The cyberattack that spread around the globe over the weekend, hitting businesses, hospitals and government agencies in at least 150 countries, infected more computers as users returned to work early Monday. 
 
 Investigators launched a far-reaching hunt for the perpetrator, as institutions around the world worked to mitigate damage from the highest-profile computer-worm outbreak in nearly a decade. Europe’s police-coordination agency estimated at least 200,000 individual terminals had fallen victim to the attack, while Chinese... ||||| What does ransomware do? 
 
 There are different types of ransomware. However, all of them will prevent you from using your PC normally, and they will all ask you to do something before you can use your PC. 
 
 They can target any PC users, whether it’s a home computer, endpoints in an enterprise network, or servers used by a government agency or healthcare provider. 
 
 Ransomware can: 
 
 Prevent you from accessing Windows. 
 
 Encrypt files so you can't use them. 
 
 Stop certain apps from running (like your web browser). 
 
 Ransomware will demand that you pay money (a “ransom”) to get access to your PC or files. We have also seen them make you complete surveys. 
 
 There is no guarantee that paying the fine or doing what the ransomware tells you will give access to your PC or files again. ||||| Bitcoin took a dive from its $1,800 territory down to $1,600 Friday, but it has since managed to recover and as of late Saturday was back in high $1,700 territory. The drop naturally alarmed the market, given the steady gains the currency has made in the last two weeks. 
 
 The Friday dip could have been caused by the WannaCry bitcoin malware infection that has afflicted 36,000 computers. The malware automatically encrypts files on the victim’s computer and tells the user to send $300 in bitcoin to a particular bitcoin address. 
 
 Hackers Seek To Short Bitcoin? 
 
 If the attackers are motivated by making a fast profit, they could be trying to manipulate the bitcoin price with the intention of shorting the currency. The hackers have given their victims a short time frame to unlock their computers. 
 
 Given the small size of the bitcoin market compared to other commodities, such price manipulation might be possible. 
 
 The malware infection is an alarming story with international implications that casts bitcoin in a highly negative light. It wouldn’t be unreasonable for a bitcoin holder to get nervous about being overexposed in the bitcoin market and deciding to sell some if not all of their bitcoin. 
 
 Advertisement: 
 
 
 
 Nor would it be farfetched to worry that governments could see WannaCry as a reason to enact restrictions on bitcoin as a way to prevent future malware attacks, a move that would further diminish bitcoin’s price. 
 
 Could The Publicity Help Bitcoin? 
 
 But at the same time, the publicity over the malware infection caused many media outlets to educate the public about bitcoin, which could drive demand, ultimately delivering price recovery. 
 
 The dip could also have marked the start of a price correction. Some analysts have claimed bitcoin has become overvalued. Maria Terekhova noted in Business Insider yesterday that questions are starting to arise as to whether the asset is headed for a bubble. 
 
 Another explanation could be that the price is simply consolidating its gains for the time being. 
 
 The fact that the gains have been steady this year is a positive reading, as opposed to the volatility of 2013 and 2014. 
 
 Challenges Still Exist 
 
 Some observers have expected a market correction to the recent rally on account of some challenges bitcoin continues to face. 
 
 Daniel Masters, director of Global Advisors Bitcoin Investment Fund, an investment fund listed on the International Stock Exchange on the Channel Islands, said a few days ago that bitcoin is “fully valued for the moment,” which could result in a pullback to $1,100. 
 
 In March, the U.S. Securities Exchange Commission (SEC) rejected a bitcoin exchange-traded fund (ETF) sought by Tyler and Cameron Winklevoss. The proposal is currently under review, however, and if approved, will give new credibility to bitcoin, especially among investors. 
 
 Bitcoin’s scaling challenge remains unresolved. A backlog of bitcoin transactions has slowed transaction time. 
 
 Some cryptocurrency exchanges, such as Bitfinex, have stopped allowing access to the banking system, preventing customers from withdrawing fiat currency. 
 
 Also read: Global malware campaign WannaCry is affecting bitcoin’s price 
 
 Positive Developments Continue 
 
 At the same time, there are some positive signs on the scaling challenge. 
 
 The market has opted not to support the Bitcoin Unlimited solution, which would have required a hard fork that would have split bitcoin into two currencies. 
 
 In addition, Litecoin has deployed Segregated Witness (SegWit), which enables faster cryptocurrency transactions. The successful SegWit deployment raises hopes that the tool can also help bitcoin solve its scaling challenge. 
 
 Masters of Global Advisors Bitcoin Investment Fund noted the longer-term outlook for bitcoin remains positive. In the next eight to 14 months, Masters expects bitcoin’s price to be around $4,000. 
 
 A jump in global trading volume, particularly from Japan, which recently legalized bitcoin, has contributed to bitcoin’s demand. 
 
 The interest from institutional buyers is another promising factor. Brian Kelly, the founder of Brian Kelly Capital, noted the biggest driver in bitcoin’s growth is institutional investors in the digital asset sector. He referred to the incoming capital as “real money” that will be used to fund the new Internet. 
 
 Capital flows into bitcoin are also increasing worldwide. 
 
 If massive malware attacks can affect bitcoin’s price, they join a myriad of factors. What remains to be seen is which factors will matter the most and for how long. 
 
 Featured image from Shutterstock. ||||| What computers are affected by the cyber 
 
 attack? 
 
 The virus or malware that has affected at least 150 countries this weekend primarily targets PCs and laptops that still use Windows XP. This software, which Microsoft released in 2001, was one of the most common operating systems of the 2000s. The company stopped supporting it – meaning that it issued no more updates, to fix problems – in 2014. That has left Windows XP particularly exposed to new methods of hacking. More recent Microsoft systems, including Windows 10, 8 and 7, can also be infected by the ransomware virus. In March the company released a patch, or security upgrade, to protect computers against the ransomware involved in this weekend’s attack. 
 
 What is ransomware? 
 
 Ransomware is a virus that locks your computer or web browser, then displays a demand for payment, usually in the online currency Bitcoin, in return for unlocking your files. The virus can target home computers or servers that businesses and state agencies use. WannaCry, the virus involved in the current attack, is thought to be based on software developed by the US National Security Agency. The attack that targeted the NHS, in the UK, asked for $300 worth of Bitcoin to unlock each computer. Microsoft says payment does not guarantee unlocking. WannaCry is spread mainly via email. Europol, the EU law-enforcement agency, has advised people to be wary of clicking on links in or downloading attachments from any emails from senders they do not recognise. The spread of the current attack was stopped by an anonymous UK cybersecurity researcher, who discovered that by registering an unusual domain name that had been written into the ransomware he could get the virus to shut itself down. The creators of the virus might have included the web address as a kill switch, in case they wanted to stop it spreading any further; the name might also have been included as protection against the ransomware being analysed by cybersecurity experts. 
 
 How can I protect my computer from the ransomware virus? 
 
 If you still use Windows XP you should upgrade to a more recent operating system, as this will help to secure your computer. Microsoft’s current operating system is Windows 10. Two slightly older versions, Windows 8.1 and Windows 7, are also still available. 
 
 My computer doesn’t run Windows XP. Am I safe? 
 
 Even if you use a more recent Windows system you should ensure you have downloaded the latest updates and security software, to protect against viruses or malware. The security patch that Microsoft released in March, named MS17-010, can be found online. Windows 10, 8.1 and 8 all include Microsoft’s Windows Defender antivirus software. This guards against many types of malware and ransomware. If you’re using Windows 7 you can download Microsoft’s free Windows Security Essentials software. This will also help protect against viruses. 
 
 Any other advice? 
 
 Microsoft advises users to avoid clicking on links in or downloading attachments from emails from senders you do not recognise. It also says to block pop-ups adverts, which will stop most potentially dangerous pop-up windows with harmful links appearing on your screen. 
 
 What should I do if my computer has been infected? 
 
 As there are different types of ransomware, there is no single, easy solution to restore your computer if it has been infected. If the ransomware has just blocked access to your web browser, it may be possible to regain control by accessing your computer’s task manager and shutting down the program. If the ransomware has locked your entire PC, as WannaCry has done, combating it is more difficult. You may have to download safety software on to an uninfected computer, then try to transfer it to the affected computer via a CD-Rom or USB stick. You can find detailed instructions at microsoft.com ||||| There are few things Apple users love more than being Apple users. The tight security features and largely virus-free ecosystem have long given the Mac enthusiast a feeling of superiority over virus-ridden PC brethren. One problem: It's no longer true and hasn't been true for some time. 
 
 Apple's reputation for security was earned long ago. A group of hackers proved how dated that notion is earlier this week when they took control of the Transmission BitTorrent app and used it to distribute malicious software to Mac users that encrypts files on a victim’s machine and demands a $400 ransom payment to release the affected files. 
 
 It is not clear which versions of OS X, Mac's operating system, are affected. But it is clear that much of the Mac's reputation for safety was simply a function of not being attacked. For most pro hackers, the smaller Mac ecosystem simply wasn't worth the time. But that's changing. Indeed, the 6,500 people who downloaded the software unwittingly showed that cybercriminals’ investment in cracking Apple software is starting to pay off. 
 
 “Windows was really insecure for a long time, and Mac didn’t have a lot of market share so they weren’t as much of a target,” said Patrick Wardle, a former U.S. National Security Agency staffer who's now director of research at the security firm Synack. “If I’m going to hack an organization's devices now, it’s going to be Apple. They’re a security soft target.” 
 
 Apple's security weaknesses begin with the software designed to protect it. 
 
 Apple's Gatekeeper, first introduced in 2012 as part of OS X Mountain Lion, has become the primary security measure on OS X computers. It's meant to ensure that users only download apps and other software that have already been approved by Apple, either via the App Store or from identified developers who include a preapproved developer certificate (which verifies a developer's identity) in their product. It's a measure that's meant to prevent users from downloading outside programs that would enable hackers to steal their passwords and financial information, secretly capture audio or video or worse. 
 
 But Gatekeeper also includes a number of vulnerabilities that researchers have proved can be exploited for nefarious means. Last year Wardle exposed a mechanism in Gatekeeper that would allow hackers to bypass the protection by infecting software that has already been approved by Apple. Essentially, once an app was approved by Gatekeeper, it was always trusted, even if it started distributing malware later on. 
 
 Apple responded to Wardle's revelations in January by issuing a security update that only blocked the files Wardle provided to the company. The update didn't address the deeper problem: trusted files can still be used to distribute a variety of shady software. That's largely what appears to have happened in the ransomware attack, where attackers faked Transmission's already-approved developer certificate to distribute their own ransomware code. 
 
 “I wasn't really surprised, we were expecting this,” Wardle said, adding that Apple computers running El Capitan, the newest version of the Mac OS, without antivirus software rank at a five on a security scale of one to 10. Windows 10 is closer to a seven. “From a technical point of view there was no reason we hadn't seen this before. It was just neat that it was signed, which is an easy way around Mac Gatekeeper.” 
 
 Apple quickly revoked the digital certificate upon learning Transmission files were infected. 
 
 Photo: Reuters 
 
 Apple’s OS X held 7 percent of the worldwide operating system market as of November 2015, according to figures released by Net Applications. But just because an OS is less used doesn’t mean it’s safe. And now, with Apple computer sales expected to grow after a slight sales dip in the first fiscal quarter of 2016, it’s clear the attacks are going to continue, according to Grayson Milbourne, security intelligence director at the security company Webroot. 
 
 “We’ve seen attacks on Apple growing over the past few years, particularly in adware and apps that change your browser’s settings, but it’s all been much less severe than something like ransomware,” Milbourne said. “It’s really just following what people are doing online and how they’re accessing the Internet.” 
 
 Two years ago, the monthly average of infected Mac computers varied between 10,000 and 70,000 machines, according to the security firm Symantec. Research published last year by the cybersecurity company Bit 9 declared that, in 2015 alone, “The number of OS X malware samples has been five times greater than in 2010, 2011, 2012, 2013 and 2014 combined.” That number is expected to rise drastically in 2016, according to Symantec and other security vendors. 
 
 Apple has yet to employ a number of the security strategies Microsoft has had no choice but to explore as the proprietor of 91.39 percent of the operating systems in use in the world. With the launch of Windows 10 last summer, the company offered a $100,000 bug bounty to anyone who found a security vulnerability and reported it through the proper channels. 
 
 Microsoft also has a history of reaching out to hackers who previously made life difficult for the corporation. In 2006, Microsoft hired members of the Polish hacking group Last Stage of Delirium, which had exploited a hole in the Windows Remote Procedure Call interface and laid the groundwork for the Blaster worm— a program that used Microsoft sites to launch cyberattacks. 
 
 Such tactics could have detected issues in Gatekeeper and the certificate verification process before the security measures were released publicly. 
 
 “If you want to get better at what you do, especially when it comes to security, you need to make sure you plug as many holes as possible,” said Liviu Arsene, senior threat analyst at Bitdefender, a Romanian cybersecurity company that unveiled research on the ransomware affecting Mac computers. “The cost of actually having a breach is much higher than the cost to your company under a bug bounty.” 
 
 Neither of those efforts would have prevented the ransomware from hitting Windows users. Windows computers, widely used by individuals as well as employers, remain a tempting target for ransomware attackers who stand to make millions by separating users from their data. 
 
 Along with Gatekeeper, Apple computers also employ the technique known as Sandboxing, which limits the amount of information apps can access on a user's computer. Users are warned that a file downloaded from an unknown third party could contain malware. Apple's Safari browser also employs a robust anti-phishing algorithm that warns users before they visit websites containing potentially harmful materials. 
 
 "A lot of Apple's security mitigations rest on Gatekeeper," said Patrick Wardle. "They're just not as proactive as Microsoft, with the bug bounty and consulting with external hackers ... but they're making a ton of money, so why would they spend a ton of money on security when they don't really have to?" 
 
 Apple declined to comment for this story. 
 
 Apple fans can at least relax in knowing the iPhone is, generally, safer than Android mobile devices. Along with passcode encryption and end-to-end encrypted iMessages, iPhones include security features that would need to be disabled in order to download a potentially malicious app. Meanwhile, ransomware attackers have disguised their malware as pornography apps and video players that have bilked countless downloaders out of hundreds of dollars apiece. 
 
 “So far there hasn’t been any ransomware for iPhones because you’d have to sideload an app onto the iPhone,” said Liviu Arsene. “Few people really jailbreak their phones.” ||||| I woke up to a flood of news about ransomware today. By virtue of being down here in Australia, a lot happens in business hours around the world while we're sleeping but conversely, that's given me some time to collate information whilst everyone else is taking a break. The WannaCry incident is both new and scary in some ways and more of the same old stuff in others. Here's what I know and what the masses out there need to understand about this and indeed about ransomware in general. 
 
 The ransomware problem 
 
 Firstly, if ransomware is a foreign enough concept and you genuinely want to understand what it's about, I made a free course for Varonis last year titled "Introduction to Ransomware". One of the observations I make in that course is that this class of malware has been around for decades starting with the AIDS trojan dating back to 1999: 
 
 This variant attempted to make the PC unusable unless a ransom was paid. But because it was pre-modern internet, it was distributed via floppy disk to the (comparatively) small number of people who had PCs and requested that they send (via snail mail) a cashier's cheque or money order. Fast forward to the modern era and we have billions of people using the world's largest malware distribution network (we also call this "the internet") and Bitcoin as the currency of choice for ransoms. So whilst ransomware has been around for ages, it's only seriously gained traction in more recent times, especially since early last year: 
 
 Most of the modern ransomware variants encrypt personal files on an infected machine. The first people usually know of an infection is that files aren't readable or they're faced with a ransom notice. For example, this one that my mother in law got hit with last year (and yes, they're her handwritten notes): 
 
 The same operating system that's sitting on your desktop at home so that you can write email and watch cat videos is running our hospitals, our rail systems and all sorts of other critical infrastructure. Because of the extent to which the same operating systems and software is used across personal, private and public sectors, ransomware is indiscriminate. Schools get hit. Churches get hit. Even the police get hit. Each one of those wound up paying the ransom too (yes, even the cops), because the alarming reality of ransomware is that it often makes good financial sense to pay. No, this doesn't send a good message and yes, it makes the whole thing worse for the masses because it incentivises criminals. In a case like that church where it's $570 and you get your data back versus not paying and losing everything, you can see why victims pay. 
 
 This isn't always the case - criminals don't always unlock your data after payment and it's not always impossible to get your data back without paying - but the business model of ransomware doesn't have to be perfect to still be highly lucrative. Still, modern day encryption is effective enough and the distribution of malicious content is easy enough that this remains a very big problem. 
 
 The situation with WannaCry / Wcry / WannaCrypt 
 
 Let's cover the fundamentals here, starting with the ransom demand shown on infected machines (image credit to Talos who've written a very good early piece on this): 
 
 The ransom is $300 and you've got 3 days to pay before it doubles to $600. If you don't pay within a week then the ransomware threatens to delete the files altogether. Note the social engineering aspect here too: a sense of urgency is created to prompt people into action. A sense of hope is granted by virtue of the ability to decrypt a sample selection of the files. (Note the "Wana Decrypt0r" title on the window above: the three terms WannaCry, Wcry and WannaCrypt are all referring to the same piece of malware, they're merely various representations of the same name.) 
 
 The malware spread via SMB, that is the Server Message Block protocol typically used by Windows machines to communicate with file systems over a network. An infected machine would then propagate the infection to other at-risk boxes: 
 
 Yes, you can still use your machine its just that everything is being encrypted and its pivoting to attack more machines. https://t.co/h9sJTMl2rW — Hacker Fantastic (@hackerfantastic) May 12, 2017 
 
 It's able to do this where the machine supporting the protocol has not received the critical MS-17-010 security patch from Microsoft which was issued on the 14th of March and addresses vulnerabilities in SMBv1 (Microsoft doesn't mention SMBv2 but Kaspersky has stated that WannaCry targets v2 as has Symantec). In other words, you had to be almost 2 months behind in your patch cycle in order to get hit with this. Windows 10 machines were not subject to the vulnerability this patch addressed and are therefore not at risk of the malware propagating via this vector. Likewise, I've seen no commentary suggesting that other SMB implementations such as Samba are impacted. 
 
 According to Talos, the ransomware is encrypting basically everything it can get its hands on in terms of connected or networked devices: 
 
 The file tasksche.exe checks for disk drives, including network shares and removable storage devices mapped to a letter, such as 'C:/', 'D:/' etc. The malware then checks for files with a file extension as listed in the appendix and encrypts these using 2048-bit RSA encryption. 
 
 From everything I've read, the spread of WannaCry has been via SMB so when we're talking about machines behind firewalls being impacted, it implies ports 139 and 445 being open and at-risk hosts listening to inbound connections. It'd only take one machine behind the firewall to become infected to then put others at risk due to it being self-propagating. Because of the nature of the web and the broad range of unpatched machines, infection rates rapidly spread to tens of thousands of machines across the world: 
 
 Check out this NYT post, they made a really cool time based map with my data https://t.co/K7lVjagq29 — MalwareTech (@MalwareTechBlog) May 13, 2017 
 
 Talos first detected this variant of malware shortly before 9am UTC on the 12th of May. They also noted that there were requests to iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com beginning at 07:24 which is the first external indicator of compromise (I'll come back to that address when I talk about the killswitch). The headline stories which I awoke to in Australia very much focused on the UK's NHS (their National Health Service) and they were in pretty bad shape: 
 
 Here's what a London GP sees when trying to connect to the NHS network pic.twitter.com/lV8zXarAXS — Rory Cellan-Jones (@ruskin147) May 12, 2017 
 
 I suspect the NHS got the lion's share of early press due to a combination of the time of day (first thing in the morning for the UK) and inevitably, having a large number of unpatched machines and an open ingress point for WannaCry to take hold. But we've subsequently seen reports of all other sorts of organisations around the world being impacted which isn't at all surprising; ransomware doesn't tend to discriminate: 
 
 The ransomware virus has spread to Deutsche Bahn computers, appears on train station screens pic.twitter.com/uUF97Huqrd (via @Nick_Lange_ ) — Gregor Peter (@L0gg0l) May 12, 2017 
 
 The killswitch 
 
 That domain I just mentioned - iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com - is a "randomly" human-typed address which as Talos observed, primarily consists of keys in the top row of the keyboard. In other words, someone mashed the keyboard to generate it. This was found in the WannaCry code: 
 
 .@malwareunicorn This is the reason infections are dropping off - it contained a kill switch, that was activated before US woke up. NEW propagation = dead. pic.twitter.com/l4VKZ45kq7 — Kevin Beaumont (@GossiTheDog) May 12, 2017 
 
 If the malware could communicate with the host name, it would exit but because that name wasn't registered, it continued to execute. Well, that is until a researcher worked out what was going on and simply registered the domain name! 
 
 Infections for WannaCry/WanaDecrpt0r are down due to @MalwareTechBlog registering initial C2 domain leading to kill-switch #AccidentalHero — Warren Mercer (@SecurityBeard) May 12, 2017 
 
 I'm yet to see a good analysis on why the kill switch existed in the first place and why discovery and circumvention was so simple. It seems entirely counter-intuitive to the goal of infecting as many machines as possible as quickly as possible and I hope we see some good analysis of that soon. The important thing here though is that based on the analysis we're seeing, this variant shouldn't be spreading any further however... there'll almost certainly be copycats. In fact, that's enormously important and it also speaks to the futility of virus definition signatures; watch this thing come back with a vengeance after a few modifications. If it was me, I'd be taking any at-risk machine off the wire until it's patched. 
 
 Payments 
 
 There are references to 3 different Bitcoin addresses for which we can observe the transactions. At the time of writing, they are: 
 
 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 - 23 transactions totalling $7,188 
 
 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw - 17 transactions totalling $7,767 
 
 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn - 12 transactions totalling $2,905 
 
 Now on the one hand, nearly $18k is a nice little earn yet on the other, for tens of thousands of infections to have totalled only 52 payments seems very small. That could well go up though; regardless of the kill switch, many machines remain infected and if there's a 3-day window of payment before the cost escalates, you'd expect plenty of people to be holding off for a bit. It'll be interesting to look at those Bitcoin addresses in another 48 hours. 
 
 Edit, 17 May: There's a Twitter bot tweeting payment amounts. The latest sum total of what WannaCry has collected is over US$76k: 
 
 The three bitcoin wallets tied to #WannaCry ransomware have received 265 payments totaling 42.9251299 BTC ($76,233.26 USD). — actual ransom (@actual_ransom) May 17, 2017 
 
 It's because you didn't upgrade or patch your things 
 
 You know how people say you should keep your software up to date, right? Hello? The eternal problem is that for individuals, there's the often the attitude of "well it works fine, why should I change it?" and this is enormously dangerous. Newer versions of operating systems, for example, typically get a raft of additional defences. Windows 10 (you know, the version not vulnerable to WannaCry...) got features such as ELAM to protect against malware during the boot cycle. When we look at the problem today hitting machines as old as Windows XP, we're talking about a 16-year-old operating system that was superseded a decade ago and went off support 3 years ago. (Although note that Microsoft has released an out of band patch to protect XP users against WannaCrypt.) And for the less tech-minded, when we say "patch your things", in this case it's nothing more than allowing Windows Update to do precisely what it's configured to do straight out of the box - just don't disable it! 
 
 And then there's "The Enterprise". Organisations are notoriously bad at keeping software modern, especially those in the public sector. Now in their defence, it's a non-trivial exercise when you're talking about a large number of machines. When I was working at Pfizer, I went through multiple OS and browser upgrades and one of the most painful parts of the exercise was compatibility with existing software. The last one I recall was simply an Internet Explorer upgrade and the cost of rectifying non-functional web apps within the organisation was a 7-figure amount. (Frankly, I believed that demonstrated more fundamental problems with the software development process, but I digress.) Organisations need to be proactive in monitoring for, testing and rolling out these patches. It's not fun, it costs money and it can still break other dependencies, but the alternative is quite possibly ending up like the NHS or even worse. Bottom line is that it's an essential part of running a desktop environment in a modern business. 
 
 But all of this is known from the outset: consumers and enterprises alike know that software will evolve and that there may be a cost. Keep in mind that Windows 10 was available for free (I betcha there's a bunch of infected folks wishing they'd taken that offer up a couple of years ago), but even once you consider the costs within the enterprise for upgrading (testing and compatibility remediation, training, etc), this was never a surprise. Organisations often just simply don't budget for this stuff and when the CIO eventually comes cap in hand asking for cash, the money isn't there - "but everything is working ok at the moment, right?" 
 
 As an interim step for orgs struggling to patch, there's always just disabling SMB altogether: 
 
 Particularly for organisations with professionally managed desktop environments, there is no "oh, we didn't realise" or other cop out excuses here, someone screwed up big time. 
 
 Oh - and it's worse because you don't have (proper) backups 
 
 One of the most fundamental defences against ransomware is the ability to reliably restore from backup. If all your things get crypto'd and you can just say "oh well, it's not fun and I need to rebuild my machine but at least I've only lost time" then you're in a fundamentally better position than having lost your files (short of paying the ransom, that is). 
 
 Many (probably most) individuals and organisations alike don't have a satisfactory backup strategy. Typically, problems include: 
 
 They're not taking backups at all 
 
 They're backing up over existing backups and writing corrupted files over good ones 
 
 They're not backing up frequently enough (it must be fully automated) 
 
 They're only backing up to connected devices accessible by malicious software 
 
 Ideally, you want a 3-2-1 backup strategy which means at least 3 total copies of your data, 2 of which are local but on different mediums (such as external storage devices) and 1 which is offsite. There are professional cloud backup services available which will keep versioned copies of all your things and allow you to rollback to any point in time (no, Dropbox alone won't do that). There are cheap external devices with large capacities you can physically rotate and store with a trusted relative. It's another topic altogether, but just consider your ability to recover from these scenarios: 
 
 All your files become corrupted (or encrypted) and replicated to your backup devices 
 
 Everything that can communicate with your machine gets hosed 
 
 A thief steals all your devices or your house burns down 
 
 Resilience against all of these isn't hard, but it takes planning. Also, "backup" is important but what's really important is "restore" so do test that as well. Oh - and you can't do this after stuff goes wrong either, it's one of those "in advance" sort of things. 
 
 Is this the NSA's fault? 
 
 This is where it gets a bit political: the SMB vulnerability Microsoft patched was known by the NSA. We know this because the Shadow Brokers leak last month referred to it specifically as "ETERNALBLUE", an SMBv2 exploit. A month ago, we knew this could be bad news: 
 
 I'm not people understand the scope of SMB exploits. Every version of Windows has SMB enabled by default. Remote unauth code execution = bad — Kevin Beaumont (@GossiTheDog) April 14, 2017 
 
 And sure enough, the vulnerability was quickly exploited which is not at all surprising given the way in which it had now been publicly disclosed. But remember, that's one month after the vulnerability had already been patched, so what's the worry? 
 
 For folks at home, this isn't a big deal. Install the Windows Updates when Windows Update says "install me!". But you should do that anyway. — Pwn All The Things (@pwnallthethings) April 14, 2017 
 
 Well obviously, and as you well know if you've read this far, people (and companies) don't always patch their things. But the political bit was already making headlines in April and it effectively boiled down to arguing that the NSA should be in touch with companies like Microsoft as soon as they discover these risks so they can be patched. On the other hand, the surveillance argument is that these vulnerabilities are enormously useful for intelligence agencies to do precisely what we want them to do which is to gather intelligence on targets (let's just assume for a moment that they do this responsibly...) Yet still, you can't ignore the irony of how not just the underlying vulnerability but also the NSA exploit code has impacted the world, including governments themselves: 
 
 The government when they realize their systems are currently being pwned by exploits they helped write pic.twitter.com/qLzqKLDyl1 — MalwareTech (@MalwareTechBlog) May 12, 2017 
 
 Thing is though, even with a whole 2 months of lead time we still have this problem of large scale compromise so simply asserting that earlier disclosure and patching would solve the problem isn't quite accurate. It's a politically charged debate and frankly, the only thing we can uniformly agree on here is that we've gotta get better at patching our things. 
 
 Where to now? 
 
 Well, we're pretty much in clean-up mode. AV vendors are releasing signatures to identify the malware and we're all assessing what the total damage will be whilst waiting for new variants to follow. But the bigger lessons out of all of this are the ones that reinforce what the security community has been telling people for so long, namely the following: 
 
 Keep your operating systems current 
 
 Take patches early 
 
 Have a robust backup strategy 
 
 Lock down machines 
 
 Don't open suspicious email or attachments 
 
 Restrict access to network resources (ransomware can only encrypt what it can access or what machines it can propagate to can access) 
 
 Block unnecessary ports (Talos suggests that organisations may have had SMB externally accessible) 
 
 Traditional anti-virus is bad at identifying this stuff 
 
 All of this is so much more important than WannaCry / Wcry / WannaCrypt and until we get that right, other subsequent variants will hit those who are unprepared. By pure coincidence, only a few days ago I wrote about how I saw my dentist dealing with ransomware and it's a pretty safe bet they screwed up pretty much every bullet point I just mentioned. They're the real lessons here - not just installing MS-17-010 and being done with it - so until we get those right, this is just one of many more incidents to come. 
 
 Edit: Related to this, I've just blogged about Don't tell people to turn off Windows Update, just don't because, well, that title gives you a pretty good idea and this is after learning that it's only unpatched machines that got hit by WannaCry!
– As experts scramble to make heads or tails over WannaCry, a global cyberattack unleashed Friday that’s affected up to 200,000 computers in 150 countries, some fear the worst is yet to come. According to the Wall Street Journal, the spread of attacks has slowed down after a kill switch was activated by a stroke of luck, but even more computers may find the ransomware waiting for them when they log back into their systems after the weekend break. Here’s the latest on WannaCry: A primer: CNN’s breakdown and timeline of the WannaCry attack, which some are calling the largest cyberattack ever executed, will catch you up to speed on what happened. The attack exploits a vulnerability in Microsoft Windows. About ransomware: The anonymous attack comes in the form of ransomware, a type of malware that locks a computer’s files, making it impossible to access them. On the locked screen, users are instructed to pay up a sum within a time frame—in this case $300 to a Bitcoin account within three days. Tech blogger and expert Troy Hunt explains more in detail. Windows users: If you're using Windows XP, upgrade quickly, advises a Q&A in the Irish Times. If you're already infected, the fix isn't easy, but Microsoft has the particulars. Are Macs safer? In this case, yes. WannaCry affects Windows systems, but not Macs. Apple computers tend to field less attacks, but according to the International Business Times, it’s not because Mac security is impenetrable. Since PCs are more widespread, more viruses are written for them. Shoring up your digital security: The New York Times outlines eight general steps that can help your digital thumbprint from mobile to desktop, like using apps such as Signal or WhatsApp when texting. NSA's role: Some of the key code utilized may have been created by the NSA, reports the BBC. It raises the question of whether government agencies should disclose the vulnerabilities they've discovered. Edward Snowden concurs: "In light of today's attack, Congress needs to be asking @NSAgov if it knows of any other vulnerabilities in software used in our hospitals," he wrote on Twitter. Bitcoin in spotlight: Bitcoin, the anonymous digital currency, saw a drop in value on Friday from $1,800 to $1,600, according to CryptoCoin News, before it stabilized to $1,700 Saturday. Some experts think hackers might be trying to manipulate the currency to boost profits. The site looks at how the attack could affect the currency, for better or worse. Microsoft has offered to provide extended support to all users, even those with the most ancient operating systems.