57,000 Detections, 74 Countries Affected by Global Ransomware

 

Go here for more information on malware affections.

Further, US-CERT, by DHS has this information.

 

 

Older machines running XP do not appear to be affected. Meanwhile, about a month ago:

Microsoft responds to NSA’s Windows exploits, urges customers to upgrade to supported versions

Remember, this NSA vault toolkit was stolen, leaked and published by WikiLeaks, Julian Assange. In some cases, it could be a deadly threat to life considering the intrusions into hospitals. The other blame goes to the Russian cyber gang, ShadowBrokers.

Russian-linked cyber gang Shadow Brokers blamed for NHS computer hack 

Ransom message found on NHS computersCourtesy: TelegraphUK: Ransom message found on NHS computers

CyberScoop: Large organizations on every continent are being hit by a global campaign of ransomware attacks on Friday, unfortunately, average ransomware demand has increased significantly. Machines are being infected using exploits developed by the U.S. National Security Agency and leaked by the group known as ShadowBrokers, according to authorities.

More than 57,000 detections in 74 countries have been recorded. Russia appears to be the most infected country by far, according to cybersecurity firms Kaspersky and Avast.

The “number [is] still growing fast,” according to Costin Raiu, Kaspersky’s director of research.

Hospitals across England were forced to divert emergency patients, according to the National Health Service. Other hospitals are asking patients to avoid coming in except for emergencies, news reports said.

In Spain, victims including the telecommunications company Telefónica told employees to shut down machines and networks in an effort to stop the spread of the malware. Other victims include Gas Natural and Iberdrola, an electric utility firm.

The ransomware campaign is caused by “exploiting the vulnerability described in bulletin MS17-010 using EternalBlue / DoublePulsar,”Spain’s Computer Emergency Readiness Team explained on Friday. “Infection of a single computer can end up compromising the entire corporate network.”

EternalBlue and DoublePulsar are code names for NSA hacking tools used to infect thousands of machines around the world since the NSA tools leaked in April.

That description from Spanish authorities and the work of several researchers point directly to NSA tools hacked and leaked by ShadowBrokers. The patch that Microsoft published in March assigned the designation MS17-010 to the vulnerability.

A widespread “bloodbath” from criminals has been expected by experts since the leak.

The ransomware “infects the machine by encrypting all its files and, using a remote command execution vulnerability through SMB, is distributed to other Windows machines on the same network. Microsoft published the vulnerability on March 14 in its bulletin and a few days ago a proof of concept was released that seems to have been the trigger of the campaign.” SMB is Microsoft’s Server Message Block protocol for network file sharing.

The attacks in different countries have been linked to the same group, according to the Financial Times.

The U.S. Department of Homeland Security is “coordinating with our international cyber partners” in Europe and Asia, a spokesperson told CyberScoop. “The Department of Homeland Security stands ready to support any international or domestic partner’s request for assistance. We routinely provide cybersecurity assistance upon request, including technical analysis and support.  Information shared with DHS as part of these efforts, including whether a request has been made, is confidential.”

Security researcher Kevin Beaumont advised patching machines immediately:

** Kevin Beaumont?Verified account @GossiTheDog5h5 hours ago 

Confirmed – wcry ransomware spreading across Europe uses EternalBlue/MS17-010/SMB. PATCH NOW EVERYWHERE.

Spanish authorities confirmed the ransomware is a version of WannaCry (also known as WannaCrypt0r), according to the National Cryptology Center. In Spain, the newspaper El Mundo is reporting that “early indications point to an attack originating in China.”

“Given the rapid, prolific distribution of this ransomware, we consider this activity poses high risks that all organizations using potentially vulnerable Windows machines should address,” a spokesperson from the cybersecurity firm FireEye told CyberScoop. “Organizations seeking to take risk management steps related to this campaign can implement patching for the MS17-010 Microsoft Security bulletin and leverage the indicators of compromise identified as associated with this activity.”

FireEye has yet to see a U.S.-based company be affected by the ransomware worm.

An estimated 25 health facilities in London and across England have been hit, according to the NHS. St Bartholomew’s Hospital in London, one of the victims, received warnings earlier this year that computers using Windows XP were vulnerable, reported the technology news site the Inquirer. Increasingly, some infected hospitals are not accepting phone calls or internet communications. The Derbyshire Community Health Services NHS Trust has reportedly shut down all of its IT systems.

“At this stage we do not have any evidence that patient data has been accessed,” an NHS statement said. “We will continue to work with affected organizations to confirm this.”

East and North Hertfordshire NHS trust, a hospital just north of London, publicly acknowledged “a major IT problem” that is “believed to be caused by a cyber attack.”

“The trust is postponing all non-urgent activity for today and is asking people not to come to A&E – please ring NHS111 for urgent medical advice or 999 if it is a life-threatening emergency,” according to a statement. “To ensure that all back-up processes and procedures were put in place quickly, the trust declared a major internal incident to make sure that patients already in the trust’s hospitals continued to receive the care they need.”

News of the English hospitals being hit with ransomware spread quickly among doctors and hospital employees, including in a widely shared message from an English doctor now making the rounds on social media.

**

If.ra? @asystoly6h6 hours ago  Why would you cyber attack a hospital and hold it for ransom? The state of the world ?

“So our hospital is down,” the doctor wrote. “We got a message saying your computers are now under their control and pay a certain amount of money. And now everything is gone.”

DoJ, AG Sessions, Effectively Immediately

Read the 2 page memo here.

Sessions ends Obama-era leniency on sentencing, infuriating civil rights groups

FNC: Attorney General Jeff Sessions announced Friday that he has told prosecutors to pursue the most serious charges possible against criminal suspects – a stunning reversal of Obama-era policies, and a move that infuriated civil rights groups.

“We will enforce the laws passed by Congress pure and simple,” he said at an awards ceremony in Washington D.C, adding that prosecutors deserved to be “unhandcuffed and not micro-managed from Washington.”

“This is a key part of President Trump’s promise to keep America safe,” Sessions said. “We’re seeing an increase in violent crime in our cities – in Baltimore, Chicago, Memphis, Milwaukee, St. Louis and many others.  The murder rate has surged 10 percent nationwide – the largest increase since 1968.”

In a letter to 94 U.S. attorneys Thursday night, Sessions called it a “core principle” that prosecutors charge and pursue “the most serious and readily provable offense.” Sessions defined the most serious offenses as those that carry the most substantial guidelines sentence.

Sessions noted that “there will be circumstances in which good judgment would lead a prosecutor to conclude that a strict application” of the policy is not warranted, but that any exceptions must first be approved by a U.S. attorney, assistant attorney general, or a designated supervisor.

The move, which will send more criminals to jail and for longer terms by triggering mandatory minimum sentences, explicitly reverses policies set in motion by President Obama’s former Attorney General Eric Holder – who implemented the “Smart on Crime” drug sentencing policy that focused on not incarcerating people who committed low level, non-violent crimes. DOJ officials call it a “false narrative” and say unless a gun is involved, most of those cases aren’t charged period.

Officials say Holder’s “Smart on Crime” policy “convoluted the process,” and left prosecutors applying the law unevenly, which they said “is not Justice.”

But civil rights groups blasted the process, with the American Civil Liberties Union describing the move as a move that will “reverse progress” and repeat the War on Drugs, which it called a “failed experiment.”

“With overall crime rates at historic lows, it is clear that this type of one-dimensional criminal justice system that directs prosecutors to give unnecessarily long and unfairly harsh sentences to people whose behavior does not call for it did not work,” Udi Ofer, director of the American Civil Liberties Union’s Campaign for Smart Justice.

The policy was also criticized by Sen. Rand Paul, R-Ky., who said mandatory minimums have “unfairly and disproportionately incarcerated too many minorities for too long.”

“Attorney General Sessions new policy will accentuate that injustice. Instead we should treat our nation’s drug epidemic as a health crisis and less as a lock ‘em up and throw away the key problem,” he said.

However, the National Association of Assistant United States Attorneys backed the move, saying it would make the public safer and give prosecutors to “tools that Congress intended” to lock up drug dealers and dismantle gangs.

 


Wait for it…nah never mind…former DOJ AG, Eric Holder has already responded.

Former Attorney General Eric Holder blasts Sessions memo as ‘dumb on crime’

Former Attorney General Eric Holder blasted a new Justice Department policy on prosecutions and sentencing, calling it “dumb on crime.”

“The policy announced today is not tough on crime. It is dumb on crime. It is an ideologically motivated, cookie-cutter approach that has only been proven to generate unfairly long sentences that are often applied indiscriminately and do little to achieve long-term public safety,” Holder said in a statement Friday shortly after the new department memo.

Attorney General Jeff Sessions released a memo early Friday directing prosecutors to “charge and pursue the most serious, readily provable offense” in all cases going forward.

The Sessions memo reverses one issued by Holder in 2013 that encouraged federal prosecutors to seek the most harsh punishment for only “serious, high-level, or violent drug traffickers” instead of lower-level offenders.

Holder cited department data showing that since the implementation of his memo — the Smart on Crime directive — prosecutors have been able to successfully focus more resources on higher level drug offenders such as kingpins and cartel leaders.

“The data showed that while they brought fewer indictments carrying a mandatory minimum sentence, the prosecutions of high-level drug defendants had risen and that cooperation and plea rates remained effectively the same,” Holder said. “These reversals will be both substantively and financially ruinous, setting the Department back on track to again spending one-third of its budget on incarcerating people, rather than preventing, detecting, or investigating crime.”

2008, the Russians Hacked Obama’s Campaign Too

Why are we learning this now? It is a dereliction of duty to advise the American electorate, campaign operators and all later political candidates, regardless of the kind of race. Further, should we be blaming Obama on this and did he invite the FBI to investigate? If so, the matters of phishing operations and Russia should have been a clarion call.

Further, why would Obama and Hillary even consider ‘resetting’ relations with Russia? Oh yeah……’cut it out Vladimir’..remember that?

Okay read on….the anger mounts.

Exclusive: Russian Hackers Attacked the 2008 Obama Campaign

Jeff Stein: Russian hackers targeted the 2008 Barack Obama campaign and U.S. government officials as far back as 2007 and have continued to attack them since they left their government jobs, according to a new report scheduled for release Friday.

The targets included several of the 2008 Obama campaign field managers, as well as the president’s closest White House aides and senior officials in the Defense, State and Energy Departments, the report says.

It names several officials by title, but not by name, including “several officials involved in Russian policy, including a U.S. ambassador to Russia,” according to a draft version of the report, authored by Area 1 Security, a Redwood City, California, company founded by former National Security Agency veterans.

“They’re still getting fresh attacks,” the company says.

The attacks on their email accounts have continued as the officials migrated to think tanks, universities and private industry, the company says. The favored weapon of the Russians and other hackers is the so-called “phishing” email, in which the recipient is invited to click on a innocent-looking link, which opens a door to the attackers.

China can’t be excluded as a perpetrator in those attacks, Area 1 Security’s report says, but its new data “show that Russia tried to hack several members of the Obama campaign and could have done so at the same time as someone that achieved massive data exfiltration.”

Blake Darché, a former NSA technical analyst who co-founded Area 1 Security, tells Newsweek that “state-sponsored Russian hackers have been targeting United States officials and politicians since at least 2007 through phishing attacks.” Russian hackers reportedly breached the Joint Chiefs of Staff email system in 2015.

The company says one of the Russian targets was a “deputy campaign manager” in the 2008 Obama campaign, but was otherwise unidentified in its report. There were a number of them over a period of time. One was Steve Hildebrand. Reached in Sioux Falls, South Dakota, where he now runs a specialty bakery and coffee shop, Hildebrand says he was “not aware” that he might have been a Russian target and didn’t remember being warned about cyberattacks of any kind during the campaign. Another senior 2008 campaign aide (and later White House National Security Council spokesman), Tommy Vietor, tells Newsweek he had “no knowledge” of Russian hacking at the time.

Besides top officials in the Energy, Defense and State departments, the Area 1 Security report cites a half-dozen positions in the Obama White House that were targeted from 2008 through 2016, including the president’s deputy assistant, special assistant, the special assistant to the political director, advance team leaders for first lady Michelle Obama, and the White House deputy counsel. None of them could immediately be reached for comment.

Among the State Department targets named by Area 1 Security were three top offices dealing with Russia and Europe. Evelyn Farkas, who served as the Obama administration’s deputy assistant secretary of defense for Russia/Ukraine/Eurasia from 2012 to 2015, says she could not discuss matters that remain classified, but says “the biggest impact” she remembered offhand was the Russian hack of the Joint Chiefs.

Among the three top, unnamed targets at the Energy Department was the director of the Office of Nuclear Threat Science, which is responsible for overseeing the U.S. Nuclear Counterterrorism Program.

The Area 1 Security report names the “Dukes,” also known as “Cozy Bear” and APT-29, for the Obama attacks, the same Russian actors named in the 2015 and 2016 hacking of the Democratic National Committee (DNC) and the State Department.

In an interview, Darché calls the Dukes a front for Russia’s “premier intelligence-gathering arm,” which would be the SVR, or External Intelligence Service, the Kremlin equivalent to the CIA, although he declined to specifically name it. As opposed to the DNC hacks launched to steal and publicize information damaging to the campaign of Hillary Clinton, he says, the Russian offensives that Area 1 Security uncovered were clandestine “intelligence gathering operations” designed to secretly penetrate a wide variety of institutions and industry.

Oren Falkowitz, a former analyst at the National Security Agency who co-founded Area 1 Security, says he launched the company to stop phishing attacks, which until then was thought to be impossible because so many employees continue to click on risky links in emails. The key to the company’s success was persuading clients to let it monitor its servers, he told The New York Times in a 2016 interview.

In Friday’s report, Area 1 Security says it uses a “vast active sensor network” to detect and trace phishing attacks. It says it could imagine the Dukes “operating a giant spreadsheet where new targets are added, but never leave.” It “moves quickly, compromising a server or service to send out phishing emails from it, and then leaves, never returning to check for  bounced email messages to cull from its list.”

Most ex-officials don’t realize they are carrying “the blemish of being a Russian target into their new workplace,” the Area 1 Security report says.  As a result, “they give the Dukes beachheads in companies and organizations they never even planned on or imagined hacking,” such as Washington think tanks, defense contractors, lobbyist offices,  financial institutions and pharmaceutical companies stocked with high ranking former political, military and intelligence  officials.

Russia is “notoriously persistent in pursuing targets,” the report says. “It’s a lesson on why every organization needs great security.”

***

FireEye CEO: Russians are at Work in Election Hacking

FireEye CEO Kevin Mandia said Thursday that strengthening U.S. cybersecurity defenses begins with protecting the country’s own systems first, and he is hopeful the Trump administration will implement a strategy to defend from cyber threats, during an interview on FOX Business’ “Countdown to the Closing Bell.”

“You gotta protect critical infrastructure and under times of duress, you have to be able to have shields up as a nation, and I think this order is going to move toward that,” he said, referring to the executive order President Trump signed Thursday, aimed at strengthening the America’s infrastructure to help prevent cyberattacks.

Cyber hacking has been in the forefront of an FBI investigation over Russia’s alleged involvement in the 2016 presidential election. Mandia said he believes acting FBI Director Andrew McCabe will continue the investigation into these claims.

“When you awake the sleeping giant, they get the job done and I think the FBI, whenever they apply the resources at their disposal and their capability, they can get the job done as they see fit,” he said.

Mandia believes the Russians are at work in election hacking and thinks it will continue to happen.

“The tool in every emerging nation’s tool box now [is] a cyber component,” he said.

The FireEye CEO added that the risks from cyberattacks can’t be eliminated because persistent hackers are exploiting human trust and not exploiting systems.

Trump’s EO on Voter Fraud Commission

Read the text here. The ‘voting rights’ division at the Justice Department may just have an issue with this, but the commission should happen along with a technology fix going into the future. We cannot forget that DHS contacted several states prior to the voting season last Fall concerning registration databases and voting machines. Some states cooperated while others frankly did not only not trust government intrusion but DHS.

Image result for voter fraud

Trump signs executive order launching voter fraud commission

President Trump signed an executive order on Thursday to launch a commission to review alleged voter fraud, a White House official confirmed to Fox News, after months of claiming voter fraud in the 2016 presidential election.

The order, titled “Presidential Commission on Election Integrity,” would establish a bipartisan commission, chaired by Vice President Mike Pence, to review alleged voter fraud and suppression. Kansas Secretary of State Kris Kobach, who has investigated voter fraud in Kansas, will serve as vice chair.

“The commission will also include individuals with knowledge and experience in election management and voter integrity,” White House Deputy Press Secretary Sarah Huckabee-Sanders said on Thursday at the White House daily press briefing. “The commission will review policies and practices that enhance or undermine confidence in elections and identify system vulnerabilities.”

Huckabee-Sanders announced five members to the commission on Thursday: Indiana Secretary of State Connie Lawson (R), New Hampshire Secretary of State Bill Gardner (D), Maine Secretary of State Matthew Dunlap (D), Christie McCormick, commissioner of the election assistance commission, and former Ohio Secretary of State Ken Blackwell(R).

The White House said the commission will review practices that affect the integrity of federal elections–spanning improper registrations, improper voting, fraudulent registrations, fraudulent voting and voting suppression.

“We expect the report to be complete by 2018,” Huckabee-Sanders said. “The experts will follow the facts where they lead–we’ll share updates as we have them.”

Trump originally vowed to create such a commission in January. Days after his inauguration, Trump took to Twitter calling for a “major investigation into VOTER FRAUD,” saying that depending on the results of the investigation, “we will strengthen up voting procedures!” He cited “illegal” voters and “those registered to vote who are dead (and many for a long time)” which he claimed cost him the popular vote, which Hillary Clinton won by 3 million votes.

But on Thursday, Senate Minority Leader Charles Schumer, D-N.Y., slammed the commission.

“Putting an extremist like Mr. Kobach at the helm of this commission is akin to putting an arsonist in charge of the fire department,” Schumer said. “President Trump has decided to waste taxpayer dollars chasing a unicorn and perpetuating the dangerous myth that widespread voter fraud exists.”

Voting experts and many lawmakers have said they haven’t seen anything to suggest that millions of people voted illegally, including House Oversight Committee Chairman Jason Chaffetz. The Utah Republican said his committee won’t be investigating voter fraud.

In a lunch meeting with senators in February, Trump said that he and former Republican Sen. Kelly Ayotte would have won in New Hampshire if not for voters bused in from out of state. New Hampshire officials have said there was no evidence of major voter fraud in the state.

In a February interview with Bill O’Reilly, Trump said the main issue of voter fraud was registration, and vowed to look at the situation “very, very carefully.”

“When you look at the registration and you see dead people that have voted, when you see people that are registered in two states, that have voted in two states, when you see other things, when you see illegals, people that are not citizens and they are on registration roles,” Trump said. “We can be babies, but you take a look at registration, you have illegals, you have dead people, you have this, it’s a really bad situation, it’s really bad.”

The decision to revisit the voter fraud issue comes during a tumultuous week, after Trump on Tuesday fired FBI Director James Comey. The administration cited Comey’s handling of the Clinton email probe, but Democrats also question what role his bureau investigation into Russian meddling in the 2016 race played.

In a House Intelligence Committee hearing on Russian election tampering in March, voter fraud became a topic of questioning — Committee Chairman Devin Nunes, R-Calif., asked Comey if the FBI had any evidence that votes were changed in states like Pennsylvania, North Carolina, Florida, and Ohio, to which Comey answered “No.”

After winning the election, Trump singled out several states and claimed fraud in their voting system, but officials in those states insisted that his claims were unfounded.

No Cyber Policy, Doctrine, Protection, Result of Senate Hearing

President Trump signed another executive order today. This one is on cyber security and protecting infrastructure. Read it here.

Image result for trump signs executive order BusinessInsider

No one wants to participate in the hard debate regarding cyber, where it is noted to be the highest threat for the homeland. At least the Trump White House is taking note, yet this executive order may not be enough or engage the private sector. It is gratifying however that some inside and outside experts are in fact having talks on an international basis with cyber experts. That is always a good thing.

At issue on this topic is the path forward and the estimated costs. Cyber is a battlespace where it should be noted it could cost what conventional military operations costs against adversaries and could take as long if not forever. All government infrastructure is dated, unprotected and there are no measures to correct in a priority ranking.

The other item of note, there is no legal or case law condition where the cyber attackers are prosecuted. Exactly why did Sony not sue North Korea? If there is no consequence, even ceremoniously, then expect more hacks. Of note, to sue and or sanction North Korea, China would have to be included, as the internet connectivity to North Korea is provided by China and further, China trained the hackers in North Korea….sheesh right?

Politico reports: The directive is Trump’s first major action on cyber policy and sets the stage for the administration’s efforts to secure porous federal networks that have been repeatedly infiltrated by digital pranksters, cyber thieves and government-backed hackers from China and Russia.

“The trend is going in the wrong direction in cyberspace, and it’s time to stop that trend and reverse it on behalf of the American people,” White House Homeland Security Adviser Tom Bossert told reporters during a Thursday afternoon briefing.

Cyber specialists say the order breaks little new ground but is vastly improved over early drafts, which omitted input from key government policy specialists. The final version, cyber watchers say, essentially reaffirms the gradually emerging cyber policy path of the past two administrations.

As part of the executive order’s IT upgrade initiative, administration officials will study the feasibility of transitioning to shared IT services and networks across the government. An estimated 80 percent of the $80 billion federal IT budget goes toward taking care of aging systems.

Senior Trump adviser Jared Kushner’s Office of American Innovation will play a significant role in the federal IT modernization effort, multiple people tracking the efforts have told POLITICO. Earlier this month, Trump signed an executive order creating the American Technology Council, with Kushner as director, to help coordinate that effort. More here.

*** Personally, it must be mentioned there is a problem with this operating out of the White House and certainly out of Jared Kushner’s office, he is way too tasked to be effective. Other professionals in the cyber realm agree, the matter of a ‘net’ command and operations that collaborate with the private sector should be it’s own command and separated from NSA.

There was a significant hearing today on The Hill while the FBI hearing was going on. Those on the witness panel included James Clapper, Jim Stavridis and Michael Hayden. The Senate Armed Services Committee hosted this session and it included high rate discussions including why there is no cyber doctrine, why there are no offensive measures and what the highest cyber threats are for the homeland.