The IT Nerd

Honda Motor company got pwned by hackers via some sort of ransomware. And the attack took down the car maker globally. That make it the most devastating cyberattacks that I have heard of. Here’s what the BBC reported:

“Honda can confirm that a cyber-attack has taken place on the Honda network,” the Japanese car-maker said in a statement.

It added that the problem was affecting its ability to access its computer servers, use email and otherwise make use of its internal systems.

“There is also an impact on production systems outside of Japan,” it added.

“Work is being undertaken to minimise the impact and to restore full functionality of production, sales and development activities.”

The firm – which makes motorcycles, cars, generators and lawn mowers, among other products – said one of its internal servers was attacked externally. 

It added that “the virus had spread” throughout its network, but did not provide further details.

And:

The company has confirmed that work at the UK plant has been halted alongside a suspension of other operations in North America, Turkey, Italy and Japan.

Dave Palmer, director of technology for Darktrace had this to say:

“This reported attack is a stark reminder of the risks that come from hyper connectivity.

EKANS is a relatively new form of ransomware – a tool which has the power to lock down industrial control systems and machinery in factories.

Critical environments do not fail gracefully. There isn’t the option of reverting to pen and paper and muddling along.

We need to build in cyber resiliency so these systems are able to resist and fight back against cyber-attacks. Last month, AI detected an attempted ransomware attack at a steel manufacturer and automatically stopped the attack from spreading to the sensitive (and much more valuable) industrial control systems avoiding any shut down of systems.

Now that industrial environments cannot simply be air-gapped to keep them safe, we need to invest in artificial intelligence systems that can work in the background to automatically and dynamically block attacks that not only bleed from IT but originate in industrial systems.”

Hopefully Honda will do some sort of post mortem on this and figure out how to improve their environment to avoid this situation in the future. I say that because shutting down production can’t be cheap. I’m going to guess that it’s tens if not hundreds of millions of dollars. Something a company like Honda can afford. I will also say that other companies should be watching so that they can learn from this and don’t become the next Honda.

Reuters is reporting that a previously unknown IT firm in India were apparently hackers for hire who spied on a variety of high value targets. Here’s the details:

A little-known Indian IT firm offered its hacking services to help clients spy on more than 10,000 email accounts over a period of seven years. New Delhi-based BellTroX InfoTech Services targeted government officials in Europe, gambling tycoons in the Bahamas, and well-known investors in the United States including private equity giant KKR and short seller Muddy Waters, according to three former employees, outside researchers, and a trail of online evidence. A cache of data reviewed by Reuters provides insight into the operation, detailing tens of thousands of malicious messages designed to trick victims into giving up their passwords that were sent by BellTroX between 2013 and 2020. The data was supplied on condition of anonymity by online service providers used by the hackers after Reuters alerted the firms to unusual patterns of activity on their platforms. On the list: judges in South Africa, politicians in Mexico, lawyers in France and environmental groups in the United States. These dozens of people, among the thousands targeted by BellTroX, did not respond to messages or declined comment. 

Researchers at internet watchdog group Citizen Lab, who spent more than two years mapping out the infrastructure used by the hackers, released a report here on Tuesday saying they had “high confidence” that BellTroX employees were behind the espionage campaign. “This is one of the largest spy-for-hire operations ever exposed,” said Citizen Lab researcher John Scott-Railton. Reuters was not able to establish how many of the hacking attempts were successful.

This firm at first blush seem to be a version of the rather infamous NSO Group. But to be clear, it doesn’t matter how successful or not that they happen to be. The fact is that groups like these are a legitimate threat that we’ll all need to deal with. Thus my advice for businesses and even individuals would be to make sure that your cyber securities are “on point” as the kids say so that you can avoid being a victim of a group like this.