With Baltimore being held hostage, ransomware fears growing once again 

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: Fears of another ransomware attack like 2017’s WannaCry virus prompted Microsoft to take the unusual step to provide security updates for otherwise unsupported operating systems. The patch was of little solace to the city of Baltimore, which suffered an unrelated ransomware attack that shut down its email system, among other critical functions. Baltimore’s cyber woes are not unheard of, however, as one study found that ransomware attacks on state and local governments are on the rise despite the fact that many state and local governments are refusing to pay the ransom. One reason for this concerning trend could be that two prominent data recovery firms, whose clients included local municipalities, paid off Iranian hackers in secret, fueling fears that the firms are incentivizing hackers to go after city governments.

And now, on to the clips!

—————–

City of Baltimore hit with crippling ransomware attack. @magmill95 reports that the attack “took down several of the city’s services last week, including some of the capabilities of the Baltimore City Department of Transportation, the Department of Public Works, and the Department of Finance.” At the time of the drafting of this publication, “the city was still unable to send or receive email.” Officials “could not give an exact time for when the systems would all be fully operational.” (Source: The Hill)

Firms promised to free data from ransomware attacks with technology. In reality, they were secretly paying Iranian hackers. In the wake of the SamSam ransomware attacks, tech firms promised to use their “own data recovery methods but instead payed ransoms, sometimes without informing victims such as local law enforcement agencies. …” In addition to misleading their clients, the firms “charge[ed] victims substantial fees on top of the ransom amounts.” (Source: ProPublica)

Report watch: Ransomware attacks on state and local governments are on the rise. @uuallan found that “while 2018 saw a small resurgence in overall ransomware attacks, there was a sharp jump in ransomware attacks against state and local governments, and that surge seems to be continuing into 2019.” (Source: Recorded Future)

ICE pays contractors $1.2 million to hack into Americans’ iPhones. The expenditure reveals the high priority that U.S. Immigration and Customs Enforcement has placed on undermining “passcodes and other security features Americans use to keep their information private.” (Source: Washington Post)

Microsoft scrambles to stop WannaCry 2.0 before it happens. Last week, Microsoft took the “unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003, citing the discovery of a ‘wormable’ flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017.” (Source: Krebs on Security)

Russia hacked two Florida election systems during the 2016 election. Florida Gov. Ron DeSantis acknowledged that the breach occurred but stressed that “[n]othing that affected the vote count,” took place. Followers of election security will recall that “[l]ast year, former Florida Sen. Bill Nelson warned that Russia had ‘penetrated’ Florida’s voter registration systems, but election officials denied that vehemently at the time. Then-Gov. Rick Scott, who defeated Nelson in the Senate race, decried Nelson’s claims and said they ‘only serve to erode public trust in our elections at a critical time.’” (Source: NPR)

Rhode Island launches first statewide cybercrime hotline. In Rhode Island, cyber victims need to only dial 211 to “be connected with an operator who is trained to connect the victim with the proper organization to help. These include government organizations, local nonprofits, and local, state and federal agencies and resources to help protect them from further attacks and recover any money that may have been lost.” (Source: Patch)

Ajit Pai’s FCC is keeping commissioners in the dark about phone location data investigation. After news broke that AT&T, Sprint, Verizon, and T-Mobile were selling their customers’ real-time cell phone location data without their consent, the FCC vowed to look into the matter. Months later, the public still does not know what happened, and FCC Commissioners are complaining about being kept in the dark by their own agency. Commissioner Jessica Rosenworcel publicly complained that “[s]o far it appears that the FCC is more interested in protecting the privacy of its investigation than the privacy of wireless consumers across the country.” (Source: Vice)

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. (Source: Federal Trade Commission)

National Consumers League
Published May 23, 2019