Errymath: Shadow Brokers

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY-1Unf-pDdFXBb5c-qPqniHl92JJw3X-HtLq_w_RfPAOyV_FTPmqpX9dLQaAicp-GWzTt7qA9awyuTNKi1V-cYl8M58vQn8l1_Ct2SF9IMP_olYRVp84wkphlruuIG0pVKHFPjvXLkP8/s1600/4040F88F00000578-4500738-image-a-9_1494632755859.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="470" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY-1Unf-pDdFXBb5c-qPqniHl92JJw3X-HtLq_w_RfPAOyV_FTPmqpX9dLQaAicp-GWzTt7qA9awyuTNKi1V-cYl8M58vQn8l1_Ct2SF9IMP_olYRVp84wkphlruuIG0pVKHFPjvXLkP8/s640/4040F88F00000578-4500738-image-a-9_1494632755859.jpg" width="640" /></a></div>
   Several computers at a university in Italy were also randomly targeted in the cyber attack<br />
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br />
<div class="mol-para-with-font">
A global cyber attack using hacking tools 
widely believed to have been developed by the US National Security 
Agency and leaked online by a group called the Shadow Brokers has  
caused chaos around the world.</div>
<div class="mol-para-with-font">
British 
hospitals, the Russian government, German railways and big companies 
like FedEx were among those affected on Friday when they were crippled 
by the 'ransomware' that rapidly spread across the globe and infected 
tens of thousands of computers in 74 countries.</div>
<div class="mol-para-with-font">
Security
 experts say the malicious software behind the onslaught appeared to 
exploit a vulnerability in Microsoft Windows that was identified by the 
US National Security Agency for its own intelligence-gathering 
purposes.<br />
</div>
<div class="mol-para-with-font">
The NSA documents were stolen and then released to the world last month by a mysterious group known as the Shadow Brokers.</div>
<div class="mol-para-with-font">
The
 hackers, who have not come forward to claim responsibility, likely made
 it a 'worm', or self spread malware, by exploiting a piece of NSA code 
known as Eternal Blue, according to several security experts.<br />
</div>
<div class="mol-para-with-font">
The
 Shadow Brokers released Eternal Blue last month as part of a trove of 
hacking tools that they said belonged to the US spy agency. It has 
stoked fears that the spy agency's powerful cyber weapons had been 
stolen and repurposed by hackers with nefarious goals. </div>
<div class="mol-para-with-font">
The
 malicious software was blocking access to computers and demanding 
payments of as much as $600 to restore access and scrambling data. It is
 thought to have impacted at least 57,000 computers, including machines 
in the Russian government.  </div>
</div>
<br />
<div class="artSplitter mol-img-group">
<div class="mol-img" style="position: relative;">
<div class="image-wrap fff-pic" style="cursor: pointer;">
<img alt="The NHS has been hit by a major cyber attack hitting computers, phones and emergency bleepers in hospitals and GP surgeries - and pop-ups like this one have appeared demanding a ransom" class="blkBorder img-share b-loaded" data-track-pos="1" height="673" id="i-b7e4181434202a6c" src="http://i.dailymail.co.uk/i/pix/2017/05/12/16/403D0D0100000578-4500080-image-m-39_1494603239216.jpg" width="634" />
      </div>
</div>
<div class="imageCaption">
The NHS has
 been hit by a major cyber attack hitting computers, phones and 
emergency bleepers in hospitals and GP surgeries - and pop-ups like this
 one have appeared demanding a ransom</div>
<div class="imageCaption">
<br /></div>
</div>
<div class="mol-para-with-font">
The
 technological meltdown began earlier on Friday afternoon in Britain 
when more than 40 NHS organisations including hospitals and GP surgeries
 were hit by the virus.</div>
<div class="mol-para-with-font">
But with the 
virus spreading at a rate of five million emails per hour, tens of 
thousands of victims have now been reported in more than 74 countries 
including the US, Australia, Belgium, France, Germany, Italy and Mexico.</div>
<div class="mol-para-with-font">
Russia
 is thought to have been among the worst hit by the ransomware amid 
reports that 1,000 computers in the country's Interior Ministry were 
affected, but sources say no information was leaked.</div>
<div class="mol-para-with-font" id="ext-gen141">
Ministry
 spokeswoman Irina Volk told Russian news agencies it had 'recorded a 
virus attack on the ministry's personal computers controlled by a 
Windows operating system.' </div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
 </div>
<blockquote class="tr_bq">
<h3 class="mol-factbox-title">
<span style="background-color: #d9ead3;">RANSOMWARE: THE CYBER ATTACK THAT CRIPPLED THE WORLD</span></h3>
</blockquote>
<div class="ins cleared mol-factbox-body">
<blockquote>
                                <div class="mol-para-with-font mol-style-bold">
<b>What is ransomware? </b></div>
<div class="mol-para-with-font">
Ransomware is a type of malicious software that criminals use to attack computer systems.</div>
<div class="mol-para-with-font">
Hackers often demand the victim to pay ransom money to access their files or remove harmful programs.</div>
<div class="mol-para-with-font">
The
 aggressive attacks dupe users into clicking on a fake link – whether 
it's in an email or on a fake website, causing an infection to corrupt 
the computer.</div>
<div class="mol-para-with-font">
In some instances, 
adverts for pornographic website will repeatedly appear on your screen, 
while in others, a pop-up will state that a piece of your data will be 
destroyed if you don't pay.</div>
<div class="mol-para-with-font">
In the case of the NHS attack, the ransomware used was called Wanna Decryptor or 'WannaCry' Virus. </div>
</blockquote>
<br />
<blockquote>
<div class="mol-para-with-font mol-style-bold">
<b>What is the WannaCry virus?</b> </div>
<div class="mol-para-with-font">
The WannaCry virus targets Microsoft's widely used Windows operating system.</div>
<div class="mol-para-with-font">
The virus encrypts certain files on the computer and then blackmails the user for money in exchange for the access to the files.</div>
<div class="mol-para-with-font">
It leaves the user with only two files: Instructions on what to do next and the Wanna Decryptor program itself.</div>
<div class="mol-para-with-font">
When
 opened the software tells users that their files have been encrypted 
and gives them a few days to pay up or their files will be deleted.</div>
<div class="mol-para-with-font">
It can quickly spread through an entire network of computers in a business or hospital, encrypting files on every PC.</div>
</blockquote>
<blockquote>
<div class="mol-para-with-font mol-style-bold">
<b>How to protect yourself from ransomware</b> </div>
<div class="mol-para-with-font">
Thankfully, there are ways to avoid ransomware attacks, and Norton Antivirus has compiled a list of prevention methods:</div>
<div class="mol-para-with-font">
1. Use reputable antivirus software and a firewall</div>
<div class="mol-para-with-font">
2. Back up your computer often</div>
<div class="mol-para-with-font">
3. Set up a popup blocker</div>
<div class="mol-para-with-font" id="ext-gen148">
4. Be cautious about clicking links inside emails or on suspicious websites</div>
<div class="mol-para-with-font">
5. If you do receive a ransom note, disconnect from the Internet</div>
<div class="mol-para-with-font">
6. Alert authorities </div>
</blockquote>
</div>
</div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
  </div>
<div class="mol-para-with-font">
Leading international shipper FedEx Corp 
was among the companies whose Microsoft Corp Windows systems were 
affected. They said they were 'implementing remediation steps'.</div>
<div class="mol-para-with-font">
The
 German rail system was also experiencing issues due to the ransomware. 
Photos surfaced on social media appeared to show ticketing computers at 
train stations having been affected by the cyber attack.  </div>
<div class="mol-para-with-font">
In
 Spain, the Telefonica mobile phone network, power firm Iberdrola and 
utility provider Gas Natural all suffered from the virus. </div>
<div class="mol-para-with-font">
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">More than 45,000 ransomware attacks have hit more than 74 countries in last 10 hours, global security firm reports <a href="https://t.co/yNZvT6p92R">https://t.co/yNZvT6p92R</a> <a href="https://t.co/XLW0Emh3X1">pic.twitter.com/XLW0Emh3X1</a></p>— CNN (@CNN) <a href="https://twitter.com/CNN/status/863204904420212738">May 13, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">There’s a massive ransomware attack happening around the world — here’s how to protect yourself <a href="https://t.co/1fGtPDEvN3">pic.twitter.com/1fGtPDEvN3</a></p>— Business Insider (@businessinsider) <a href="https://twitter.com/businessinsider/status/863191333598486529">May 13, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">"Massive Disturbances" In German Rail System Due To <a href="https://twitter.com/hashtag/Ransomware?src=hash">#Ransomware</a> Attack <a href="https://t.co/NkElUYgVfU">https://t.co/NkElUYgVfU</a> <a href="https://twitter.com/hashtag/investing?src=hash">#investing</a> <a href="https://t.co/btlWgxI5x7">pic.twitter.com/btlWgxI5x7</a></p>— InvestopiaUk (@InvestopiaUk) <a href="https://twitter.com/InvestopiaUk/status/863160163250786304">May 12, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
Some
 big firms in Spain took pre-emptive steps to thwart ransomware attacks 
following a warning from the National Cryptology Centre of 'a massive 
ransomware attack'.</div>
<div class="mol-para-with-font">
Iberdrola and Gas 
Natural, along with Vodafone's unit in Spain, asked staff to turn off 
computers or cut off internet access in case they had been compromised.</div>
<div class="mol-para-with-font" id="ext-gen140">
Security
 teams at large financial services firms and businesses were reviewing 
plans for defending like Telefonica get hit is going to get 
everybody worried.against cyber attacks, according to executives with 
private cyber security firms.Chris
 Wysopal, chief technology officer with cyber security firm Veracode, 
said: 'Seeing a large telco</div>
<div class="mol-para-with-font">
'Now ransomware is affecting larger companies with more sophisticated security operations.'  </div>
<div class="mol-para-with-font">
<br /></div>
<div class="artSplitter mol-img-group">
<div class="mol-img" style="position: relative;">
<div class="image-wrap fff-pic" style="cursor: pointer;">
<img alt="The German rail system was also experiencing issues due to the ransomware. Photos surfaced on social media showing ticket machines at train stations having been affected" class="blkBorder img-share b-loaded" data-track-pos="2" height="476" id="i-1190d3f2c49d972" src="http://i.dailymail.co.uk/i/pix/2017/05/13/00/4040F88900000578-4500738-image-a-8_1494632740081.jpg" width="634" /></div>
<div class="container-36EYi vertical--v2Ug">
</div>
</div>
<div class="imageCaption">
The German rail system was also 
experiencing issues due to the ransomware. Photos surfaced on social 
media showing ticket machines at train stations having been affected. <i>dailymail</i></div>
</div>
<div class="artSplitter mol-img-group">
<div class="mol-img" style="position: relative;">
<div class="image-wrap fff-pic" style="cursor: pointer;">
</div>
</div>
</div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br />
<div class="mol-para-with-font">
Computer expert Lauri Love, who is facing 
extradition to the US over the alleged theft of data from government 
computers, said the attack is being powered by a 'top of the range cyber
 weapon' used by spies in the US. </div>
<div class="mol-para-with-font" id="ext-gen142">
'It
 appears the cyber attack affected so many computers in the UK in the 
NHS and in Spain by taking advantage of a very nasty vulnerability in 
Microsoft Windows, which was dumped by hacking group Shadow Brokers who 
obtained it from the NSA in America.'</div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br />
<blockquote class="tr_bq">
<h3 class="mol-factbox-title" id="ext-gen150">
<span style="background-color: #d9ead3;">WHO HAS BEEN AFFECTED BY CYBER ATTACK</span>?</h3>
<div class="ins cleared mol-factbox-body">
<div class="mol-para-with-font">
<span class="mol-style-bold"><b>The UK's National Health Service</b>:</span> British hospitals and clinics were forced to send patients away and cancel appointments.</div>
<div class="mol-para-with-font">
<span class="mol-style-bold"><b>Russia</b>:</span>
 The country was believed to be among the worst hit when computers in 
the interior ministry were hit. Megafon - Russia's second largest phone 
network - had also been affected.</div>
<div class="mol-para-with-font">
<span class="mol-style-bold"><b>German railway stations</b>: </span>Photos surfaced on social media appeared to show ticketing computers at train stations having been affected by the cyber attack.</div>
<div class="mol-para-with-font">
<span class="mol-style-bold"><b>Spanish companies</b>:</span> Telecoms giant Telefonica, power firm Iberdrola and utility provider Gas Natural all suffered from the virus.</div>
<div class="mol-para-with-font" id="ext-gen149">
<span class="mol-style-bold"><b>FedEx</b>: </span>The shipping company confirmed they were affected and were implementing remediation steps.</div>
</div>
</blockquote>
</div>
</div>
<div class="mol-para-with-font" id="ext-gen138">
In December last year it 
was revealed about 90 per cent of NHS Trusts were still running Windows 
XP, two and a half years after Microsoft stopped supporting the system.</div>
<div class="mol-para-with-font" id="ext-gen140">
Citrix,
 an American software company, sent a Freedom of Information request to 
63 NHS Trusts, 42 of which responded. It revealed that 24 Trusts were 
unsure when they would even upgrade, The Inquirer reported.</div>
<div class="mol-para-with-font" id="ext-gen137">
Windows
 XP was released more than 15 years ago and is now particularly 
vulnerable to viruses. Microsoft stopped providing virus warnings for 
the ageing Windows XP in 2015.</div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br /><div class="mol-para-with-font">
A number of UK hospitals continue to run 
the outdated software, including East Sussex, Sheffield's Children's 
hospital and Guy's and St Thomas' NHS Trust.</div>
<div class="mol-para-with-font" id="ext-gen141">
Hours
 after news of the cyber attacks broke, a Microsoft spokesman revealed 
that customers who were running the company's free antivirus software 
and who had enabled Windows updates were 'protected' from the attack.</div>
<div class="mol-para-with-font">
It raises questions about why NHS computers using the operating system were not shielded from the ransomware.</div>
<div class="mol-para-with-font">
The
 spokesman said: 'Today our engineers added detection and protection 
against new malicious software known as Ransom:Win32.WannaCrypt.</div>
<div class="mol-para-with-font">
<br /></div>
<div class="mol-para-with-font">
'In March, we provided a security update which provides additional protections against this potential attack.</div>
<div class="mol-para-with-font">
'Those who are running our free antivirus software and have Windows updates enabled, are protected.</div>
<div class="mol-para-with-font">
'We are working with customers to provide additional assistance.'</div>
<div class="mol-para-with-font">
One
 message circulated online claims the hackers demand 300 US dollars 
(£230) in the virtual currency bitcoins  to relinquish control of their 
IT systems.</div>
<div class="mol-para-with-font">
The pop-up contains a 
countdown clock with a deadline of next Friday. At least 10 payments of 
around USD$ 300 have been made to Bitcoin accounts that the hackers have
 asked to be paid on Friday.</div>
<div class="mol-para-with-font">
But, 
although all Bitcoin transactions are public, we cannot see who made the
 payments so cannot know if they have been made by anyone in the NHS. </div>
<div class="mol-para-with-font">
'Non
 urgent' appointments and operations were postponed across the UK and 
some hospitals diverted ambulances to neighbouring ones to ensure 
patient safety.</div>
<div class="mol-para-with-font">
<br /></div>
<div class="mol-para-with-font">
Computer systems were 
switched off or immobilised and key services including the  bleeper 
system for doctors were also believed to be down.</div>
<div class="mol-para-with-font">
In
 the minutes after the attack one doctor in the UK tweeted: 'Massive NHS
 hack cyber attack today. Hospital in shut down. Thanks for delaying 
emergency patient care & endangering lives. A******s'.</div>
<div class="mol-para-with-font">
NHS
 Digital, which is responsible for the health service's cyber security, 
says computer systems are believed to have been hit by a ransomware 
cyber attack using malware called 'Wanna Decryptor'.  Three hospitals in
 America were hit in the same way last year.</div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br /></div>
</div>
<img alt="Ransomware: How do hackers take your data hostage?" class="blkBorder img-share b-loaded" data-track-pos="5" height="459" id="i-ca05cc85bdddf4c5" src="http://i.dailymail.co.uk/1/2017/05/12/20/wire-559251-1494617254-358_634x459.jpg" width="634" /><br />
Ransomware: How do hackers take your data hostage?<br />
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">this is what a digital pandemic looks like <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> <a href="https://twitter.com/hashtag/worm?src=hash">#worm</a> <a href="https://twitter.com/hashtag/infosec?src=hash">#infosec</a> <a href="https://twitter.com/hashtag/ShadowBrokers?src=hash">#ShadowBrokers</a> <a href="https://twitter.com/hashtag/ITsecurity?src=hash">#ITsecurity</a> <a href="https://twitter.com/hashtag/ciochat?src=hash">#ciochat</a> <a href="https://t.co/37YD3vmzeM">pic.twitter.com/37YD3vmzeM</a></p>— tux (@osi_model13) <a href="https://twitter.com/osi_model13/status/863170984374882305">May 12, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">'NSA malware' released by Shadow Brokers hacker group....& turns up again on May 12th.. <a href="https://t.co/e2H1a2ugUN">https://t.co/e2H1a2ugUN</a></p>— Eimear Lowe (@eimearlowe) <a href="https://twitter.com/eimearlowe/status/863132231929409541">May 12, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br /><div class="mol-para-with-font">
The National Cyber Security Centre is investigating and is working with Britain's FBI - the National Crime Agency.<span class="mol-style-bold"> </span></div>
<div class="mol-para-with-font">
GP
 surgeries hit in the attack say their phones went down and patients 
should avoid calling unless 'absolutely necessary' and doctors were back
 to using pen and paper in some areas.</div>
<div class="mol-para-with-font">
Explaining
 the fallout, one doctor said in a message shared on Twitter: 'So our 
hospital is down. We got a message saying your computers are now under 
their control and pay a certain amount of money. And now everything is 
gone.'  </div>
<div class="mol-para-with-font">
A screenshot obtained by the 
Health Service Journal (HSJ) purported to show the pop-up that appeared 
on at least one of the computers affected.</div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br /><div class="mol-para-with-font">
It said: 'Your important files are 
encrypted. Maybe you are busy looking for a way to recover your files, 
but do not waste your time.</div>
<div class="mol-para-with-font">
'Nobody can recover your files without our decryption service.'</div>
<div class="mol-para-with-font">
It goes on to demand payment, otherwise the files will be deleted. It gives a deadline of next Friday afternoon, May 19, to pay.</div>
<div class="mol-para-with-font">
The
 HSJ said services affected were thought include archiving systems for 
X-rays, pathology test results, phone and bleep systems, and patient 
admin systems.  </div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<img alt="Blackpool Victoria Hospital is one of many across the country hit - operations have been cancelled and ambulances diverted " class="blkBorder img-share b-loaded" data-track-pos="8" height="476" id="i-136275e05ccf3d31" src="http://i.dailymail.co.uk/i/pix/2017/05/12/16/403CD8D100000578-4500080-image-a-28_1494601608952.jpg" width="634" /> </div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
Blackpool Victoria Hospital is one of many across the country hit - operations have been cancelled and ambulances diverted. <i>dailymail</i> <div class="mol-para-with-font" id="ext-gen142">
<br /></div>
<div class="mol-para-with-font" id="ext-gen142">
Barts NHS Trust in east 
London said they are treating it as a 'major incident' to ensure they 
can 'maintain the safety and welfare of patients'.</div>
<div class="mol-para-with-font">
A spokesman said: 'We are experiencing a major IT disruption and there are delays at all of our hospitals. </div>
<div class="mol-para-with-font" id="ext-gen143">
'Ambulances
 are being diverted to neighbouring hospitals. The problem is also 
affecting the switchboard at Newham hospital but direct line phones are 
working. All our staff are working hard to minimise the impact and we 
will post regular updates on the website'. </div>
<div class="mol-para-with-font">
Fylde
 and Wyre NHS Trust and Blackpool Hospitals in Lancashire, East and 
North Hertfordshire NHS Trust and Derbyshire Community Health Services 
NHS Trust have admitted having problems. Colchester University Hospitals
 Trust is also a victim as is neighbouring Chelmsford in Essex.</div>
<div class="mol-para-with-font">
York
 Teaching Hospital NHS Foundation Trust which runs York and Scarborough 
hospitals has confirmed its computers have been affected by the 
widespread attack. </div>
<div class="mol-para-with-font">
They have urged people to be patient and avoid calling GP surgeries and hospitals unless 'absolutely necessary'. </div>
<div class="mol-para-with-font" id="ext-gen144">
NHS
 Merseyside said: 'Following a suspected national cyber attack we are 
taking all precautionary measures possible to protect our local NHS 
systems and services'. <i>dailymail</i></div>
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<br /></div>
</div>
</div>
</div>
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/Ransomware?src=hash">#Ransomware</a> dominates the EU, USA and India. <a href="https://t.co/Qz7rJS12cY">pic.twitter.com/Qz7rJS12cY</a></p>— Public Situation (@PublicSituation) <a href="https://twitter.com/PublicSituation/status/863156931019640832">May 12, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<br /></div>

Mysterious hacking collective called 'The Shadow Brokers' stole NSA superweapon and caused global cyber attack that is causing chaos in 74 countries

Several computers at a university in Italy were also randomly targeted in the cyber attack A global cyber attack using hacking too...

Errymath

Mysterious hacking collective called 'The Shadow Brokers' stole NSA superweapon and caused global cyber attack that is causing chaos in 74 countries

Latest

Archive

Subscribe