Ransomware poses dangerous new threat to cities

9th April 2018   ·   0 Comments

By Fritz Esker
Contributing Writer

The governments of Atlanta and Baltimore recently found themselves victims of a dangerous and frightening form of malicious computer software: ransomware.

Atlanta’s attack was discovered on March 22. Some effects included residents not being able to pay their bills or switch on new services online. The attackers demanded $51,000 in bitcoin for the city to be able to access its files and data again.

Just a few days later, a ransomware attack crippled Baltimore’s 911 dispatch system. The city’s emergency dispatching services were shut down for almost 17 hours.

The term ransomware might be unfamiliar to those who aren’t technically savvy.

Jon Clay, director of global threat communications at Trend Micro, a cyber security company headquartered in Tokyo, Japan, described ransomware as a type of malware that either limits a user’s access to their system or prevents it entirely. The attacker locks the system’s screen or files unless the user pays a ransom. The infection can occur through a number of ways, including: a user unwittingly visiting malicious sites that download ransomware onto their systems; existing malware downloading ransomware onto a computer; attachments from spam emails; and malicious advertisements.

Once the ransomware is on the system, it will lock the computer screen and show a full-screen image or notification on the screen and stop the user from accessing their system. One form of ransomware can encrypt predetermined files on local and remote drives, making it impossible for users to access potentially valuable or important documents.

With local governments, ransomware can disable an entire network vital to a city’s daily operations. Industrial control systems, payment systems and dispatch systems can be affected.

If the ransom gets paid, the attacker can send a decryption key allowing users to access their files again. But Clay does not recommend paying the ransom. In some cases, the attacker will not send the decryption key even after payment.

While there are more specific ways to fight ransomware intrusions that can vary on a case by case basis, Clay said there are a few general pointers that everyone should remember. The first is to avoid opening unverified emails or clicking on their embedded links, which will start the ransomware installation process. The second is to back up important files using the “3-2-1 Rule.” This means you should create three backup copies on different media, with one of the backups being in a separate location. The third is to regularly update software, programs and applications to ensure that all apps are current with the latest protections against potential threats.

“Organizations with business critical systems that are connected to their employees should take special attention as these are the types of victims ransomware actors will target because if they can disrupt the operations, the victim is more likely to pay the ransomware and is likely to support an even higher ransom request,” Clay said.

While the City of New Orleans declined to make specific comments on how it fights ransomware threats, a spokesman said they are aware of the problem.

“While cyber-attacks have become more commonplace in today’s digital world, we have not detected any recent threats,” said Kim LaGrue, chief information officer for the City of New Orleans. “However, the City of New Orleans remains vigilant in managing risks through effective tools and processes to protect its people, technology and data.”

The City of Atlanta also declined to comment on specifics.

“Above all else, the city has a responsibility to secure and protect our system’s infrastructure and the residents we serve. Following the advice of our federal partners and security experts, we will not be commenting further on the attack. We continue to take a critical look at our systems and processes in order to ensure that we have the ability to continue serving our residents,” said Nicole Forman, a spokesperson for the City of Atlanta.

The City of Baltimore and the Department of Homeland Security did not return our requests for comment as of press time.

This article originally published in the April 9, 2018 print edition of The Louisiana Weekly newspaper.