I'll Cry if I Wanna

   I try not to jump on bandwagons, but with so much coverage and affects of the whole worldwide WannaCry mess, I do have a few things to say.  I have a few different things to cover that you may not have seen elsewhere.

   There's been plenty of media coverage so I'll just give a high level overview of what happened.  Like many other nations, the US National Security Agency (NSA) studies computer flaws and develops ways to attack them.  The Shadow Brokers are a hacker group who started leaking some of these NSA-developed attacks in the second half of 2016.  The April 2017 edition of their leaks included the code that enabled the WannaCry attack.
   The attack that started on Thurs May 11 consisted of two parts.  One would encrypt files so that the owner could not get access to their files (commonly called "CryptoWare").  The other part could get remote access to any vulnerable computer.  This was a very powerful combination and this is the first time we've seen this kind of auto-spreading cryptoware.  Once infected, the victim sees a screen that directs them to pay a ransom in bitcoin - so the whole attack is considered "Ransomware".

   Now, Microsoft did release a patch in March to fix some of these problems, in particular the remote access part.  So no problem, right?  Desktops and laptops are usually easier to patch, and you should always have your home systems set to automatically update.  But servers need more testing to assure that applications continue to work as expected.

   Patching was a critical part of the fix, but there was definitely more to it including things like new anti-virus signatures, whitelisting, intrusion prevention signatures and firewall rules.
   One reason healthcare orgs seemed to be hit hard, including the British National Health Service (NHS) is that heathcare often has many older systems and applications.  These can be hard to update.  With NHS, most of their desktop systems were running Windows XP!

   So much for a short overview!

   But now... who is to blame?

   On his podcast, episode 21, Graham Cluley asked this question.  In particular, the question was, which of Microsoft, NSA, Shadow Brokers are to blame.  You can listen to hear what they said.

   Here's my opinion.  There's one group to blame and then an additional area of concern.

   The "blame" goes to those who carried out the exploit!  Yes, they took advantage of existing vulnerabilities and companies that didn't protect their systems, but that's beside the point.  I mean, just because a bank has a welcome mat at the door doesn't mean you're allowed to rob it.

   Now, what about these software vulnerabilities? Why do we keep having these problems?  Someone has to write these in first place.  I'm not picking on software developers.  I've been one.  It's a hard job.  Code is very complex. This is something we call secure software engineering and it's not easy, but there are tools available to help us.

   For additional reading, security expert Marcus Ranum was talking about this whole complexity issue 12 or more years ago.

   And, not to pick on Microsoft, but why do we give everyone a computer with a general purpose operating system when most people only do specific things like email or word processing (which can both be accomplished inside a browser).  The more we can simplify the better off we'll be.
   And then there's the corresponding monoculture problem we were discussing 15-20 years ago - if everyone's computer is basically the same then one problem can take them all out (think potato blight).  And that seems to happen pretty regularly (to computers, not crops)!  The answer here is special purpose computing, and the more scaled down the better.  I'm a big fan of "thin" systems like chromebooks.

   What can you do to protect yourself?

At home and at work:

• be careful with link and attachments

At work:

• follow security policies
• work with your IT team on all technology needs (if it uses electricity, it could pose a security issue)

At home:

• use the default for windows updates
• use Secunia PSI
• if you use windows, turn on the all the default protections
• back up your stuff - there are many good tools available for home backups including Carbonite and CrashPlan, or even Microsoft OneDrive or Google Drive
• encrypt your stuff - two good choices for this are bitlocker and veracrypt

   You need to take these kinds of steps now, particularly at home.  We are going to see more new and bigger attacks coming in the future.