single sign-on tools.

National Center for Manufacturing Sciences (NCMS)

National Center for Manufacturing Sciences (NCMS)

NCMS is a cross-industry technology development consortium, dedicated to improving the competitiveness of the US industrial base. Strategic initiatives include industrial cyber security.

StormWall

StormWall

StormWall is an Anti-DDoS protection service for websites and networks. We offer 100% protection from all types of DDoS attacks and 24/7 technical support.

Senseon

Senseon

Senseon’s multiple threat-detection senses work together to detect malicious activity across an organisation’s entire digital estate, covering the gaps that single point solutions create.

Syskode Technologies

Syskode Technologies

Sykode Technologies is a next-generation global technology company offering an integrated portfolio of advisory services, products and solutions in areas including AI, IoT and Cyber Security.

Digital Management (DMI)

Digital Management (DMI)

DMI is a provider of mobile enterprise, business intelligence and cybersecurity services.

Prolimax

Prolimax

Prolimax deliver innovative solutions to IT Manufacturers, Distributors, Resellers and End-users including Data Erasure and secure IT Asset Disposition (ITAD)

Sum&Substance (Sumsub)

Sum&Substance (Sumsub)

Sum&Substance is a developer of remote verification solutions. Our technology allows online services around the world to meet regulatory requirements, prevent fraud and enhance customer confidence.

Nova Leah

Nova Leah

Nova Leah helps connected medical device manufacturers meet cybersecurity compliance requirements throughout the entire product lifecycle.

Newberry Group

Newberry Group

The Newberry Group provides comprehensive IT services and solutions that optimize operations, minimize risk and deliver measurable business value.

TrustGrid

TrustGrid

Trustgrid is a pioneer and leader in secure, cloud-native software-defined connectivity.

TXOne Networks

TXOne Networks

TXOne Networks offer cybersecurity solutions to protect your industrial control systems to ensure their reliability and safety from cyberattacks.

PreVeil

PreVeil

We started PreVeil to bring radically better security to ordinary business and personal communication and information storage.

Valeo Nertworks

Valeo Nertworks

Valeo Nertworks is a full-service Managed Security Service Provider (MSSP). We partner with organizations to remove the burden of technology so that they can focus on growing their business.