CLOSE A Microsoft executive has blasted the CIA and NSA for "stockpiling" vulnerabilities in software instead of reporting them to industry so that they can be fixed. Newslook 
 
 Google servers (AP Photo/Google, Connie Zhou) 
 
 SAN FRANCISCO — Microsoft president Brad Smith used Friday's global ransomware attack as a chance to call once more for the nations of the world to create and adhere to a set of Geneva Convention-like rules in cyberspace. 
 
 The massive “WannaCry” malware attack crippled more than 20% of hospitals in the United Kingdom and affected more than 200,000 victims in 150 countries, Rob Wainwright, the head of the European Union’s “Europol” law enforcement agency, said Sunday. 
 
 The software, which spreads among Windows computers, infects and then locks up individual machines, demanding a ransom to be paid in the electronic currency Bitcoin. The attack mostly impacted computers in Europe and Asia and for the most part spared North America. The criminals behind the attack have not yet been identified. 
 
 Smith and others have long advocated that the world’s governments need to pledge not to engage in cyberattacks that target civilian infrastructure. 
 
 The includes not stockpiling flaws in computer code that can be used to craft digital weapons. Just such a stockpiled flaw was behind the rapaciousness and rapidity with which the WannaCry ransomware spread. 
 
 Related stories 
 
 It’s believed a group connected to the National Security Agency, known as The Equation Group, found or purchased previously undiscovered flaws in Microsoft Windows code and used them to create cyber-snooping and infiltration tools. 
 
 Those tools were part of a large cache of older NSA data that was stolen sometime over the past few years. 
 
 In August 2016, a group calling itself The Shadow Brokers began posting materials from that stolen cache of programs online. 
 
 Multiple leaks were posted, including one on April 14 of this year that contained an exploit (flawed computer code that can be used to craft cyberweapons) called EternalBlue. 
 
 That exploit was in turn one of those used to create the WannaCry ransomware program which can rapidly spread itself from computer network to computer network. 
 
 CLOSE It’s being called the biggest ransomware outbreak in history and it could be far from over. Buzz60 
 
 Jonathan Sander, chief technology officer for STEALTHbits Technologies, called WannaCry “a Frankenstein's monster of vulnerabilities with patches and exploits that were stolen from the NSA and published for all to see.” 
 
 The theft and posting of the stolen data gave criminals a huge head start. Instead of having to develop their own arsenals of cyberweapons, they simply had to repurpose work done by the highly skilled cyber experts at the NSA, said Phillip Hallam-Baker, principal scientist at the cybersecurity firm Comodo. 
 
 Just as dangerous as lost nuclear weapons 
 
 The U.S. government clearly had its priorities wrong in not focusing on better protecting these cyberweapons, he said. 
 
 “Whether or not you think the U.S. government should be spending a fortune developing such cyberweapons, surely it is obvious that the weapons they develop should be properly secured. If someone had lost a nuclear weapon, heads would have rolled. The CIA and NSA have been breached on a massive scale, and now the effects are being felt,” Hallam-Baker said. 
 
 Many people in fact believe someone at NSA must have tipped Microsoft that the files had been stolen, which is how it knew it needed to push out that particular patch, said Ryan Kalember of Proofpoint, a Sunnyvale, Calif.-based security firm whose researchers were instrumental in fighting the the WannaCry attack. 
 
 A Microsoft spokesman reached Sunday said the company had no comment. 
 
 Smith wrote in a blog post Sunday that the attack is an excellent object lesson in why governments stockpiling such vulnerabilities is such a problem. 
 
 “This is an emerging pattern in 2017. We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world. Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage,” he said. 
 
 Nations need to see the attack as a wake-up call, said Smith. 
 
 “They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world. We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.” 
 
 Read or Share this story: https://usat.ly/2qh6H5t ||||| Early Friday morning the world experienced the year’s latest cyberattack. 
 
 Starting first in the United Kingdom and Spain, the malicious “WannaCrypt” software quickly spread globally, blocking customers from their data unless they paid a ransom using Bitcoin. The WannaCrypt exploits used in the attack were drawn from the exploits stolen from the National Security Agency, or NSA, in the United States. That theft was publicly reported earlier this year. A month prior, on March 14, Microsoft had released a security update to patch this vulnerability and protect our customers. While this protected newer Windows systems and computers that had enabled Windows Update to apply this latest update, many computers remained unpatched globally. As a result, hospitals, businesses, governments, and computers at homes were affected. 
 
 All of this provides the broadest example yet of so-called “ransomware,” which is only one type of cyberattack. Unfortunately, consumers and business leaders have become familiar with terms like “zero day” and “phishing” that are part of the broad array of tools used to attack individuals and infrastructure. We take every single cyberattack on a Windows system seriously, and we’ve been working around the clock since Friday to help all our customers who have been affected by this incident. This included a decision to take additional steps to assist users with older systems that are no longer supported. Clearly, responding to this attack and helping those affected needs to be our most immediate priority. 
 
 At the same time, it’s already apparent that there will be broader and important lessons from the “WannaCrypt” attack we’ll need to consider to avoid these types of attacks in the future. I see three areas where this event provides an opportunity for Microsoft and the industry to improve. 
 
 As a technology company, we at Microsoft have the first responsibility to address these issues. We increasingly are among the first responders to attacks on the internet. We have more than 3,500 security engineers at the company, and we’re working comprehensively to address cybersecurity threats. This includes new security functionality across our entire software platform, including constant updates to our Advanced Threat Protection service to detect and disrupt new cyberattacks. In this instance, this included the development and release of the patch in March, a prompt update on Friday to Windows Defender to detect the WannaCrypt attack, and work by our customer support personnel to help customers afflicted by the attack. 
 
 But as this attack demonstrates, there is no cause for celebration. We’ll assess this attack, ask what lessons we can learn, and apply these to strengthen our capabilities. Working through our Microsoft Threat Intelligence Center (MSTIC) and Digital Crimes Unit, we’ll also share what we learn with law enforcement agencies, governments, and other customers around the world. 
 
 Second, this attack demonstrates the degree to which cybersecurity has become a shared responsibility between tech companies and customers. The fact that so many computers remained vulnerable two months after the release of a patch illustrates this aspect. As cybercriminals become more sophisticated, there is simply no way for customers to protect themselves against threats unless they update their systems. Otherwise they’re literally fighting the problems of the present with tools from the past. This attack is a powerful reminder that information technology basics like keeping computers current and patched are a high responsibility for everyone, and it’s something every top executive should support. 
 
 At the same time, we have a clear understanding of the complexity and diversity of today’s IT infrastructure, and how updates can be a formidable practical challenge for many customers. Today, we use robust testing and analytics to enable rapid updates into IT infrastructure, and we are dedicated to developing further steps to help ensure security updates are applied immediately to all IT environments. 
 
 Finally, this attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem. This is an emerging pattern in 2017. We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world. Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen. And this most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today – nation-state action and organized criminal action. 
 
 The governments of the world should treat this attack as a wake-up call. They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world. We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits. This is one reason we called in February for a new “Digital Geneva Convention” to govern these issues, including a new requirement for governments to report vulnerabilities to vendors, rather than stockpile, sell, or exploit them. And it’s why we’ve pledged our support for defending every customer everywhere in the face of cyberattacks, regardless of their nationality. This weekend, whether it’s in London, New York, Moscow, Delhi, Sao Paulo, or Beijing, we’re putting this principle into action and working with customers around the world. 
 
 We should take from this recent attack a renewed determination for more urgent collective action. We need the tech sector, customers, and governments to work together to protect against cybersecurity attacks. More action is needed, and it’s needed now. In this sense, the WannaCrypt attack is a wake-up call for all of us. We recognize our responsibility to help answer this call, and Microsoft is committed to doing its part. ||||| Patients wait near a banner informing about the delay in service put up at the registration desks at Dharmais Cancer Hospital in Jakarta, Indonesia, Monday, May 15, 2017. Dozens of the hospital's computer... (Associated Press) 
 
 TOKYO (AP) — The worldwide "ransomware" cyberattack wreaked havoc in hospitals, schools and offices across the globe on Monday. Asia reported thousands of new cases but no large-scale breakdowns as workers started the week by booting up their computers. 
 
 The full extent of the damage from the cyberattack felt in 150 countries was unclear and could worsen if more malicious variations of the online extortion scheme appear. 
 
 The initial attack, known as "WannaCry," paralyzed computers running Britain's hospital network, Germany's national railway and scores of other companies and government agencies around the world. 
 
 As a loose global network of cybersecurity experts fought the ransomware, the attack was disrupting computers that run factories, banks, government agencies and transport systems in scores of countries, including Russia, Ukraine, Brazil, Spain, India and Japan, among others. Among those hit were Russia's Interior Ministry and companies including Spain's Telefonica and FedEx Corp. in the U.S. 
 
 Chinese state media said 29,372 institutions there had been infected along with hundreds of thousands of devices. 
 
 The Japan Computer Emergency Response Team Coordination Center, a nonprofit group providing support in computer attacks, said 2,000 computers at 600 locations in Japan were reported affected. Companies including Hitachi and Nissan Motor Co. reported problems but said they said had not seriously affected their business operations. 
 
 Auto manufacturer Renault said one of its plants, which employs 3,500 people in Douai, northern France, wasn't reopening Monday as technicians dealt with the cyberattack's aftermath. The temporary halt in production was a "preventative step," Renault said, giving no details on how badly the plant was affected by the malware. 
 
 In China, universities and other educational institutions were among the hardest hit, possibly because schools tend to have old computers and be slow to update operating systems and security, said Fang Xingdong, founder of ChinaLabs, an internet strategy think tank. 
 
 On social media students complained about not being able to access their work, and people in various cities said they hadn't been able to take their driving tests over the weekend because some local traffic police systems were down. 
 
 Railway stations, mail delivery, gas stations, hospitals, office buildings, shopping malls and government services also were affected, China's Xinhua News Agency said, citing the Threat Intelligence Center of Qihoo 360, a Chinese internet security services company. 
 
 Elsewhere in Asia, the Indonesian government urged businesses to update computer security after the malware locked patient files on computers in two hospitals in the capital, Jakarta. 
 
 Patients arriving at Dharmais Cancer Hospital had to wait several hours while staff worked with paper records. 
 
 Officials in Japan and South Korea said they believed security updates had helped ward off the worst of the impact. But the South Korean cinema chain CJ CGV Co. was restoring advertising servers at dozens of theaters after the attack left the company unable to display trailers of upcoming movies. 
 
 Experts urged organizations and companies to immediately update older Microsoft operating systems, such as Windows XP, with a patch released by Microsoft Corp. to limit vulnerability to a more powerful version of the malware — or to future versions that can't be stopped. 
 
 Paying ransom will not ensure any fix, said Eiichi Moriya, a cybersecurity expert and professor at Meiji University. 
 
 "You are dealing with a criminal," he said. "It's like after a robber enters your home. You can change the locks but what has happened cannot be undone. If someone kidnaps your child, you may pay your ransom but there is no guarantee your child will return." 
 
 New variants of the rapidly replicating worm were discovered Sunday. One did not include the so-called kill switch that allowed researchers to interrupt the malware's spread Friday by diverting it to a dead end on the internet. 
 
 Ryan Kalember, senior vice president at Proofpoint Inc. which helped stop its spread, said the version without a kill switch could spread. It was benign because it contained a flaw that prevented it from taking over computers and demanding ransom to unlock files but other more malicious ones will likely pop up. 
 
 "We haven't fully dodged this bullet at all until we're patched against the vulnerability itself," Kalember said. 
 
 The attack held users hostage by freezing their computers, popping up a red screen with the words, "Oops, your files have been encrypted!" and demanding money through online bitcoin payment — $300 at first, rising to $600 before it destroys files hours later. 
 
 Just one click on an infected attachment or bad link would lead to all computers in a network becoming infected, said Vikram Thakur, technical director of Symantec Security Response. 
 
 "That's what makes this more troubling than ransomware was a week ago," Thakur said. 
 
 The attack has hit more than 200,000 victims across the world since Friday and is seen as an "escalating threat," said Rob Wainwright, the head of Europol, Europe's policing agency. 
 
 "The numbers are still going up," Wainwright said. 
 
 Microsoft's top lawyer is laying some of the blame at the feet of the U.S. government. Brad Smith criticized U.S. intelligence agencies, including the CIA and National Security Agency, for "stockpiling" software code that can be used by hackers. Cybersecurity experts say the unknown hackers who launched this weekend's "ransomware" attacks used a vulnerability that was exposed in NSA documents leaked online. 
 
 It was too early to say who was behind the onslaught, which struck 100,000 organizations, and what their motivation was, aside from the obvious demand for money. So far, not many people have paid the ransom demanded by the malware, Europol spokesman Jan Op Gen Oorth told The Associated Press. 
 
 Researchers who helped prevent the spread of the malware and cybersecurity firms worked around the clock over the weekend to monitor the situation and install the software patch. 
 
 "Right now, just about every IT department has been working all weekend rolling this out," said Dan Wire, spokesman at Fireeye Security. 
 
 Microsoft distributed the patch two months ago, which could have forestalled much of the attack, but in many organizations it was likely lost among the blizzard of updates and patches that large corporations and governments strain to manage. 
 
 ___ 
 
 Watt reported from Beijing. AP researcher Yu Bing and news assistant Liu Zheng in Beijing, John Leicester in Paris, Youkyung Lee in Seoul and Kelvin Chan in Hong Kong contributed to this report. ||||| Media playback is unsupported on your device Media caption How to protect yourself online from a cyber-attack 
 
 A computer malware that has spread across 150 countries appears to be slowing down, with few reports of fresh attacks globally on Monday. 
 
 A spokesperson for police agency Europol said the situation in Europe "seems stable". 
 
 In Asia, where many offices closed before the WannaCry ransomware struck on Friday, the attack has been less severe than expected. 
 
 The ransomware takes over users' files, demanding $300 (£230) to restore them. 
 
 The White House said on Monday that under $70,000 (£54,000) had been paid in total in a bid to get any locked data released. 
 
 Payments could go up as the ransomware warned the cost would double after three days, and threatened to delete files within seven days if no payment was made. 
 
 Computer giant Microsoft said the attack, which has affected hundreds of thousands of computers, should serve as a wake-up call. 
 
 Among the organisations targeted worldwide have been Germany's rail network Deutsche Bahn, Spanish telecommunications operator Telefonica, US logistics giant FedEx and Russia's interior ministry. 
 
 What was the situation on Monday? 
 
 Many firms employed experts over the weekend to try to prevent new infections. 
 
 Senior spokesman for Europol, Jan Op Gen Oorth, told the AFP news agency: "The number of victims appears not to have gone up and so far the situation seems stable in Europe, which is a success. 
 
 "It seems that a lot of internet security guys over the weekend did their homework and ran the security software updates." 
 
 UK Health Minister Jeremy Hunt confirmed to the BBC that UK intelligence services had found no evidence of a second wave of attacks on Monday. 
 
 The badly affected National Health Service said seven out of 47 trusts that were hit were still facing serious issues. 
 
 French carmaker Renault said its plant in the northern town of Douai would not reopen on Monday as it dealt with the cyber-attack. 
 
 In Asia, the spread was reportedly slowing, with banking systems largely unaffected: 
 
 Australia : At least eight businesses reported being locked out of their systems 
 
 : At least eight businesses reported being locked out of their systems South Korea : Four companies reported problems over the weekend. One cinema chain was unable to display trailers 
 
 : Four companies reported problems over the weekend. One cinema chain was unable to display trailers Indonesia : Records at two hospitals were blocked 
 
 : Records at two hospitals were blocked Japan : Both Nissan and Hitachi reported some units had been affected, but not seriously 
 
 : Both Nissan and Hitachi reported some units had been affected, but not seriously China: Computers at nearly 30,000 institutions and organisations were affected, including government agencies and hospitals, internet firm Qihoo 360 said. Some payment systems and government services affected, but less than feared 
 
 US President Donald Trump's Homeland Security adviser Tom Bossert has also confirmed that no US federal government systems were affected. 
 
 Who is behind the attack? 
 
 This won't take long. Nobody knows. Europol's Jan Op Gen Oorth said: "A bit early to say... but we are working on a decrypting tool". 
 
 Associated Press quoted Tim Wellsmore, of US security firm FireEye, as saying: "We expect this is a small operation... They just happened to hit the mother lode." 
 
 Russian President Vladimir Putin said: "Russia has absolutely nothing to do with it." 
 
 EU Commissioner for Security Julian King told the BBC on Monday that the EU was proposing legislation to reinforce cyber security in the wake of the attack. 
 
 Some private sector security researchers say they have seen some similarities between some of the code in the recent attack and some linked to North Korea in the past. 
 
 Security officials in the UK, however, say they have not seen anything they would regard as hard evidence, Gordon Corera, the BBC's security correspondent, reports. 
 
 Should people pay? 
 
 Companies in Asia and Europe have been warning employees to be careful when clicking on attachments and links in their emails. 
 
 The message from the UK's National Crime Agency was "do not pay!" - there is no guarantee that systems will be restored. 
 
 Michael Gazeley, of Network Box, a Hong Kong-based cyber-security firm, told Reuters there were still "many 'landmines' waiting in people's inboxes", adding that his firm had detected a new version that infected users directly via a malicious link on hacked websites. 
 
 Media playback is unsupported on your device Media caption Technology explained: what is ransomware? 
 
 Becky Pinkard, from Digital Shadows, a UK-based cyber-security firm, also said it would be easy for the initial attackers or "copy-cat authors" to change the virus code so it is difficult to guard against. 
 
 A UK security researcher known as "MalwareTech", who helped to limit the ransomware attack, had predicted "another one coming... quite likely on Monday". 
 
 MalwareTech, whose name was revealed in UK media to be 22-year-old Marcus Hutchins, was hailed as an "accidental hero" after registering a domain name to track the spread of the virus, which actually ended up halting it. 
 
 What's behind Microsoft's 'wake-up call' warning? 
 
 The computing giant says the tool used in this current attack had been developed by the US National Security Agency and was stolen by hackers. 
 
 It is highly critical of the way governments store data on software vulnerabilities. 
 
 Image copyright AFP Image caption A railway station system in Chemnitz, eastern Germany, is infected 
 
 Microsoft president and chief legal officer Brad Smith said on Sunday: "We have seen vulnerabilities stored by the CIA show up on Wikileaks, and now this vulnerability stolen from the NSA has affected customers around the world. 
 
 "An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen." 
 
 The organisation also said that many organisations had failed to keep their systems up to date, allowing the virus to spread. 
 
 Microsoft said it had released a Windows security update in March to tackle the problem involved in the latest attack, but many users were yet to run it. 
 
 How roots can be traced to the US 
 
 Get news from the BBC in your inbox, each weekday morning
– The massive ransomware attack still reverberating around the world is the kind of thing that is going to keep happening unless rules like those governing conventional warfare are brought in for cyberspace, Microsoft says. Microsoft president Brad Smith warned in a blog post Sunday that the "stockpiling of vulnerabilities by governments" has once again caused enormous damage, USA Today reports. Smith says the "WannaCrypt" attack, also known as "WannaCry," was created with data stolen from the NSA, which had used a vulnerability it found to create cyberweapons. The equivalent scenario with conventional weapons would be the "US military having some of its Tomahawk missiles stolen," Smith said. "The governments of the world should treat this attack as a wake-up call," Smith wrote, repeating the company's call for a digital Geneva Convention. Microsoft issued a patch after the theft was discovered in March, but it was not issued to people and organizations using older versions of its system. More than 200,000 computers in 150 countries have been affected and the AP reports that there were thousands more cases early Monday as people got back to work after the weekend and booted up infected computers. The ransomware is demanding $300 to unlock user's files. The BBC says its analysis of accounts linked to the attack found that around $38,000 had been paid by early Monday.