The IT Nerd

Many news sites including Motherboard are reporting that a massive ransomware attack is underway. Computers in Spain, France, Ukraine, Russia, and other countries have apparently been hit by this:

The attacks bear some resemblance to the recent WannaCry outbreak, in which thousands of computer systems were locked down with ransomware around the world.

Motherboard has seen several reports of infections shared by victims on Twitter. We were not able to immediately confirm the veracity of the reports, but several security researchers and firms also reported the attacks.

“We are seeing several thousands of infection attempts at the moment, comparable in size to Wannacry’s first hours,” Costin Raiu, a security researcher at Kaspersky Lab, told Motherboard in an online chat.

Judging by photos posted to Twitter and images provided by sources, many of the alleged attacks involved a piece of ransomware that displays red text on a black background, and demands $300 worth of bitcoin.

“If you see this text, then your files are no longer accessible, because they are encrypted,” the text reads, according to one of the photos. “Perhaps you are busy looking for a way to recover your files, but don’t waste your time. Nobody can recover your files without our decryption service.”

I suspect that this will be a very long day for IT admins in various places around the world. And we shouldn’t be shocked that this is happening as it was only a matter of time before something like this happened. The question is, how bad can this get?

Watch this space for updates as they come.

UPDATE: The ransomware in question is called Petya. Many security experts are theorizing that it is spreading so fast because it is leveraging the same NSA supplied attack vector that the last epic cyberattack used. Thus a fully patched Windows system should be able to be resistant to this ransomware.

I’m going to go out on a limb and say that heads are about to roll over this…. If they already haven’t. I say that because according to many outlets including Bloomberg, numerous Ohio Government website have been pwned by hackers who defaced the websites with messages purported to be from the terrorist group known as the Islamic State or IS:

Ten state websites and two servers were affected, and they’ve been taken off line for an investigation with law enforcement into how the hackers were able to deface them, said Tom Hoyt, a spokesman for the Ohio Department of Administrative Services.

The Ohio governor’s website wasn’t loading on Sunday afternoon, and a cached version showed the message “hacked by Team System Dz.’’ It said, “You will be held accountable Trump, you and all your people for every drop of blood flowing in Muslim countries’’ and added, “I love the Islamic state.”

Lovely. But I’m really not focused on whomever did this. The real question is why in 2017 was anyone actually able to do this? Website defacement isn’t new. Neither is how to defend against this sort of thing. Take these suggestions, or these suggestions for example. I’m sure as I am typing this there is a root cause analysis going on to figure out how these hackers got in, and who they are. The public will likely never see it, but it’s a safe bet that if someone in the IT department in Ohio screwed something up or missed something, they may be mass e-mailing their CV to find a new job in short order.