Services have been hit as ransom is demanded to unlock systems
New Zealand is likely to be affected by a massive global cybersecurity that is hitting dozens of countries by hackers reportedly using adapted stolen National Security Agency programs.
It was first reported in England - hackers gained access to the National Health Service computers, effectively shuttering the entire system.
Patients were told to stay home; doctors and nurses were unable to access email or medical records and had to take notes by hand. The hackers demanded a ransom, to be paid in bitcoin.
A specialist in cyber threats says it's highly likely the ransomware bug Wanna Cry is already in New Zealand.
Ransom demands have been reported from over 70 countries so far.
Auckland University's Lech Janczewski says there's nothing random about the targets.
By Friday afternoon, though, it was clear that this was not a limited attack. Businesses in at least 11 other countries reported similar cyberattacks. Many were paralyzed, reports Washington Post.
There's still a lot we don't know. (We'll be updating this post!) But here's what we do know, so far:
As its name implies, ransomware works like a hostage-taker.
Once your computer is infected, the attack can do a couple of things. One common approach: Your files will be encrypted or converted into a different language for which only the hacker has the cipher. Often, you won't even know you've been targeted until you try to open a file.
Another, more damaging version is what happened Friday: The ransomware locks you out of your entire system.
During the attack in England, computer screens showed a message demanding $300 in bitcoin in exchange for the decryption key that would unlock the files.
Victims had three days to pay before the fee was doubled. (Something very similar happened to a hospital system in Los Angeles a couple of months ago.
The hospital ended up paying about $17,000. The hackers even set up a help line to answer questions about paying the ransom.)
This attack relies on something called the Wanna Decryptor, also known as WannaCry or WCRY.
These kinds of attacks are particularly hard to spot, especially because hackers are always tweaking them. The Wanna Decryptor being used is just weeks old, and it was just updated.
How do computers get infected?
Lots of ways.
Hackers can get ransomware on your system if you download an infected piece of software or a PDF. They can also use a phishing email to direct you to an infected website.
In this case, hackers sent a zip file attachment in an email. When victims clicked on it, their computers were infected. But the attack didn't stop there. The ransomware spread through the hospitals' and businesses' computer networks. "Once you get a foothold in the system, other users will start to run those pieces of software," explained Clifford Neuman, who directs the University of Southern California's Center for Computer Systems Security.
Here's the screen that comes up on hacked computers. Photo / Sourced: Washington Post
What's Edward Snowden got to do with it?
Though we don't know for sure, it looks like the hackers exploited a vulnerability in the Windows operating system. Microsoft knew about this many months ago and put together a patch, but many businesses are slow to update their operating systems because they have to evaluate the updates' impact on other software. (Or, like most of us, they just keep running old versions of software forever.)
Microsoft knew about this vulnerability because it was exposed by former National Security Agency contractor Edward Snowden: Apparently the U.S. surveillance agency had been exploiting it for its own use.
Who's behind the attack?
Investigators are pursuing a lot of leads, but so far they have very little concrete evidence. They do think it's the work of criminals, not a foreign power.
They know the original hacking tool was leaked by a group called the Shadow Brokers, which dumps stolen NSA tools online. But they don't know who the Shadow Brokers hackers are or whether they perpetrated the attack.
Who's been hit so far?
Britain's National Health Service (NHS) was a major victim. More than 40 hospitals and health facilities across England were affected, and many staff members were locked out of their computers, unable to access patient medical records, appointment schedules and internal emails.
It was so bad that officials warned people to stay home unless they were having a medical emergency. Hospitals in Scotland and Wales were affected, too.
But investigators quickly discovered that the NHS was not the only, or even the intended, victim. The attack was wide-ranging and affected organizations across the country.
Meanwhile, Spain's National Cryptologic Center, part of that country's intelligence agency, reported a "massive ransomware attack" against Spanish organizations.
At Telefonica, in Madrid, security department officials ordered employees to switch off their computers and disconnect from WiFi.
This is much bigger than that, though. According to Britain's Independent newspaper, these attacks may stretch around the globe, from Portugal to Turkey, Indonesia, Vietnam, Japan, Germany and Russia. It "is much larger than just the NHS," Travis Farral, director of security strategy for cybersecurity firm Anomali Labs, told the Independent. "It appears to be a giant campaign that has hit Spain and Russia the hardest." (Here's a live map tracking the malware.)
What are investigators trying to do to catch the attackers?
It can be hard to track down the perpetrators in attacks like this, but it's not impossible.
One method: follow the money. It's possible to trace where a bitcoin payment ends up. "Despite what people tend to think, it's highly traceable," said Neuman, of USC. "You can see the flow of funds through the bitcoin system."
That doesn't mean, however, that you'll know who actually ends up with the money, especially once it's pulled out of the system. Hackers are able to hide that in lots of different ways.
Experts will also be searching the code itself for clues. Hackers each write codes in different ways, leaving identifiable traces of their work, like a signature.
What can I do to stay safe?
First, back up your hard drive. You should be keeping frequent backups anyway, in case your computer dies on its own. But if your computer gets hacked, you'll be able to retrieve your data without paying a ransom.
If you run a business, back up every computer in your office and have a plan for what to do if your system goes down for a while. Be smart about setting up your network, so that most users don't have complete access to the system.
