The number of ransomware attacks has grown over the past few years with an incredible speed with damage costs for 2017 being predicted to exceed $5 billion, up from just a few hundred million a couple of years ago.
Of course, another incredible threat this year alone have been the two massive attacks of WannaCry and NotPetya. While neither of these managed to amass any real fortune for the groups behind the attacks, being designed to wreak more havoc than actual ransoms, they both did quite a bit of damage.
WannaCry infected several hundred thousand computers across the world after hacker group Shadow Brokers dumped some NSA files online detailing tools used by the intelligence agency to infiltrate computers – Windows vulnerabilities that had gone unnoticed for years. Despite Microsoft releasing a Windows patch to fix things a month before the files were even made public, people had not updated their systems, or installed security software, leaving them vulnerable.
NotPetya is a trojan that posed as ransomware, infecting computers left and right while using some of the Petya ransomware code. In fact, the purpose of the malware was to destroy data, to do as much damage as possible. While some money was dumped into the affiliated Bitcoin wallets, it wasn’t a sum that would have made it worth the entire effort and risk of getting caught.
Back in May, it was reported that WannaCry ransomware attack losses could reach $4 billion. NotPetya, which was considered to be more complex and virulent than its predecessor, despite using the same NSA undisclosed backdoor into Windows, might be even more damaging.
One company alone – Reckitt Benckiser – who sells brands such as Dettol, Nurofen or Durez, has already warned that it may have lost as much as £100 million in revenue following the attack. FedEx has not named any numbers, but it has admitted that even after restoring its IT systems and services, some damage may never be fully fixed.
The scary part about this type of cyberattacks, because we’re not just talking about ransomware anymore, is that they could cost the world many, many billions of dollars. In fact, Lloyd’s of London, one of the largest insurers in the world, has warned that a well-executed cyberattack could cause damages ranging from $53 billion to over $121 billion. That’s pretty much the same level as natural disasters such as hurricanes.
The obvious problem is that such attacks are becoming more and more likely to happen as hackers either become better at spotting zero day vulnerabilities in key software, such as Windows, or they’re getting better at hacking those who hoard such bugs, such as the NSA and other intelligence agencies in the world. Despite numerous pleas from the tech community for the intelligence community to stop collecting zero days for their own use instead of reporting them to the affected companies in order to protect millions of people worldwide, they’ve just kept on doing it.
One of the first times such a demand was made was a few years back, following the revelations coming from the leaked NSA documents from Edward Snowden. It was exposed then that the NSA was collecting various critical vulnerabilities and keeping them hidden. As long as they are not reported back to the manufacturer of the affected software, hackers can find and exploit the same vulnerabilities because they are not patched. While the intelligence community’s need for such zero days is understandable for their operations, allowing tens of millions of people to be put at risk doesn’t seem like a good balance whatsoever.
The dark future
The future regarding cybersecurity is quite grim. As the number of attacks will continue to grow as time goes on, it will also become increasingly difficult to fend them all off. Ransomware has grown in popularity because it’s an easy way to make money – infect a computer, or a mobile device, encrypt the data, and wait for the victim to pay you so their data can once more be restored. Of course, there are plenty of people waiting for security researchers to come up with a decryption tool that works for them, which happens quite often.
Unfortunately, there’s a growing sense that there are black hats out there that are doing this just for the havoc they create, reveling in the damage they’ve produced. WannaCry was one example of this, while NotPetya was another, although a lot more destructive. Security experts believe this trends will only continue over the years, so it’s probably a good idea to always keep your operating systems updated with the latest patches, and to have an active security software in place. Of course, making sure to use common sense when online is also mandatory – don’t install just anything you download off the Internet, don’t follow links coming from people you don’t know, don’t allow Microsoft Word Macros to run, don’t install just any app you find on the official stores, much less on third party mobile stores.
The Cyber-Secret Futurist 