Tag Archives: Technology

EU agrees to use sanctions against cyber hackers

Participant of the Pro-Europe "Pulse of Europe" movement waves European Union flag during a protest at Gendarmenmarkt square in Berlin, Germany, April 2, 2017. REUTERS/Fabrizio Bensch

LUXEMBOURG (Reuters) – The European Union can levy economic sanctions on anyone caught attacking EU states’ computer networks, EU foreign ministers said on Monday, the bloc’s latest step to deter more attacks following incidents in Britain and France.

With German national elections in September, interference in democratic votes is a concern for the bloc after accusations of Russian meddling in the U.S. presidential election last November and the French election in May.

EU foreign ministers agreed that so-called restrictive measures including travel bans, assets freezes and blanket bans on doing business with a person, company or government could be used for the first time.

“A joint EU response to malicious cyber activities would be proportionate to the scope, scale, duration, intensity, complexity, sophistication and impact of the cyber activity,” the bloc said in a statement.

U.S. intelligence agencies concluded last year that Russia hacked and leaked Democratic Party emails as part of an effort to tilt the presidential election in favor of President Donald Trump, which Russia denies.

A British intelligence agency has told political parties to protect themselves against potential cyber attacks, while the French government dropped plans to let its citizens abroad vote electronically in Sunday’s legislative elections because of the risk of cyber attacks.

(Reporting by Robin Emmott, editing by Ed Osmond)

Wall St. at record highs on technology, health stocks strength

Traders work on the floor of the New York Stock Exchange (NYSE) in New York, U.S., June 2, 2017.

By Sinead Carew

NEW YORK (Reuters) – U.S. stocks rose on Monday, with the S&P 500 and the Dow Jones Industrial Average hitting record highs helped by a technology sector rebound and strength in healthcare and financial stocks.

Nasdaq’s biotechnology index rose 2.5 percent and was on track for its biggest one-day gain since February helped by stocks including Biogen Inc and Clovis Oncology while the S&P’s healthcare index  hit a record high.

The S&P technology sector was up 1.4 percent after its second straight weekly decline, which was triggered by fears of stretched valuations. Tech stocks have led the S&P 500’s 9.4 percent rally this year.

“(Technology) valuations are not cheap but it doesn’t seem to be a deterrent for buyers,” said Mark Luschini, chief investment strategist at Janney Montgomery Scott in Philadelphia. “Investors were temporarily chased from the space but many companies in the sector offer growth which is difficult to find in the market as a whole.”

Apple rose 3.8 percent to $146.07, providing the biggest boost to technology followed by Microsoft, Alphabet and Facebook.

The financial sector was also one of the benchmark’s strongest gainers with a 0.9 percent rise after New York Federal Reserve President William Dudley, a close ally of Fed Chair Janet Yellen, said U.S. inflation was a bit low but should rise alongside wages as the labor market continues to improve, allowing the U.S. central bank to continue gradually tightening monetary policy.

Yellen’s confidence as her team raised interest rates for the third time in six months last week surprised investors who had expected more caution about the economy following a set of weak U.S. economic data.

“That was notable in supporting the financial sector which does well under the prospects of better economic conditions and a steeper yield curve,” said Luschini.

The S&P 500 bank subsector was up 1.3 percent

At 2:48 P.M. (1848 GMT), the Dow Jones Industrial Average was up 119.2 points, or 0.56 percent, to 21,503.48, the S&P 500 had gained 16.44 points, or 0.68 percent, to 2,449.59 and the Nasdaq Composite had added 74.33 points, or 1.21 percent, to 6,226.08.

Biogen shares were one of the top three S&P percentage gainers with a 3.96 percent rise to $261.71, after it was upgraded to “neutral” from “sell” at UBS, which raise its price target to $270 from $262.

Shares of Clovis Oncology were up 46.9 percent at $88 after late-stage data on its already approved ovarian cancer drug.

The S&P tech sector is trading at about 18.7 times forward earnings, compared with the historical 10-year average of 14.5, according to Thomson Reuters Datastream.

Advancing issues outnumbered declining ones on the NYSE by a 1.68-to-1 ratio; on Nasdaq, a 1.92-to-1 ratio favored advancers.

The S&P 500 posted 49 new 52-week highs and 10 new lows; the Nasdaq Composite recorded 99 new highs and 87 new lows.

(Additional reporting by Tanya Agrawal, Chuck Mikolajczak and Lewis Krauskopf; Editing by Saumyadeb Chakrabarty and James Dalgleish)

U.S. muni market slowly starts paying heed to cyber risks

FILE PHOTO: An advertisement about the Microsoft Cybercrime Center plays behind a window reflecting a nearby building at the Microsoft office in Cambridge, Massachusetts, U.S. May 15, 2017. REUTERS/Brian Snyder/File Photo

By Hilary Russ

NEW YORK (Reuters) – A rise in cyber attacks on U.S. public sector targets so far has had little impact in the $3.8 trillion municipal debt market, with no issuer as yet hit by a downgrade or higher borrowing costs because of a cyber security threat.

That is beginning to change.

S&P Global has begun to quiz states, cities and towns about their cyber defenses, and some credit analysts are starting to factor cyber security when they look at bonds. Moody’s Investors Service is also trying to figure out how to best evaluate cyber risk.

The shift follows a particularly steep rise in ransomware attacks, when criminals hold an entity’s computer system hostage until a small ransom is paid.

The number of global ransomware detections rose 36 percent in 2016 from the year before, to 463,841, with the United States most heavily affected, according to cyber security firm Symantec Corp.

Such attacks, which have also hit companies and federal entities, have spared no kind of municipal issuer large or small, from police departments to school districts and transit agencies. Ransomware attacks on state and local governments and their agencies have risen in proportion with the overall increase, according to cyber insurance provider Beazley Group.

“State and local governments are a huge target, quite frankly an easy target for bad guys,” said Bob Anderson, managing director for information security at Navigant management consulting firm in Washington and a former global cyber investigator at the Federal Bureau of Investigation.

Last month’s “WannaCry” ransomware attack, which hobbled global businesses and Britain’s National Health Service, may also be prompting renewed focus on cyber security, though it had minimal impact in the United States.

Considering a potential cyber attack as a similar risk to a natural disaster, S&P has already been reviewing cyber security defenses of utilities, hospitals and colleges because they were early public sector targets for hackers.

Now it is also beginning to ask cities and states about the costs and level of security measures and the financial impact of successful attacks, said Geoffrey Buswick, who manages S&P’s public sector ratings.

HEAD IN THE SAND

The answers feed into broader categories that affect an issuer’s ratings, particularly governance, liquidity and operations.

Many breaches are handled quickly and financial damage is limited, but not every attack will necessarily end that way, Buswick said. “We’re trying to get sense of who has their head in the sand and who doesn’t.”

Fitch Ratings said it does not consider cyber security in its ratings, and many investors still are not concerned enough to ask for details.

In part, that is because it can be difficult to assess the operational and financial fallout of such attacks. Some high profile breaches so far have also done limited damage to issuers’ finances.

Case in point is the state of South Carolina, which in August 2012 suffered possibly the worst cyber attack yet of any city or state.

When hackers stole the personal data of more than 3.5 million taxpayers, the state had to investigate, provide credit monitoring and consumer fraud protection, and implement a slew of post-breach upgrades, according to State Senator Thomas Alexander.

The total cost is around $76 million and counting, he said. That is enough to pay for several school programs combined. But against South Carolina’s annual general fund budget of roughly $8 billion, the costs made no dent in its standing as a borrower.

Many issuers do not disclose any information to potential investors in bond documents about cyber risks or defenses. But a few, particularly hospitals and utilities, have started doing so.

In a February prospectus, the Maryland Health and Higher Educational Facilities Authority, the state’s largest public debt issuer, included nearly a full page devoted to the growing risk of cyber attacks.

“Because we’re such a large issuer, and because healthcare is often treated much more like a corporate credit, the legal counsels to the transaction weigh in on the bondholder risk section,” said Annette Anselmi, the authority’s Executive Director, noting that such disclosures also evolve depending on what kinds of questions the market is asking.

Hospitals are also ahead on cyber security disclosure because they rely on huge amounts of data, said Court Street Group analyst Joseph Krist.

Eventually, he expects others to follow suit.

“We went through this with getting munis to … disclose more pension information. Those were frankly long and painful processes. It just has to get to a critical mass.”

(Reporting by Hilary Russ; Additional reporting by Jim Finkle in Toronto; Editing by Daniel Bases and Tomasz Janowski)

Facebook launches features to connect U.S. users to elected officials

FILE PHOTO: A picture illustration shows a Facebook logo reflected in a person's eye, in Zenica, March 13, 2015. REUTERS/Dado Ruvic/Illustration/File Photo

By Dustin Volz

WASHINGTON (Reuters) – Facebook Inc <FB.O> announced a set of three new features on Wednesday intended to boost civic engagement among users in the United States on its platform by connecting them more easily with their elected representatives.

The new offerings come as the social media juggernaut has sought to rehabilitate its image as a credible source of information following a wave of criticism after last November’s presidential election that the company did too little to combat misleading or wholly fabricated political news stories during the campaign.

Among the features, Facebook will now allow users to turn on “Constituent Badges” to identify them as living in their elected officials’ district. The opt-in badge will be visible when a user comments on content shared by their federal, state and local representatives.

Facebook also announced “Constituent Insights,” which allows elected officials and other users to find local news stories that are popular in their district.

“District Targeting” creates a new preset audience selection that lets politicians’ pages target posts to people likely to be their constituents.

Facebook has continued to come under attack from prominent Democrats and some technology experts despite a raft of changes it has made in recent months that seek to help users consume more legitimate political news.

Hillary Clinton, who ran for president as a Democrat last year but lost to President Donald Trump, a Republican, said last week that Facebook was flooded with false information about her during the campaign and that people were understandably misled. She said she wanted Facebook to curate its network more aggressively.

(Reporting by Dustin Volz; Editing by Bill Trott)

Chipotle says hackers hit most restaurants in data breach

Signage for a Chipotle Mexican Grill is seen in Los Angeles, California, United States, April 25, 2016. REUTERS/Lucy Nicholson/File Photo

By Lisa Baertlein

(Reuters) – Hackers used malware to steal customer payment data from most of Chipotle Mexican Grill Inc’s <CMG.N> restaurants over a span of three weeks, the company said on Friday, adding to woes at the chain whose sales had just started recovering from a string of food safety lapses in 2015.

Chipotle said it did not know how many payment cards or customers were affected by the breach that struck most of its roughly 2,250 restaurants for varying amounts of time between March 24 and April 18, spokesman Chris Arnold said via email.

A handful of Canadian restaurants were also hit in the breach, which the company first disclosed on April 25.

Stolen data included account numbers and internal verification codes. The malware has since been removed.

The information could be used to drain debit card-linked bank accounts, make “clone” credit cards, or to buy items on certain less-secure online sites, said Paul Stephens, director of policy and advocacy at the non-profit Privacy Rights Clearinghouse.

The breach could once again threatens sales at its restaurants, which only recently recovered after falling sharply in late 2015 after Chipotle was linked to outbreaks of E. coli, salmonella and norovirus that sickened hundreds of people.

An investigation into the breach found the malware searched for data from the magnetic stripe of payment cards.

Arnold said Chipotle could not alert customers directly as it did not collect their names and mailing addresses at the time of purchase.

The company posted notifications on the Chipotle and Pizzeria Locale websites and issued a news release to make customers aware of the incident.

Linn Freedman, an attorney at Robinson & Cole LLP specializing in data breach response, said Chipotle was putting the burden on the consumer to discover possible fraudulent transactions by notifying them through the websites.

“I don’t think you will get to all of the customers who might have been affected,” she said.

Security analysts said Chipotle would likely face a fine based on the size of the breach and the number of records compromised.

“If your data was stolen through a data breach that means you were somewhere out of compliance” with payment industry data security standards, Julie Conroy, research director at Aite Group, a research and advisory firm.

“In this case, the card companies will fine Chipotle and also hold them liable for any fraud that results directly from their breach,” said Avivah Litan, a vice president at Gartner Inc <IT.N> specializing in security and privacy.

Chipotle did not immediately comment on the prospect of a fine.

Retailer Target Corp <TGT.N> in 2017 agreed to pay $18.5 million to settle claims stemming from a massive data breach in late 2013.

Hotels and restaurants have also been hit. They include Trump Hotels, InterContinental Hotels Group <IHG.L> as well as Wendy’s <WEN.O>, Arby’s and Landry’s restaurants.

Shares in Chipotle Mexican Grill ended marginally lower at $480.15 on Friday following the announcement.

(Additional reporting by Natalie Grover and Siddharth Cavale in Bengaluru and Tom Polansek and Nandita Bose in Chicago; Editing by Grant McCool and Lisa Shumaker)

Newly discovered vulnerability raises fears of another WannaCry

FILE PHOTO: A hooded man holds a laptop computer as blue screen with an exclamation mark is projected on him in this illustration picture taken on May 13, 2017. REUTERS/Kacper Pempel/Illustration

SINGAPORE (Reuters) – A newly found flaw in widely used networking software leaves tens of thousands of computers potentially vulnerable to an attack similar to that caused by WannaCry, which infected more than 300,000 computers worldwide, cybersecurity researchers said on Thursday.

The U.S. Department of Homeland Security on Wednesday announced the vulnerability, which could be exploited to take control of an affected computer, and urged users and administrators to apply a patch.

Rebekah Brown of Rapid7, a cybersecurity company, told Reuters that there were no signs yet of attackers exploiting the vulnerability in the 12 hours since its discovery was announced.

But she said it had taken researchers only 15 minutes to develop malware that made use of the hole. “This one seems to be very, very easy to exploit,” she said.

Rapid7 said it had found more than 100,000 computers running vulnerable versions of the software, Samba, free networking software developed for Linux and Unix computers. There are likely to be many more, it said in response to emailed questions.

Most of the computers found are running older versions of the software and cannot be patched, said Brown.

Some of the computers appear to belong to organizations and companies, she said, but most were home users.

The vulnerability could potentially be used to create a worm like the one which allowed WannaCry to spread so quickly, Brown said, but that would require an extra step for the attacker.

Cybersecurity researchers have said they believe North Korean hackers were behind the WannaCry malware, which encrypted data on victims’ computers and demanded bitcoin in return for a decryption key.

(Reporting and writing By Jeremy Wagstaff; Editing by Michael Perry)

Security experts find clues to ransomware worm’s lingering risks

FILE PHOTO: A man types on a computer keyboard in front of the displayed cyber code in this illustration picture taken March 1, 2017. REUTERS/Kacper Pempel/Illustration/File Photo

(Corrects spelling of first name in paragraph 22 of this May 18 story to Salim from Samil)

By Eric Auchard

FRANKFURT (Reuters) – Two-thirds of those caught up in the past week’s global ransomware attack were running Microsoft’s Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found.

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying “patient zero” could help catch its criminal authors.

They are having more luck dissecting flaws that limited its spread.

Security experts warn that while computers at more than 300,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences.

“Some organizations just aren’t aware of the risks; some don’t want to risk interrupting important business processes; sometimes they are short-staffed,” said Ziv Mador, vice president of security research at Trustwave’s Israeli SpiderLabs unit.

“There are plenty of reasons people wait to patch and none of them are good,” said Mador, a former long-time security researcher for Microsoft.

WannaCry’s worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations & incident response at UK consulting firm MWR InfoSecurity.

Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 percent of infections, although it represents less than half of the global distribution of Windows PC users.

Computers running older versions, such as Windows XP used in Britain’s NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported.

In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread.

Windows 10, the latest version of Microsoft’s flagship operating system franchise, accounts for another 15 percent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated.

COMPUTER BASICS

Any organization which heeded strongly worded warnings from Microsoft to urgently install a security patch it labeled “critical” when it was released on March 14 on all computers on their networks are immune, experts agree.

Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs.

“Clearly people who run supported versions of Windows and patched quickly were not affected”, Trustwave’s Mador said.

Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government canceled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts.

Seeking to head off further criticism in the wake of the WannaCry outbreak, the U.S. software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers.(http://reut.rs/2qvSPUR)

Microsoft declined to comment for this story.

On Sunday, the U.S. software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret – in order to conduct espionage and cyber warfare – and sharing those flaws with technology companies to better secure the internet (http://reut.rs/2qAOdLm).

Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 percent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic.

By contrast, the United States accounts for 7 percent of WannaCry infections while Britain, France and Germany each represent just 2 percent of worldwide attacks, Kryptos said.(http://tmsnrt.rs/2qIUckv)

DUMB AND SOPHISTICATED

The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from the U.S. National Security Agency, creating a vastly potent class of crimeware.

“What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption”, said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic.

Last Friday, the company’s British-based 22-year-old data breach research chief, Marcus Hutchins, created a “kill-switch”, which security experts have widely hailed as the decisive step in halting the ransomware’s rapid spread around the globe.

WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home.

An unknown number of computers sit behind the 300,000 infected internet connections identified by Kryptos.

Because of the way WannaCry spreads sneakily inside organization networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday.

Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: “The attack shows how sophisticated ransomware has become, forcing even unaffected organizations to rethink strategies.”

ESCAPE ROUTE

Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed.

However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: “Users unlikely to get files restored”, the company’s Security Response team tweeted.

The rapid recovery by many organizations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said.

While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree.

These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims.

Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever. (Reuters graphic: [http://tmsnrt.rs/2rqaLyz)

The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organizations install major new software security patches.

WannaCry landed nine weeks after Microsoft’s patch arrived.

“The same things are causing the same problems. That’s what the data shows,” MWR research head Pratley said.

“We haven’t seen many organizations fall over and that’s because they did some of the security basics,” he said.

For a graphic on WannaCry worm, click http://fingfx.thomsonreuters.com/gfx/rngs/CYBER-ATTACK/010041552FY/index.html

(Editing by Philippa Fletcher)

Hackers hit Russian bank customers, planned international cyber raids

FILE PHOTO: The logo of Sberbank is seen on top of a building in central Moscow, Russia April 22, 2016. REUTERS/Maxim Zmeyev/File Photo

By Jack Stubbs

MOSCOW (Reuters) – Russian cyber criminals used malware planted on Android mobile devices to steal from domestic bank customers and were planning to target European lenders before their arrest, investigators and sources with knowledge of the case told Reuters.

Their campaign raised a relatively small sum by cyber-crime standards – more than 50 million roubles ($892,000) – but they had also obtained more sophisticated malicious software for a modest monthly fee to go after the clients of banks in France and possibly a range of other western nations.

Russia’s relationship to cyber crime is under intense scrutiny after U.S. intelligence officials alleged that Russian hackers had tried to help Republican Donald Trump win the U.S. presidency by hacking Democratic Party servers.

The Kremlin has repeatedly denied the allegation.

The gang members tricked the Russian banks’ customers into downloading malware via fake mobile banking applications, as well as via pornography and e-commerce programs, according to a report compiled by cyber security firm Group-IB which investigated the attack with the Russian Interior Ministry.

The criminals – 16 suspects were arrested by Russian law enforcement authorities in November last year – infected more than a million smartphones in Russia, on average compromising 3,500 devices a day, Group-IB said.

The hackers targeted customers of state lender Sberbank <SBER.MM>, and also stole money from accounts at Alfa Bank and online payments company Qiwi <QIWI.O>, exploiting weaknesses in the companies’ SMS text message transfer services, said two people with direct knowledge of the case.

Although operating only in Russia before their arrest, they had developed plans to target large European banks including French lenders Credit Agricole <CAGR.PA>, BNP Paribas <BNPP.PA> and Societe Generale <SOGN.PA>, Group-IB said.

A BNP Paribas spokeswoman said the bank could not confirm this information, but added that it “has a significant set of measures in place aimed at fighting cyber attacks on a daily basis”. Societe Generale and Credit Agricole declined comment.

The gang, which was called “Cron” after the malware it used, did not steal any funds from customers of the three French banks. However, it exploited the bank service in Russia that allows users to transfer small sums to other accounts by sending an SMS message.

Having infected the users’ phones, the gang sent SMS messages from those devices instructing the banks to transfer money to the hackers’ own accounts.

The findings illustrate the dangers of using SMS messages for mobile banking, a method favored in emerging countries with less advanced internet infrastructure, said Lukas Stefanko, a malware researcher at cyber security firm ESET in Slovakia.

“It’s becoming popular among developing nations or in the countryside where access to conventional banking is difficult for people,” he said. “For them it is quick, easy and they don’t need to visit a bank… But security always has to outweigh consumer convenience.”

CYBER CRIMINALS

The Russian Interior Ministry said a number of people had been arrested, including what it described as the gang leader. This was a 30-year-old man living in Ivanovo, an industrial city 300 km (185 miles) northeast of Moscow, from where he had commanded a team of 20 people across six different regions.

Four people remain in detention while the others are under house arrest, the ministry said in a statement.

“In the course of 20 searches across six regions, police seized computers, hundreds of bank cards and SIM cards registered under fake names,” it said.

Group-IB said the existence of the Cron malware was first detected in mid-2015, and by the time of the arrests the hackers had been using it for under a year.

The core members of the group were detained on Nov. 22 last year in Ivanovo. Photographs of the operation released by Group-IB showed one suspect face down in the snow as police in ski masks handcuffed him.

The “Cron” hackers were arrested before they could mount attacks outside Russia, but plans to do that were at an advanced stage, said the investigators.

Group-IB said that in June 2016 they had rented a piece of malware designed to attack mobile banking systems, called “Tiny.z” for $2,000 a month. The creators of the “Tiny.z” malware had adapted it to attack banks in Britain, Germany, France, the United States and Turkey, among other countries.

The “Cron” gang developed software designed to attack lenders including the three French groups, it said, adding it had notified these and other European banks at risk.

A spokeswoman for Sberbank said she had no information about the group involved. However, she said: “Several groups of cyber criminals are working against Sberbank. The number of groups and the methods they use to attack us change constantly.”

“It isn’t clear which specific group is being referred to here because the fraudulent scheme involving Android OS (operating system) viruses is widespread in Russia and Sberbank has effectively combated it for an extensive period of time.”

Alfa Bank did not provide a comment. Qiwi did not respond to multiple requests for comment.

Google <GOOGL.O>, the maker of Android, has taken steps in recent years to protect users from downloading malicious code and by blocking apps which are insecure, impersonate legitimate companies or engage in deceptive behaviors.

A Google spokesman said: “We’ve tracked this malware family for several years and will continue to take action on its variants to protect our users.”

FAKE MOBILE APPS

The Russian authorities, bombarded with allegations of state-sponsored hacking, are keen to show Russia too is a frequent victim of cyber crime and that they are working hard to combat it. The interior and emergencies ministries, as well as Sberbank, said they were targeted in a global cyberattack earlier this month.

Since the allegations about the U.S. election hacking, further evidence has emerged of what some Western officials say is a symbiotic relationship between cyber criminals and Russian authorities, with hackers allowed to attack foreign targets with impunity in return for cooperating with the security services while Moscow clamps down on those operating at home.

The success of the Cron gang was facilitated by the popularity of SMS-banking services in Russia, said Dmitry Volkov, head of investigations at Group-IB.

The gang got their malware on to victims’ devices by setting up applications designed to mimic banks’ genuine apps. When users searched online, the results would suggest the fake app, which they would then download. The hackers also inserted malware into fake mobile apps for well-known pornography sites.

After infecting a customer’s phone, the hackers were able to send a text message to the bank initiating a transfer of up to $120 to one of 6,000 bank accounts set up to receive the fraudulent payments.

The malware would then intercept a confirmation code sent by the bank and block the victim from receiving a message notifying them about the transaction.

“Cron’s success was due to two main factors,” Volkov said. “First, the large-scale use of partner programs to distribute the malware in different ways. Second, the automation of many (mobile) functions which allowed them to carry out the thefts without direct involvement.”

($1 = 56.0418 roubles)

(The story is refiled to fix typo in spelling of Societe Generale)

(Additional reporting by Maya Nikolaeva in Paris and Eric Auchard in Frankfurt; Editing by Christian Lowe and David Stamp)

Companies use kidnap insurance to guard against ransomware attacks

FILE PHOTO: A screenshot shows a WannaCry ransomware demand, provided by cyber security firm Symantec, in Mountain View, California, U.S. May 15, 2017. Courtesy of Symantec/Handout via REUTERS/File Photo

By Suzanne Barlyn and Carolyn Cohn

NEW YORK/LONDON (Reuters) – Companies without cyber insurance are dusting off policies covering kidnap, ransom and extortion in the world’s political hotspots to recoup losses caused by ransomware viruses such as “WannaCry”, insurers say.

Cyber insurance can be expensive to buy and is not widely used outside the United States, with one insurer previously describing the cost as $100,000 for $10 million in data breach insurance.

Some companies do not even consider it because they do not think they are targets.

The kidnap policies, known as K&R coverage, are typically used by multinational companies looking to protect their staff in areas where violence related to oil and mining operations is common, such as parts of Africa and Latin America. Companies could also tap them to cover losses following the WannaCry attack, which used malicious software, known as ransomware, to lock up more than 200,000 computers in more than 150 countries, and demand payments to free them up. Pay-outs on K&R for ransomware attacks may be lower and the policies less suitable than those offered by traditional cyber insurance, insurers say.

“There will be some creative forensic lawyers who will be looking at policies,” said Patrick Gage, chief underwriting officer at CNA Hardy, a specialist commercial insurer, in London.

He added, however, that given that K&R policies are geared towards a threat to lives, “our absolute preference is that people buy specific cover, rather than relying on insurance coverage that is not specific”.

American International Group Inc, Hiscox Ltd and the Travelers Companies Inc have been receiving ransomware claims from some customers with K&R policies as ransomware attacks become more common, the companies said.

The insurers declined to comment on total claims, citing confidentiality and client security concerns.

“We are seeing claims (over the past 18 months) but not a huge uptick,” a Hiscox spokeswoman said. “These are within expectations and entirely manageable.”

She declined to say whether the firm had seen any such claims from the WannaCry attacks though Tom Harvey, an expert in cyber risk management at catastrophe modeling firm RMS, said “insurers with kidnap and ransom books will want to look closely at their policy wordings to see whether they are exposed.”

A sharp rise in ransomware attacks in the past 18 months has driven companies to use K&R policies to cover some of their damages if they do not have direct cyber coverage or cannot meet initial cyber policy deductible costs, insurers said.

Symantec Corp,, a cyber security firm based in Mountain View in California, observed over 460,000 ransomware attempts in 2016, up 36 percent from 2015, the company said. The average payment demand ballooned from $294 to $1,077, a 266 percent increase. But as the threat mounts, K&R insurers are at risk from steeper claims than they had anticipated. They are responding by making changes to their policies, which were not designed around ransomware, insurance brokers said. MORE DAMAGING THEN KIDNAPPING Most of the computers affected by WannaCry were outside the United States, where companies have been slow to buy cyber insurance. Nearly 90 percent of the world’s annual cyber insurance premium of $2.5-3 billion comes from the U.S. market, according to insurance broker Aon Plc.

Global companies typically buy K&R policies without ransomware in mind. But instances of high-tech hacks and online ransom demands can hit a company’s business more than an executive being held hostage.

“If your CFO (chief financial officer) gets kidnapped, the company is going to continue to function,” said Bob Parisi, cyber product leader for insurance broker Marsh & McLennan Companies Inc.

“If you get a get a piece of malware in the system, you might have two factories that stop working. The actual damage is probably greater.”

The K&R policies, which typically do not have deductibles, cover the ransom payments as well as crisis response services, including getting in touch with criminal and regulatory authorities, said Kevin Kalinich, global head of Aon’s cyber risk practice.

Still, K&R policies may provide only a quick fix since they were not designed for ransomware. Companies can add coverage for business interruption, but the upper limits for pay-outs are usually lower than for a cyber policy, insurers say.

K&R insurers have been adapting to ransomware-related claims – some are modernizing coverage by setting up Bitcoin accounts for clients to speed up ransom payments, brokers said.

But insurers are mindful of their own risks.

Some have added deductibles, said Anthony Dagostino, head of global cyber risk at Willis Towers Watson PLC advisory and brokerage.

AIG has reduced business interruption coverage available for K&R policies to a $1 million maximum, from much higher and more flexible limits, said Tracie Grella, global head of cyber risk insurance at AIG.

“Insurers didn’t anticipate there would be this much ransomware activity,” Grella said.

(Reporting by Suzanne Barlyn and Carolyn Cohn; Editing by Carmel Crimmins adn Timothy Heritage)

Bitcoin’s murkier rivals line up to displace it as cybercriminals’ favourite

FILE PHOTO: A Bitcoin (virtual currency) paper wallet with QR codes and a coin are seen in an illustration picture taken in Paris, France May 27, 2015. REUTERS/Benoit Tessier/File Photo

By Jemima Kelly

LONDON (Reuters) – Bitcoin is well-entrenched as the preferred payment for cybercriminals like the WannaCry hackers who have hit more than 300,000 computers over the past week, but cryptocurrencies offering more anonymity are threatening to displace it.

A key reason for bitcoin’s dominance in the nefarious online underworld, say technologists and cybercrime experts, is its size – the total value of all bitcoins in circulation is more than twice that of the nearest of hundreds of rivals.

That makes it easy for victims to access enough to pay the ransoms demanded, and for hackers to cash out of it via online exchanges to spend money in the real world.

Bitcoin was set up in 2008 by someone – or some group – calling themselves Satoshi Nakamoto, and was the first digital currency to successfully use cryptography to keep transactions secure and hidden, making traditional financial regulation difficult if not impossible.

Money is sent from one anonymous online “wallet” to another with no need for a third party to validate or clear the transactions.

In the WannaCry attack, the addresses of three anonymous bitcoin wallets were given to victims, with a demand for ransom payments from $300 worth of bitcoin, with a promise the affected machines would be decrypted in return, a promise that no evidence has shown will be kept.

But since the way that Bitcoin functions is via the blockchain – a giant, virtually tamper-proof, shared ledger of all bitcoin transactions ever made – payments can be traced, if users do not have the sophistication to take further steps to cloak themselves using digital anonymity tools.

“In the initial days of bitcoin, people…didn’t realise they were recording for posterity on the blockchain every financial transaction that ever took place,” said Emin Gun Sirer, a computer science professor at Cornell University.

Bitcoin addresses are anonymous, but users can be traced through IP addresses or by analysing money flows.

If criminals using bitcoin want to stay truly anonymous, Gun Sirer said, they have to go through a number of additional, complex steps to make sure they do not get caught.

It is not yet clear what level of sophistication the WannaCry hackers have when it comes to laundering their cryptocurrency, as none of the money has yet been moved out of the three bitcoin wallets linked to the ransomware, which have had over $80,000 worth of bitcoin paid into them so far. [http://tmsnrt.rs/2rqaLyz]

But some have suggested that the fact that the WannaCry hackers demanded bitcoin shows how amateur they are.

“If it was me, I would want people to use bitcoin all day, because you can trace it,” said Luke Wilson, vice president for law enforcement at Elliptic, a London-based security firm that tracks illicit bitcoin transactions and that counts the U.S. Federal Bureau for Investigations (FBI) among its clients.

Wilson, who used to work at the FBI, where he set up a taskforce to investigate the use of virtual currencies, did not disclose all the ways that Elliptic and law enforcement agencies find criminals using bitcoin. But sometimes, he said, the offenders make as obvious a mistake as withdrawing money from a bitcoin wallet directly into their bank accounts.

CAT-AND-MOUSE GAME

More sophisticated criminals use obfuscation methods that make it very hard to be tracked down. One of the most basic ones is a technique known as “chain-hopping”, whereby money is moved from one cryptocurrency into another, across digital currency exchanges – the less-regulated the better – to create a money trail that is almost impossible to track.

Newer and more complex money-laundering methods have also emerged in recent years, which make it very difficult for law enforcement and bitcoin security firms such as Elliptic or New-York-based Chainalysis to track down cybercriminals.

“It’s a cat-and-mouse game – as police and companies like Elliptic catch up to criminals’ techniques, they invent new techniques,” said Jerry Brito, executive director of the Washington, D.C.-based Coin Center, a not-for-profit advocacy group focusing on public policy issues around cryptocurrency.

These techniques are not foolproof, however – chain-hopping, for example, relies on unregulated exchanges that do not carry out know-your-customer (KYC) checks, and security firms say they will develop ways to trace such methods.

MONERO HACK

Easier, perhaps, would be for cybercriminals to use next-generation cryptocurrencies that have built-in anonymity from the start, such as Monero, Dash and Z-Cash.

And indeed, experts said late on Tuesday that a computer virus that exploits the same vulnerability as the WannaCry attack had latched on to more than 200,000 computers and begun using them to manufacture – or “mine” – Monero currency.

But with a total value of around $425 million – a little over 1 percent of that of bitcoin – converting that currency into spendable cash might not be so easy, and it is also much harder for victims to access, alternative payments experts said.

That is why the Monero attack did not demand a ransom, but rather used the infected computers’ computing power to create new currency.

“This used to happen in bitcoin before it became big – there were loads of botnets that went into computers that used to mine bitcoin, but you now can’t basically mine bitcoin on normal computers because you need specialist hardware,” said Chainalysis CEO Jonathan Levin.

Levin said such bitcoin-based attacks were carried out several years ago, when mining it was still largely a hobby for tech geeks using their home computers.

As the bitcoin price has risen and as transaction numbers have grown, the computers have become so specialized that only they can only perform the function of bitcoin mining.

“If Monero does become adopted and is as big and liquid (as bitcoin), that means the crime (will) move from using computers to mine to getting to extortion,” Levin said.