Baltimore's Ransomware Mess Is Its Own Fault—Cyber Saturday
Baltimore's Ransomware Mess Is Its Own Fault—Cyber Saturday ·Fortune
Robert Hackett
Since early May, Baltimore has been grappling with a city-crippling ransomware attack. A fiery debate has erupted within the information security community over who is to blame for the mess.
The match that lit the blaze: A story published by the The New York Times last weekend claiming the U.S. National Security Agency is partly responsible for helping to spread the computer-seizing digital infection. The report alleges that hackers used malware, dubbed RobbinHood, paired with EternalBlue, a powerful, self-propagating hacking tool allegedly developed by the NSA to target (now outdated) Microsoft Windows software. The code behind EternalBlue leaked online at the hands of a mysterious, still-unknown entity called the ShadowBrokers in 2017, and nation state actors have used the weapon to launch destructive cyberattacks—including North Korea’s WannaCry and Russia’s NotPetya—costing billions of dollars in damages for businesses and governments around the globe.
Because NSA lost control of this hacking tool, an alleged “key component” of the latest ransomware, according to the Times, the paper lays blame at the spy agency’s feet.
The backlash on that point has been fierce. Some information security professionals have argued that the malware in question did not need EternalBlue to wreak its havoc. Dave Aitel, a former NSA hacker and present chief security officer of Cyxtera, a data center company, wrote on his personal blog that “that particular exploit being used to do lateral movement for this ransomware is neither supported by any public facts, nor my own sources on the issue.” Alternative means of propagation were far likelier, he said. Rob Graham, CEO of Errata Security, a cybersecurity shop, agreed that even if the ransomware incorporated EternalBlue code, it probably didn’t rely on the tool to spread. “Yes, ransomware increasingly includes Eternalblue as part of their arsenal of attacks, but this doesn’t mean Eternalblue is responsible for ransomware,” he wrote on his own blog.
Unsurprisingly, the NSA is disclaiming responsibility for the fallout. C.A. Dutch Ruppersberger, a Maryland congressperson, said that senior NSA leaders told him “there is no evidence at this time that EternalBlue played a role in the ransomware attack affecting Baltimore City,” as the Times reported in a follow-up story on Friday. Rob Joyce, a top NSA bigwig offered his own form of disavowal: “The characterization that there is an indefensible nation-state tool propagating ransomware is simply untrue,” he said in remarks reported by CyberScoop, a cybersecurity news outlet.
The NSA has a point. If EternalBlue truly was key to the Baltimore attack, as the Times initially reported, then it would appear that Baltimore had for years failed to update its computer systems to defend against a known, critical vulnerability. Microsoft released a patch in 2017; the exploit works on machines running Windows software that’s two years out of date. The harsh truth: Baltimore should have been better prepared.
Keeping IT systems up to date and secured is easier said than done, of course. Government offices are perennially resource-strapped and impoverished of tech expertise, struggling to get by on dated equipment. (I used to work in local government—trust me.) And another point to consider: Even if the NSA is not to blame for Baltimore’s debacle, that still does not absolve the agency of its prior negligence. It’s unclear how the spooks lost control of their bag of cyber tricks, including EternalBlue, a couple years ago, let alone the identities of the thieves that call themselves the ShadowBrokers.
As we ponder these questions and wait for Baltimore to release more details about its thwomping, a recommendation: For the love of all that’s holy, please patch this other critical, wormable Windows security hole. Microsoft released a patch for the bug, dubbed BlueKeep, on May 14th, but as of two weeks later 900,000 computers still appear to remain vulnerable, by Wired’s count. If you need a reason to act with celerity, just look at Baltimore.
Do the right thing. Patch.
Robert Hackett
@rhhackett
robert.hackett@fortune.com
Welcome to the Cyber Saturday edition of Data Sheet, Fortune’s daily tech newsletter. Fortune reporter Robert Hackett here. You may reach Robert Hackett via Twitter, Cryptocat, Jabber (see OTR fingerprint on my about.me), PGP encrypted email (see public key on my Keybase.io), Wickr, Signal, or however you (securely) prefer. Feedback welcome.
Mad-Eye Moody. Credit ratings agency Moody’s on Wednesday downgraded from “stable” to “negative” its outlook for Equifax, the credit bureau, based on fallout from a major 2017 cyberattack. This is “the first time that cyber has been a named factor in an outlook change,” Joe Mielenhausen, a Moody’s spokesperson, told CNBC. Contributing to the markdown: an estimated $690 million in regulatory fines and legal settlements, plus an expected $400 million per year in cybersecurity and infrastructure upgrades for the next couple years. On the other side of the world, Chinese billionaire tech tycoons are losing billions of dollars for other reasons.
Crossing off the shopping list. Cybersecurity “unicorn” CrowdStrike is planning to raise $350 million in an initial public offering on the Nasdaq stock exchange (after settling a two-year lawsuit). Palo Alto Networks continued its months-long acquisition spree, buying two companies: Twistlock, a container security firm, for $410 million in cash and PureSec, a so-called server-less security firm, for an undisclosed sum. Insight Partners, the investment firm, bought out its portfolio company, Recorded Future, a threat intelligence startup, for $780 million. And FireEye picked up Verodin, a cybersecurity firm, for $250 million in cash and stock.
Too big for one’s breaches. Fast food restaurants Checker’s and Rally’s got hit by a data breach that affects customer payment cards at more than 100 locations. Flipboard, the social news app, reset users’ account passwords after suffering a data breach that exposed people’s names, usernames, email addresses, and cryptographically hashed passwords.
John Podesta’s creamy risotto recipe. What’s it like to train political campaigns on the art of cybersecurity? Maciej Cegłowski, founder of the social bookmarking site Pinboard (perhaps you know his Twitter account), describes the hellish experience in this incredibly entertaining post on his personal blog. If you’re in a rush, skim down to the section titled “things that worked well,” which offers tips on teaching best practices to the uninitiated.
A plum job. Every six months the U.S. military’s skunkworks, the Defense Advanced Research Agency, or DARPA, runs mock cyberattack exercises on Plum Island, a small piece of land in the Long Island Sound. The objective: Restart a power grid that’s been taken offline by hackers. The drills are practice for adversary-initiated blackouts, as Russia has allegedly caused in places like Ukraine.
