Speaker 1: Welcome to brain Stuff, production of iHeart Radio, Hey brain
Speaker 1: Stuff Lauren vogelbam here. In March, of Atlanta was hit
Speaker 1: with a ransomware attack that infected nearly three thousand, eight
Speaker 1: hundred government computers belonging to the City of Atlanta, including servers.
Speaker 1: After the virus was deployed, the ransomware essentially locked all
Speaker 1: the infected computers, rendering them impossible to access. Atlanta's court
Speaker 1: system went down. Police were unable to check license plates,
Speaker 1: residents couldn't pay bills online. Just three weeks before Atlanta
Speaker 1: was hit, the small city of Leeds, Alabama, also experienced
Speaker 1: an identical cyber attack, and before Leeds, in January, it
Speaker 1: was the Hancock Regional Hospital in the suburbs of Indianapolis.
Speaker 1: What these three attacks have in common is that they
Speaker 1: were all hit by sam SAM ransomware. Each attack demanded
Speaker 1: around the same amount, about fifty thou dollars in cryptocurrency.
Speaker 1: Hank Hawk Regional Hospital and Leads, Alabama paid the ransom, However,
Speaker 1: the City of Atlanta did not. Instead, it chose to
Speaker 1: pay millions to get its systems back online. A ransomware
Speaker 1: is when a cyber criminal accesses a network of computers,
Speaker 1: encrypts all of the data and extorts the company or
Speaker 1: organization to unlock it, essentially holding the network hostage. Before
Speaker 1: the article of this episode is based on how stuff Works,
Speaker 1: spoke with John Hulquist, vice president of analysis at Mandian
Speaker 1: Threat Intelligence at fire Eye, an intelligence led security company.
Speaker 1: He explained that these attacks are nothing new. However, in
Speaker 1: the first half of the number of organizations impacted by
Speaker 1: ransomware across the globe has more than doubled compared with
Speaker 1: another report identified more than eight hundred extortion attempts that
Speaker 1: likely had data stolen, and the targets are now becoming
Speaker 1: much more high profile. In the US a loan Since April,
Speaker 1: prominent companies like Colonial Pipeline, JBS Foods, the NBA, and
Speaker 1: Cox Media Group have all been hit. Hackers typically access
Speaker 1: networks through phishing attacks, which are emails sent to employees
Speaker 1: tricking them into giving up passwords or clicking on malicious
Speaker 1: links that will download the malware onto the company network.
Speaker 1: A ransomware also looks for other entries into company networks
Speaker 1: via passwords that are easily cracked, like one two three
Speaker 1: q w E, for instance. So why so many and
Speaker 1: why now, hulk Quist explains it like this. Originally, ransomware
Speaker 1: was mostly automated and targeted small systems with vulnerable passwords,
Speaker 1: open networks, and easy entryways. He calls it spray and
Speaker 1: prey quote. The ransomware would go out and hit whatever
Speaker 1: system it could get. The attackers were known to be
Speaker 1: quite friendly. They would unlock the data, even offered discounts
Speaker 1: sometimes and then move on with their life. But then
Speaker 1: things changed. Hull Quist says criminals started making large directed
Speaker 1: attacks on bigger companies with more money, and ransom's skyrocketed
Speaker 1: in Companies paid more than four hundred and six million
Speaker 1: dollars in cryptocurrency and ransom to attackers. Hulk Was said,
Speaker 1: these new targets have to pay out because often they
Speaker 1: are critical infrastructure they have to get back Online. Consumers
Speaker 1: are actually a factor because they are forcing these companies
Speaker 1: to make hasty decisions as far as paying. That was
Speaker 1: the case in the Colonial Pipeline attack. The hack took
Speaker 1: down the largest fuel pipeline in the United States on
Speaker 1: April and prompted mass fuel hoarding across the East Coast.
Speaker 1: CEO Joseph Blount told The Wall Street Journal that the
Speaker 1: company paid the ransom four point four million dollars in
Speaker 1: bitcoin to bring the pipeline back online, but the decryption
Speaker 1: key that the adversaries provided didn't immediately restore all of
Speaker 1: the pipeline systems. The good news for Colonial is that
Speaker 1: the US Department of Justice announced on June seven that
Speaker 1: it recovered six three point seven bitcoins valued at about
Speaker 1: two point three million dollars the Colonial had paid to
Speaker 1: its hackers. Of course, not paying the ransom can be
Speaker 1: just as problematic. Hulk Was said, some of these companies
Speaker 1: don't want to pay, so they forced them to pay
Speaker 1: by leaking their data publicly. That's a proposition that a
Speaker 1: lot of organizations do not want a part of leaked
Speaker 1: emails and other proprietary information, he says, can be far
Speaker 1: more damaging to some companies than simply paying up can
Speaker 1: open them up to legal trouble or end up hurting
Speaker 1: their brand. Other hackers simply demand payment without even installing ransomware.
Speaker 1: That's what happened during the attack on the Houston Rockets
Speaker 1: in April. No ransomware was installed on the NBA team's network,
Speaker 1: but the hacking group threatened to publish contracts and nondisclosure
Speaker 1: agreements that it claims it stole from the team system
Speaker 1: if they didn't pay up. There are several new initiatives
Speaker 1: laid out by the Biden administration in response to the
Speaker 1: Surgeon ransomware attacks. On May twelve, President Biden signed an
Speaker 1: executive order designed to improve the cyber security in the
Speaker 1: federal government networks. Among its executive actions will establish a
Speaker 1: Cybersecurity Safety Review Board modeled after the National Transportation Safety Board.
Speaker 1: The panel will likely include public and private experts who
Speaker 1: will examine cyber instance similar to how the NTSB investigates accidents.
Speaker 1: Biden's team also released an open letter on June two,
Speaker 1: addressed to corporate executives and business leaders, which emphasized that
Speaker 1: the private sector has a responsibility to protect against cyber
Speaker 1: threats and that organizations quote must recognize that note company
Speaker 1: is safe from being targeted by ransomware, regardless of size
Speaker 1: or location. We urge you to take ransomware crimes seriously
Speaker 1: and ensure your corporate cyber defenses match the threat. So
Speaker 1: what can you do to ensure that your network is safe?
Speaker 1: In May, the Cybersecurity and Information Security Agency and the
Speaker 1: FBI released best practices for preventing business disruption from ransomware attacks.
Speaker 1: In IT, they list six mitigations the companies can do
Speaker 1: now to reduce the risk of being compromised by ransomware. First,
Speaker 1: require multi factor authentication for remote access to operational technology
Speaker 1: and I T networks. Second, enables strong spam filters to
Speaker 1: prevent phishing emails, especially emails containing executable files, from reaching
Speaker 1: end users. A Third, implement a user training program and
Speaker 1: simulated attacks for spear phishing to discourage users from visiting
Speaker 1: malicious websites or opening malicious attachments. Fourth, filter network traffic
Speaker 1: to prohibit communications with known malicious IP addresses. Prevent users
Speaker 1: from accessing malicious websites by implementing URL block lists and
Speaker 1: or allow lists. Fifth, update software including operating systems, applications,
Speaker 1: and firmware on I T network assets and a timely manner.
Speaker 1: Consider using a centralized patch management system. And Sixth, limit
Speaker 1: access to resources over network, especially by restricting remote desktop
Speaker 1: protocol and requiring multi factor authentication. Hul Quist says that
Speaker 1: the entire purpose of the game now is to hit
Speaker 1: a huge target who's likely to pay and one that
Speaker 1: has to pay, and taking critical infrastructure offline is not
Speaker 1: out of the question that he says the US is
Speaker 1: not prepared for. He said, our sophistication is our Achilles
Speaker 1: heal in this space. It makes us more vulnerable to incidents.
Speaker 1: One of the lessons we should be taking from all
Speaker 1: of this is we are not prepared for cyber war,
Speaker 1: but we do know that they've targeted healthcare and other
Speaker 1: critical capabilities. Everybody is learning from this. Today's episode is
Speaker 1: based on the article surge in ransomware attacks exposes US
Speaker 1: cyber vulnerabilities on house to works dot com, written by
Speaker 1: Sarah Glin. Brain Stuff is production by Heart Radio and
Speaker 1: partnership with house to works dot Com, and it's produced
Speaker 1: by Tyler Klein. For more podcasts my heart Radio, visit
Speaker 1: the i heart Radio app, Apple Podcasts, or wherever you
Speaker 1: listen to your favorite shows. H