What we can learn from the Baltimore services hack

By

The Situation

On May 7th 2019, hackers digitally seized roughly 10,000 Baltimore government computers and demanded payment of 13 Bitcoins ($148,151 AUD) to free them back up. Using a ransomsware called RobbinHood, hackers have made it impossible to access servers without a digital key that only they possess.

What is a ransomware attack?
A ransomware attack is where hackers deploy malicious software to block access and take control over computer systems—in this case Baltimore city services and processes.

For three weeks city employees have been locked out of their accounts, while citizens have been unable to access vital services such as sites to pay water bills, property taxes and parking tickets.

A leaked N.S.A. tool, EternalBlue, was also used to exploit a vulnerability in unpatched software that allowed hackers to spread their malware faster and farther than they otherwise would have been able to.

This comes just 15 months after the attack on Baltimore’s 911 system, where hackers were able to disable the city’s 911 system for a day.

The Baltimore hackers ransom note demanded payment of 3 bitcoins per system unlocked, which totalled 13 bitcoins to unlock all seized systems. The note also threatened to increase the ransom if it were not paid within four days, as well as stating that information would be lost forever if it wasn’t paid within 10 days.

Government email systems and payment platforms remain offline, as well as affecting Baltimore’s property market as officials aren’t able to access systems needed to complete real estate sales.

Over 20 municipalities in the US have been hit by cyberattacks in 2019 alone, with an attack on Atlanta costing upwards of $17 million to fix.

 

The Takeaway

It’s important to note that ransomware attacks aren’t new. In 2017, a ransomware called WannaCry target tens of thousands of computers using Microsoft Windows operating systems in more than 100 countries. This attack included corporations in the UK, France, Russia, Israel and Ukraine as well as attacks on hospitals.

Ransomware schemes have become more effective since the invention of Bitcoin in 2009. Conventional payment networks make it difficult to accept payments without revealing your identity. Some ransomware schemes are so elaborate that customer service agents are hired to help victims obtain bitcoin and pay their ransom.

Since WannaCry, many organisations and sectors have made improvements to their security and security practices.

eStorm recommends taking stock of your networks to understand your exposure, assess the potential risks and patch vulnerable areas. We also recommend a multi-layered approach to security that includes:

 

If you have any questions about your business security, feel free to contact us at any time on (07) 3120 0640, email [email protected] or use the live-chat feature on our website between the hours of 9am and 5pm Monday to Friday.

How To Protect Yourself Against Email Attacks

By

With the Australian Governments introduction of the Notifiable Data Breach Scheme on February 22nd 2018, it is now more important than ever to protect yourself against all forms of attacks.

An incident at a KFC franchisee highlights that even the most seasoned IT professional can fall victim to a phishing attack, reported IT News on Tuesday the 20th of March 2018.

Phishing is the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication.

An IT manager at a Brisbane-based Collins Foods, the operators of hundred of KFC stores in Australia, Germany and the Netherlands, clicked an unsafe link.

This one simple action allowed anonymous attackers to briefly take control of the manager’s email account, which allowed them to send out additional phishing emails masquerading as invoices to an entire data base of contacts.

The company was able to quickly spot and address the issue by notifying those they believe had been recipients of the fake invoices via email.

The issue was a much needed reminder to all organisations of the need to remain alert, monitor processes and ensure procedures are in place for speedy responses.

How you can avoid email phishing attacks

  • Never click on hyperlinks

Good practice is to avoid clicking on any hyperlinks included within the confines of an email. This is particularly important when you have received an email from an unknown sender.

If you do however feel the need to check out the website the link is associated with, you should always enter the URL into a web browser manually.

  • Verify HTTPS

Whenever confidential information is being conveyed online, the address bar should always read “HTTPS” as opposed to the standard “HTTP”. The “S” confirms that the data is being conveyed through a secure and trustworthy channel.

  • Always check the “from” address

This is a relatively simple, yet often overlooked method for identifying potentially malicious email.

Copying the look of a trustworthy email or organisation is easy, however the email address itself is another can of worms.

Potentially malicious emails attempting to masquerade as the legitimate source often have additional numbers and letters in the email address, or even a misspelling of the legitimate organisations name.

  • Never enter sensitive information into a pop up window

Pop up windows are often used by phishers to extract information or to direct you to unsafe sites. Pop up windows are good to avoid altogether, unless from those you know to be a trustworthy source.

  • Keep antivirus and firewall current

While these both seem like rather obvious methods for avoiding attacks, you would be surprised by the number of people who fail to take this basic step.

Phishers, scammers and attackers are constantly changing and upgrading their schemes, therefore remaining current with your own protections is an invaluable first line of defence.

Learn more about a multi-layered approach to security.

If you’d like any further information, assistance with your IT needs or you simply don’t know where to start – please feel free to call us on (07) 3120 0640 or email us at [email protected].

 

Sources:
https://www.itnews.com.au/news/when-an-it-manager-falls-victim-to-a-phish-487280
http://www.globallearningsystems.com/blog/post/10-best-practices-to-avoid-email-phishing-attacks/