Ransom Attack. Microsoft Blames Everybody But Themselves.

Either unplug your USB dirive or power it off after making your backup. Encryption malware will encrypt every drive the machine can see.

Cheerio John

Thank you John, I wasn't too sure whether encryption s/ware could affect external drives but the disconnect regime after back up is what I do at present.

Rob.
 
A question to the IT experts out there:

If I back up to a USB connected external drive and I'm unfortunate enough to have been the victim of a security attack in any form or way, will my USB connected external drive be affected, will my backup be compromised in any way?

I back up regularly to this drive. I'm also very meticulous about installing the latest windows updates (Win10 Home 64x) and my anti-virus software is regularly updated.

Thanks in advance.

Back on topic. It seems incredible to me that organizations such as UK NHS are still running WinXP and seemingly ignoring any security update patches announced by Microsoft.

Rob.

If your hard drive is on, there's that possibility of infecting the data if the malware searches the hard drive paths, meaning the drive letters for such folders as documents and such files as. *.doc, *.jpg, etc. In computer terms an asterisk (*) means everything with what's on the .extension. As I used *.doc, or *.jpg means all documents, and all jpg images. If you are infected and you then turn on your hard drive on with an infected system, then there's that chance that the malware will find your hard drive when it comes online. (The paranoid side of IT comes into play here). So if you were to come into contact with the malware, it's best to remove it first, then restore data from backups, which of course I hope is obvious. :)

If your system is up-to-date, meaning all patches, and your antimalware is up-to-date you should be safe. As an added precautions, to ensure there's nothing out there that can still circumvent the updates, never click on attachments or suspicious links in emails, and exercise safe computing - meaning avoid website with naughty bits on them, and stay vigilant while on the internet. :) Remember even though you are up-to-date at the moment, there's always the chance that the malware writer is a step ahead of the other, so it's best to stay on the cautionary side.

I agree that it's truly shocking that organizations don't put in an effort to upgrade. Sure it can take time for IT to ensure the applications work properly, and all the other stuff that goes into that, but the concerted effort should be done, but sadly if you look at post, a lot of this has to do with management and getting them to buy into investing in the infrastructure.

And lastly we wonder why... To quote my own post:

Now for a real world example of what should not be done, which my brother told me about and got my hackles up as I think about it. My dad was at a local hospital for a CT-scan. The software for the equipment ran on a Windows-based computer, most likely Windows XP or Windows 2000. Instead of this machine being isolated from the internet, meaning no browser allowed, or locked down only to allow intranet access, the operator and other staff were on Facebook browsing images that were sent to one of them. Seriously! How to infect the medical-device. It's cases such as this which most likely brought the systems down at the NHS in the UK, as well as in other organizations!
 
Thank you John Citron (another John!). I take all the precautions as you've outlined and am not one for the 'naughty bits' sites!

Back to the OP's original comments with another question:
Who is to blame? Is it Microsoft or the users of Microsofts software? I know that's a very simplistic question to pose about this complex issue but I think a valid one. In my limited experience I think the blame lies with the users lax updating routines and as you say, lack of money and resources/knowledge to upgrade to more modern OS's and to keep those OS's up to date.

Rob.
 
Hi again everybody.
I will by way of my humble opinion try in this posting to expand my thoughts on what has been stated in this thread especially by John Citron and Robd. John Whellan you are “right on the button” in regard to using different fonts in collaborative documents. I will in a separate posting tell you and all of the hilarious happenings in our company when a collaborative document compiled for a court hearing went disastrously wrong.

John, you are quite correct in stating in your posting at #18 that all operating systems are vulnerable to attack but I believe that the degree of vulnerability will very much will lay within the OS system a person or organisation is using.

In the above, me and my company have no experience in using apple devices ether Mac or IOS so I will not comment on security within those devices. The problems with the Windows operating systems (all versions) has been well discussed in this thread and the security vulnerabilities are there for all to perceive.

With Google OS, (not to be confused with Google Android) an attack on a device or even multiple devices operating on that system would undoubtedly bring a very quick and responsive “get stuffed” to the ransom demand. As Google OS devices are very low cost to purchase, users would just bin the infected device(s), replace it with new, log on and anyone would be back where they left off.

In the above, for any attack to mean anything within Google OS, it would have to be directly against the Google OS cloud based servers which is not impossible but obviously much more difficult to carry out, and attacks of that nature have not in any way succeeded up to this point in time.

However, where I and others feel the vulnerability is in the “Google armory” is within the Android system, and that weakness I believe is growing by the day. The Google Android system was launched as a lightweight app orientated system for mainly casual gaming and media use on Android phones and tablets.

The above stated, many organisations now supply mobile employees with company phones with (supposedly) strict rules in regard to use and what data and documents are to be stored on them and over what time period before being transferred​ to the company's in house operating system and storage. However, phones in modern offices with good broadband connection are used for almost all tasks by way of voice dictation through apps such as Google voice, assistant or Siri.

In the above, documents compiled on those phones often remain on the device, and taken home without backup to the system. Many senior personal myself included engage in the foregoing creating a new and growing vulnerability throughout almost all professional organisations worldwide. It is difficult to visualise what any company IT personal can do to counter the abuse and Google Android has been subject to virus attacks in the past.

Google have stated that an Android for business version will be brought forward probably in the autumn the contents of which is to be announced. In the meantime I believe that Android being used in ways if was never designed to fulfill has become a huge security “hole” in very many company IT systems operation. It is also the “elephant in the room” that is not discussed.

So in answer to Robd in regard to who causes the vulnerability in IT systems, then it is often the users of those systems by way of abuse, neglect and carelessness. However, those systems must be robust in containing those abuses for we all make errors and mistakes and at times are careless, for that is part of life and must be guarded against.
Bill
 
Last edited:
As Google OS devices are very low cost to purchase, users would just bin the infected device(s), replace it with new, log on and anyone would be back where they left off.

You must have missed that little story about Sony and the PlayStation.
https://www.theguardian.com/technology/2011/apr/26/playstation-network-hackers-data

Why is throwing away a cheap Google device any different then re-formatting a desktop hard drive? You haven't paid the ransom, any data on the device is now lost, and whatever network you were connected to at the time is now infected.
 
Hi sailordan.
You must have missed that little story about Sony and the PlayStation.
https://www.theguardian.com/technology/2011/apr/26/playstation-network-hackers-data

Why is throwing away a cheap Google device any different then re-formatting a desktop hard drive? You haven't paid the ransom, any data on the device is now lost, and whatever network you were connected to at the time is now infected.

SailorDan no data is ever stored on on a Google OS device. When compiling documents almost every keystroke made is immediately passed to the cloudbased servers and security checked by the Google system which will not pass that unless it is "clean". On most OS devices a small allowance is made for offline editing and storage but that has to be of documents already processed by the system. Following editing or storage for use the documents are passed back through the Google cloud based servers checked again and stored. Should they find any virus or malware etc in any document you are immediately informed and the document isolated within the cloud system.

Therefore should it be that your device is locked by an attacker only the actual device would be unusable, no documents or data would be lost as that is all in the cloud. So just bin it, open up a new device and you are away from right where you left of before the attack.

That is the strength of the Google OS system which Microsoft are about to follow, though they are very late to the party once again.
Bill
 
Last edited:
SailorDan no data is ever stored on on a Google OS device. When compiling documents almost every keystroke made is immediately passed to the cloudbased servers and security checked by the Google system which will not pass that unless it is "clean".
in what way is that different from any other device using a cloud service? And, MS thin clients without any local data store have been supported for many years -well before the cloud became available.

I think you are claiming a uniqueness for this system that simply doesn't apply.
 
in what way is that different from any other device using a cloud service? And, MS thin clients without any local data store have been supported for many years -well before the cloud became available.

I think you are claiming a uniqueness for this system that simply doesn't apply.

Yup. Long before Google and the cloud was Citrix and Microsoft Terminal Server, which essentially do the same thing internally as well as remotely.

Sun Microsystems had their systems as well. With a Sun workstation, you can log out of one node and log into another and lose nothing. The system remembers everything, including data locations and desktop layout. MS Terminal server is similar, though not as "nice" as Solaris. :D

The cloud and all it's so-called goodness is nothing more than a renaming/rebranding of SAAS.
 
Using SSL-VPN technology, with enhanced firewall security, and a secure data entry point like Amazon Web Services may put a halt on access to important data. Turning off SMB access and getting rid of XP/2003/Vista/7/8/8.1 Windows would sure help a lot too.
 
Hi everybody.
SailorDan and John Citron's have made postings at #27 and #28 of this thread advising that the Google OS system is not original, and that similar systems have been in existence prior to the launch of Google's cloud-based operating system. In response I would have to advise that I am no "IT historian" but I believe the matter undoubtedly comes down to when and how any market item is launched, and in that whether it attracts the public interest sufficiently to bring forward sales

In the above, anyone can speculate on why one make of car will obtain a far greater market share over another brand when both have similar performance and specs. The foregoing could be considered in any number of marketable items, and the simple fact is that timing, marketing and launch are all important in the success of any product.

It may well be that with the Google OS platform it was not original at launch, as indeed Google may well have taken their ideas on what others had already developed. However, what Google perceived was a marketing opportunity in the education sector that was dominated at that time by Apple iOS (iPads) and entered that field with innovation and launched Google OS with the rest now being IT history.

In the above, Google are now expanding on that market with its operating system by attracting small and medium businesses to its platform by offering those organisations the opportunity of not having to concern themselves with antivirus needs, upgrades, updates and new versions on their IT systems which allows them to concentrate solely on the development of their businesses. The foregoing is proving to be a very strong attraction indeed but obviously the push forward into the business field will be gradual as any company wishing to move over to the Google OS platform requires good broadband connection to its premises. However, as the rollout of fibre broadband is carried out worldwide so the marketplace for the operating system will continue to grow.

Microsoft (who are again very late in coming to the party) have announced that they are to launch their own full cloud-based operating system probably in the autumn of this year. The low-priced laptops and desktops which will accompany the launch will we are informed also run the newly released Windows 10 S which is a reduced version of the full Windows 10 operating system. The foregoing would seem to be rather puzzling at this point in time, as users of Google's system are asking why anyone would want that type of desktop OS running on a full cloud-based system. However, Microsoft's entry into cloud-based operating systems will bring forward competition which is always good for any user base.

In regard to the comments in this thread advising that previous Windows versions such as XP, Vista, seven and even eight should be upgraded to the latest version as quickly as possible so as to enhance security, then in large organisations such as the British National Health Service that is very unlikely to happen in the near future. It is in those foregoing versions that I believe Microsoft have badly let down their customer base by way of to many versions and upgrades over too short a time span. The resources and expenditure needed to regularly upgrade such huge systems makes that impossible on a short and regular time factor. In that Microsoft must bear a large share of the responsibility for the ransom attack, with undoubted further responsibility for more such attacks that will come in the future.

Bill
 
Last edited:
Both Chrome OS and Android which are due to be merged into just Android this year, are based on the Linux Kernel which has been around since 1991 and was developed by Linus Torvalds, who still oversees it's development. The only reason Google can use it is that it's released under the GNU General public license.

Microsoft's Win10S is not primarily for desktops but for the New Surface laptop.
The S version will only be able to use applications from Microsoft's App Store, pretty much the same setup as with Google or Apple.
 
Hi again everybody.
Both Chrome OS and Android which are due to be merged into just Android this year, are based on the Linux Kernel which has been around since 1991 and was developed by Linus Torvalds, who still oversees it's development. The only reason Google can use it is that it's released under the GNU General public license.

Microsoft's Win10S is not primarily for desktops but for the New Surface laptop. The S version will only be able to use applications from Microsoft's App Store, pretty much the same setup as with Google or Apple.

Malc, Google have been "endeavouring" to have some type of intergration between OS and Android for almost the last twelve months but it has proved to be a "nightmare" to carryout. It was stated by the mountain view organisation that virtually all Chromebooks would be enabled to run Android apps by Christmas last year. As it has turned out only a few of the latest Chromebooks are capable at this point in time of running Android apps and it seems to be a very complicated procedure to make it happen

However, Google are begining their three day annual developers conference today a 10am eastern standard time. Therefore we may hear much more about the integration, but as it stands at the moment it will only effect Google OS Chromebooks and Chromebase desktops, with Android phones remaining​ as they operate at present.

Perhaps more will be revealed later today, but with cost of tickets to the event "sky high" all those attending will be hoping there is something coming out that makes it worth the cost

I believe all Operating Systems with the exception of Microsoft Windows run on Linux as their cores which states much for the original contributers to the open source platform. I have often wondered if those people made anything out of their efforts seeing as the likes of Amazon, Google and Apple have made billions out of the platform.

Edit to the above, have just been viewing the live channel on Cnet from the I/O conference were they have been giving a presentation on the Development and growth of the YouTube userbase. That number has increased by 4X in the last eighteen months. It is also the be integrated further with Google play music and Google play movies.

Just started a presentation on Android development, new version to be released in the autumn which will be known as android O. It has just been stated that Android gaming will be coming to large screen devices but no mention of any further intergration with Google OS. Not going to happen I feel sadly, but may get further news on that later in the week, perhaps.

If anyone is interested you can follow conference on any number of live internet channels which will cover the large screen devices that are under development for Android large screen gaming later in the day. That will include presentations by Samsung, Levono, Asus and LG.
Further Edit, not sure if those presentations will be today as conference already running late it seem after longer than expected question and answer session on YouTube development.

Bill

 
Last edited:
Wow so if small businesses don't understand security let's all blame Microsoft. Who has the responsibility? It isn't Microsoft's job to go round and hold people's hand or do you believe in the nanny state? Blame the Government?

The answer is independence for Wales and no business computers to be allowed in the country!

Luv Karen
 
It was said in this topic that Microsoft should have worked closer with the American government so that they would have known about the problem sooner. I wonder how that would work. The NSA manages to find a security loophole in a Windows version, which they can (and do) use to spy on whoever, and then they should tell Microsoft about it so they can patch it and lock themselves out again? Whoever suggested that would be the worst James Bond ever.
 
Hi everybody.
It was said in this topic that Microsoft should have worked closer with the American government so that they would have known about the problem sooner. I wonder how that would work. The NSA manages to find a security loophole in a Windows version, which they can (and do) use to spy on whoever, and then they should tell Microsoft about it so they can patch it and lock themselves out again? Whoever suggested that would be the worst James Bond ever.
Well, I have never wished to be James Bond or any kind of character similar to him. The foregoing is a fictional figure(s). However, what has happened in this attack is anything but fictional, for what we have in the UK are hospitals canceling operations, treatments and diagnostic scans etc. We also have doctors surgeries unable to access patient records making prescription processing impossible.

Monday evening on the BBC national news we had a person obviously very ill breaking down as he had been unable to obtain the results of his latest scan in regard to his cancer. All the foregoing is still ongoing in the British National Health Service which in my humble opinion is the finest health supplier in the world.

Along with the above there are numerous companies large and small unable to access their files such as customer records or their accounts. If such a situation is prolonged for more than a few days, we may see many small businesses (the backbone of the UK economy) in severe financial trouble.

The above is without doubt being repeated in many countries throughout the world. Therefore, if the NSA or any other government agency had knowledge of a security problem in any of the Microsoft Windows versions then that agency had the highest level of responsibility to divulge that information to those who had need of it. In the foregoing to not divulge the information (as reports suggest) aided and abetted the criminals in this attack at the expense of those worldwide that these government agencies are supposed to protect.

Therefore, perhaps the security agencies worldwide who we are informed collaborate so closely together should stop playing James Bond and join the more realistic earth all the rest of us live on, or the next attack may well find us all locked out of our bank accounts, along with food and fuel distribution.

Bill
 
Last edited:
The above is without doubt being repeated in many countries throughout the world. Therefore, if the NSA or any other government agency had knowledge of a security problem in any of the Microsoft Windows versions then that agency had the highest level of responsibility to divulge that information to those who had need of it. In the foregoing to not divulge the information (as reports suggest) aided and abetted the criminals in this attack at the expense of those worldwide that these government agencies are supposed to protect.
Given the timing of the MS release of a patch for this vulnerability, it appears that NSA did advise MS of the problem, but only after they became aware that the information had been stolen from them, and was therefore common knowledge. I don't think that detail will ever be released. Microsoft denies that NSA warned them (but then they would have to say that in any case), and the other possibility is that MS became aware of the problem through the people who stole it or Wikileaks. Whatever the actual sequence of events was, it appears that MS acted very promptly in patching the hole as soon as they knew about it (some time in March). You are still blaming everyone else while ignoring the fact that the actual problem lies within 'the finest health supplier in the world' which has failed to keep its systems properly updated and doesn't seem to have any sort of disaster recovery plan.
 
Joining Late

To recap, as I understand this situation from open sources and a little self-protective activity...

1. Microsoft(MS) used a vulnerable process in programming their OS family 15-20 years ago. (Microsoft was apparently unaware of this during that entire period.)
2. The National Security Administration (NSA) discovered this vulnerability and created an easy-to-use tool to exploit it. (NSA did not inform MS of this discovery.)
3. NSA lost control of the tool. (Insider, outsider, contractor, depends on who you listen to.)
4. Someone (NSA?) only then informed MS of the vulnerability.
5. MS rolled out security patches to all its OS family it felt contractually required to support. (These did not include members of the OS family MS had arbitrarily decided to no longer support except by special contract.)
6. Two months later, havoc ensued when one or more fairly simple-minded exploits created with the NSA tool turned up all over the world in unpatched systems. (Unpatched for diverse reasons: MS no longer felt required to support them, or the contractually supported users did not apply the available patches through sloth or fear they might break custom software.)
7. Addressing the havoc, MS made the security patches for this vulnerability available to all users, including those it no longer felt contractually required to support. [I have one machine which uses an "unsupported" OS, and was able to download and apply that patch after the logjam of other users trying to download it subsided.]

Comment: This very bad broth had many cooks. I tentatively point out, in the spirit that lawyers tell anyone involved in an accident never to say "I'm sorry" because it's an admission of responsibility, that MS distributing the patch to all users strongly resembles such an admission. The responsibility of NSA, the worms' writers, and contractually supported MS users is obvious; that of "unsupported" users less so.
 
Given the timing of the MS release of a patch for this vulnerability, it appears that NSA did advise MS of the problem, but only after they became aware that the information had been stolen from them, and was therefore common knowledge. I don't think that detail will ever be released. Microsoft denies that NSA warned them (but then they would have to say that in any case), and the other possibility is that MS became aware of the problem through the people who stole it or Wikileaks. Whatever the actual sequence of events was, it appears that MS acted very promptly in patching the hole as soon as they knew about it (some time in March). You are still blaming everyone else while ignoring the fact that the actual problem lies within 'the finest health supplier in the world' which has failed to keep its systems properly updated and doesn't seem to have any sort of disaster recovery plan.


I have to agree with this summary, for me it sums it up quite nicely, particularly with reference to the UK NHS. I'm a little doubtful about the 'the finest health supplier in the world' part of the comment though!:hehe:

Rob.
 
Last edited:
Belief and Warm Beer

...I'm a little doubtful about the 'the finest health supplier in the world' part of the comment though!:hehe:

Rob.



"Tongue-in-cheek" I'd say!

Belief in the NHS is just one of those national characteristics the rest of us have to accept without quite understanding... sort of like warm beer. :)
 
Back
Top