A New Level of Malware: What Security Challenges Does Wannacry Pose? Antivirus

The story with WannaCry is the first such major case when a virus caused significant damage on a truly global scale

SHARES

At the end of last week, the “hero” of all news was the malicious ransomware worm WannaCry, which infected hundreds of thousands of computers in organizations around the world. Among them were government services and departments, cellular providers, car manufacturers, and many others.

To illustrate the scale, the National Health Service was attacked in the UK and Deutsche Bahn in Germany. In Russia, the Ministry of Internal Affairs, the Emergencies Ministry, Sberbank, and some large companies were attacked. How much money the extortionists received, in the end, is anyone's guess.

In a sense, this unpleasant incident has become a landmark. It took ransomware to the next level and fully demonstrated how serious the threat is. Here are the main - and very dangerous - trends that WannaCry has exposed.

I am sure that in fact all cases of ransomware attacks (for more information on such programs - in the Forbes material ), which we know about, are just the tip of the iceberg. Naturally, none of those who have been attacked are eager to talk about it again, and usually, companies hide such attacks. These are reputational (and, naturally, monetary) losses. Therefore, according to my estimates, we know at best about 1/10 of the cases. But even the incidents we know on the consumer market speak of the scale of the problems: for example, in the fall of 2013 alone, the well-known ransomware Trojan CryptoLockerinfected over 250,000 computers, and criminals received over $ 3 million in ransom (). At the same time, by the way, the bad guys did not decrypt the files of even paying users. Another bleeder CryptoWall in 2015 extorted from the victims more than $ 18 million.

Antivirus companies, whose numbers we all operate with, do not have access to all the necessary statistics: to put it simply, IT departments of organizations and departments disable the ability to collect certain data in public space. Also, one must understand that the same anti-virus companies have different market shares in different countries and, accordingly, the ability to collect information around the world is not the same. For example, is historically strong in Russia and has a larger number of users  Therefore, its statistics will indicate that Russia got the most, although perhaps this is not entirely true. In general, it makes sense to treat any statistics with a certain degree of skepticism - it is most likely grossly underestimated.  

So why has the WannaCry story become so important? This is probably the first such major case today that the virus has caused such significant damage on a global scale. We are used to the fact that we are usually talking about stealing money, data, extortion based on competition, etc. Virtual threats in the virtual world are unpleasant, but not scary. Last week it was about the damage to the physical world: hospitals, security systems, etc. This is a completely different thing - we are dealing with a threat as serious as the destruction of nuclear centrifuges in Iran by the Stuxnet virus in 2010 or the famous blackout in the USA in 2003. Due to WannaCry, doctors in some English hospitals have temporarily not performed surgeries. Now it is already really scary - people, even entire states, may suffer. It is dangerous to ignore such things.   

Move on. We so often say that the Internet has no boundaries that we almost stopped thinking about the meaning of this phrase. An example of the latest attack in this sense is indicative - some researchers speak of hundreds of countries that have been attacked. I don’t know if this is true or not, but the attackers weren’t chosen based on geography or ethnicity. Computers and IP addresses have no nationality - the geography of attacks is very indicative here: both British hospitals and German trains, and Russian mobile operators. Ransomware is somewhat akin to terrorist threats here. Therefore, protection, probably, should also be supranational, outside geography (how it might look is a separate conversation).       

What is also very important is the “availability” of ransomware malware. Previously, it was the lot of technical specialists, geeks, almost maniacs. Today, even a neighbor's grandmother can harm you with a virus. Why it happened: copying the service model we are used to, the ransomware offers the customer RaaS (ransomware as a service). They earn money not on the crime itself, but on the customer. And now even a technically uneducated person can become one, which was previously impossible: absolutely any of your ill-wishers can order an attack. The service model allows the number of crimes to grow at a tremendous pace: the number of people who want to harm someone is huge, and now they have got this opportunity. And the bad guys went from lone cybercriminals to businessmenmassively selling dangerous weapons.

The quality of the malware itself has also changed. It has become much more advanced and proactive. Malware actively counteracts any means that should identify, stop, and destroy them. Thus, WannaCry is very similar to another powerful Trojan that has made a lot of noise recently - Osiris (here is one of many examples of how it did harm)but with one important exception. It prevents Windows from restarting in Protected Mode. This is what allows, by restarting the computer, to do disaster recovery and save at least some of the data. In the case of WannaCry, this is no longer possible. New Trojans do not just achieve their goals - they do so by defending themselves as efficiently as possible, passing through the most modern tools that are equipped with sophisticated software, advanced CRM, etc. It resembles the famous Armata tank with the Afghanit active defense system, deploying the most powerful armor and countermeasures towards the attack.

Another important feature of ransomware is its high speed and the desire to inflict maximum damage on the system. In China alone, tens of thousands of organizations have been affected. Another analogy is asked: if, when defending a fortress, you open the gates, letting the enemy inside, then closing them after that is practically useless. It's the same here - launching the antivirus five minutes after penetration can change little.  

All of this suggests an obvious thought: existing remedies are no longer as effective as they used to be. Only an integrated solution that combines backup and secure storage technologies in a single product ensures data recovery in any situation.  

Antivirus to protect your pc from viruses. 

By the way, it looks like a new WannaCry attack awaits us all soon.