WannaCry Ransomware Attack
What responsibility do intelligence agencies have to release software vulnerabilities they discover?
In 2017, a series of ransomware attacks across the world begged this question. The WannaCry ransomware took advantage of a vulnerability in Microsoft Windows computers. The vulnerability was discovered by the United States National Security Agency (NSA), who wrote a tool to spread it even more easily and kept it to themselves. This tool, Eternal Blue, was stolen from the NSA in 2016 and released onto the internet. When the NSA discovered this, they disclosed that the vulnerability had been stolen and notified Windows, which released a patch to its systems in March 2017. However, many systems didn't update and were therefore affected by the ransomware.
Ransomware holds computers "hostage"--it locks down data on computers until some set of demands are met. In the case of WannaCry, it was money; however, it can be more sinister than that.
WannaCry affected many commercial and government systems, including the United Kingdom's National Health Service and Boeing.
For more information, read: https://www.nytimes.com/2018/03/28/technology/boeing-wannacry-malware.html
Were any systems in your countries affected by WannaCry? Do you think that the NSA had a responsibility to release the bug to Microsoft as soon as they found it, protecting the systems of others from unintended consequences? Should international law prevent against countries holding cyberweapons like Eternal Blue?
Sources:
In 2017, a series of ransomware attacks across the world begged this question. The WannaCry ransomware took advantage of a vulnerability in Microsoft Windows computers. The vulnerability was discovered by the United States National Security Agency (NSA), who wrote a tool to spread it even more easily and kept it to themselves. This tool, Eternal Blue, was stolen from the NSA in 2016 and released onto the internet. When the NSA discovered this, they disclosed that the vulnerability had been stolen and notified Windows, which released a patch to its systems in March 2017. However, many systems didn't update and were therefore affected by the ransomware.
Ransomware holds computers "hostage"--it locks down data on computers until some set of demands are met. In the case of WannaCry, it was money; however, it can be more sinister than that.
WannaCry affected many commercial and government systems, including the United Kingdom's National Health Service and Boeing.
For more information, read: https://www.nytimes.com/2018/03/28/technology/boeing-wannacry-malware.html
Were any systems in your countries affected by WannaCry? Do you think that the NSA had a responsibility to release the bug to Microsoft as soon as they found it, protecting the systems of others from unintended consequences? Should international law prevent against countries holding cyberweapons like Eternal Blue?
Sources:
- https://www.cnet.com/news/wannacry-wannacrypt-uiwix-ransomware-everything-you-need-to-know/
- https://www.nytimes.com/2018/03/28/technology/boeing-wannacry-malware.html
A multitude of Chinese systems were affected by the WannaCry ransomware attack. It completely paralyzed an online payment system and also shut down a police department’s communication system. As a result, the China National Petroleum Corp petrol stations were only able to accept cash payments, internet systems had to be shut down at many universities, and the CNERT (national computer response body) had to urge users to install cybersecurity patches. In addition, in Taiwan’s Semiconductor Manufacturing Company (TSMC), over 10,000 of its most advanced machines were affecting and manufacturing was completely shut down. (South China Morning Post, 2017).
ReplyDeleteChina strongly believes that is was the responsibility for organizations such as the NSA to release information of the bug as soon as it was discovered. Although the bug was released by North Korea, cyberterrorism must be viewed as an international crisis, just as normal terrorism is. The international community must cooperate to help each other from similar crises, and therefore, to serve its duty to the international community, the NSA should have immediately released the information it gathered. But instead, it kept this information to itself and even helped it spread faster using EternalBlue, something China will not stand for.
Tools such as EternalBlue should not be tolerated in other countries. Cyberterrorism must be eliminated through international cooperation, and developing cyberterrorism tools is utterly counterproductive and counterintuitive. Actions made by the NSA go against the purposes of this committee.
The Delegation of China
“Ransomware Hits Police and Petrol Stations in China.” South China Morning Post, South China
Morning Post, 15 May 2017, www.scmp.com/news/china/society/article/2094291/
chinese-police-and-petrol-stations-hit-ransomware-attack.
This is a blatant violation of cyber sovereignty, however private companies do claim responsibility for their own security. Ideally, the government should have access to private companies' information if it could in any way provide an indirect link to government-owned or government-related information, as that falls under an attack on national security. With the government overseeing all companies' systems, there would be no need for secrecy between government and corporation and it would be in the interest of all to share any vulnerabilities in online systems.
ReplyDeleteThe Delegation of the Democratic People's Republic of Korea
The massive WannaCry ransomware attack hit hundreds of thousands of computers from Taiwan to the United Kingdom. Despite the global nature of the attack, few networks and companies in the United States appeared to have been hit. The reason being is a combination of geography and adherence to software updates, though we are by no mean invulnerable to such attacks. WannaCry took advantage of flaws in unpatched copies of some versions of Windows, especially Windows XP. The ransomware encrypted all the files on an infected computer and demanded the equivalent of an estimated $300 in bitcoin, an untraceable digital currency, to unlock a user's data. Of the small portion that was hit in the US, was automaker Renault and US shipper FedEx. However, unlike typical ransomware hacks, which require an individual user to open an emailed attachment or click on an advertisement that contains malicious software, the WannaCry hack was able to transmit itself without the user doing anything. Due to the fact that the malware spread from unprotected network to unprotected network, it relied upon quirks of geography and topology to propagate. Networks within countries and regions tend to be more densely connected than those physically distant from each other, thus, with the largest site of infection in eastern Europe and Asia, there weren't as many jumps it could make to the US. Another reason why the US was not so hard-hit is that companies and individuals in the US are much less likely to run pirated versions of the Windows operating system. We generally pay more attention to security than other countries may and with this, US companies and individuals are more security-conscious attaining security programs that proved protective against the software.
ReplyDeleteAs a signal intelligence agency, the NSA comes across many vulnerabilities in software that it can then use to achieve its intelligence goals. This could be mission-critical for the agency. NSA did not have the responsibility to release the bug to Microsoft as soon as they found it. The NSA could not know if anyone else had found this vulnerability, or bought it. They couldn't know if anyone else was using it, unless that someone else was caught using it. When the NSA stumbles upon serious vulnerabilities that could cause devastating damage in the wrong hands, it is crucial that they act with quick and precise measures and ensure that what they have found is in fact what they believe it is to be before causing an alarm. The agency's mission is to protect the United States, and by holding on to the information of the bug, the US was doing exactly that before released by North Korea.
International law should not prevent against countries holding cyberweapons. Assessing the legality of weapons is in the interest of all States, as it will help them ensure it acts in accordance with their international obligations. The use of cyber operations is essential as means and methods of warfare, in which those currently holding cyberweapons should be able to at their own extent without the intervention of international law.
The Delegation of the United States
At this point, cyberterrorism is a global crisis that requires international cooperation. The fact U.S. intelligence services had information on this attack yet withheld it from its allies and other countries goes against the values and goals of this committee. While China may disagree with previous actions the United States has taken with this issue, it is still looking forward to working with the U.S. in hopes of tackling future attacks more efficiently, and in a way that keeps the international community aware of such information.
Delete-The Delegation of China