The people of Baltimore are beginning their fifth week under an electronic siege that has prevented residents from obtaining building permits and business licenses – and even buying or selling homes. A year after hackers disrupted the city’s emergency services dispatch system, city workers throughout the city are unable to, among other things, use their government email accounts or conduct routine city business.
In this attack, a type of malicious software called ransomware has encrypted key files, rendering them unusable until the city pays the unknown attackers 13 bitcoin, or about US$76,280. But even if the city were to pay up, there is no guarantee that its files would all be recovered; many ransomware attacks end with the data lost, whether the ransom is paid or not.
Similar attacks in recent years have crippled the United Kingdom’s National Health Service, shipping giant Maersk and local, county and state governments across the U.S. and Canada.
These types of attacks are becoming more frequent and gaining more media attention. Speaking as a career cybersecurity professional, the technical aspects of incidents like this are but one part of a much bigger picture. Every user of technology must consider not only threats and vulnerabilities, but also operational processes, potential points of failure and how they use technology on a daily basis. Thinking ahead, and taking protective steps, can help reduce the effects of cybersecurity incidents on both individuals and organizations.
Understanding cyberattack tools
Software designed to attack other computers is nothing new. Nations, private companies, individual researchers and criminals continue developing these types of programs, for a wide range of purposes, including digital warfare and intelligence gathering, as well as extortion by ransomware.
Many malware efforts begin as a normal and crucial function of cybersecurity: identifying software and hardware vulnerabilities that could be exploited by an attacker. Security researchers then work to close that vulnerability. By contrast, malware developers, criminal or otherwise, will figure out how to get through that opening undetected, to explore and potentially wreak havoc in a target’s systems.
Sometimes a single weakness is enough to give an intruder the access they want. But other times attackers will use multiple vulnerabilities in combination to infiltrate a system, take control, steal data and modify or delete information – while trying to hide any evidence of their activity from security programs and personnel. The challenge is so great that artificial intelligence and machine learning systems are now also being incorporated to help with cybersecurity activities.
There’s some question about the role the federal government may have played in this situation, because one of the hacking tools the attackers reportedly used in Baltimore was developed by the U.S. National Security Agency, which the NSA has denied. However, hacking tools stolen from the NSA in 2017 by the hacker group Shadow Brokers were used to launch similar attacks within months of those tools being posted on the internet. Certainly, those tools should never have been stolen from the NSA – and should have been better protected.
But my views are more complicated than that: As a citizen, I recognize the NSA’s mandate to research and develop advanced tools to protect the country and fulfill its national security mission. However, like many cybersecurity professionals, I remain conflicted: When the government discovers a new technology vulnerability but doesn’t tell the maker of the affected hardware or software until after it’s used to cause havoc or disclosed by a leak, everyone is at risk.
The estimated $18 million cost of recovery in Baltimore is money the city likely doesn’t have readily available. Recent research by some of my colleagues at the University of Maryland, Baltimore County, shows that many state and local governments remain woefully underprepared and underfunded to adequately, let alone proactively, deal with cybersecurity’s many challenges.
It is concerning that the ransomware attack in Baltimore exploited a vulnerability that has been publicly known about – with an available fix – for over two years. NSA had developed an exploit (code-named EternalBlue) for this discovered security weakness but didn’t alert Microsoft about this critical security vulnerability until early 2017 – and only after the Shadow Brokers had stolen the NSA’s tool to attack it. Soon after, Microsoft issued a software security update to fix this key flaw in its Windows operating system.