Global cyber chaos was spreading Monday as companies booted up computers at work following the weekend’s worldwide ransomware cyberattack.
The extortion scheme created chaos in 150 countries and could wreak even greater havoc as more malicious variations appear. The initial attack, known as "WannaCry," paralyzed computers running Britain’s hospital network, Germany’s national railway, and scores of other companies and government agencies around the world.
A hospital in Oshawa, Ont., was also affected but suffered no significant damage, according to a spokesperson.
‘This is a global attack.& rsquo; — Matthew Tait, cybersecurity expert
As a loose global network of cybersecurity experts fought the ransomware hackers, Chinese state media said 29,372 institutions there had been infected along with hundreds of thousands of devices.
The Japan Computer Emergency Response Team Coordination Center, a nonprofit providing support for computer attacks, said 2,000 computers at 600 locations in Japan were reported affected so far.
Government agencies said they were unaffected. Companies like Hitachi and Nissan Motor Co. reported problems they said had not seriously affected their business operations.
- Ransomware: What you need to know
- OPINION | Ransomware doesn't just target the big guys
- How a perfect storm allowed a global ransomware attack to happen
Matthew Tait, a cybersecurity expert and founder of U.K.-based Capital Alpha Security, told CBC News Network on Sunday that "a number of" organizations and individuals in Canada have been affected, but that many of them haven't been forthcoming with that information.
"This is a global attack," Tait said. "This has affected all countries and Canada is no exception there."
‘You click on it, and bingo.’ — Prof. Atty Mashatan
Canada’s Communications Security Establishment said the federal government is "well placed to defend against these global attacks. There is no indication that any information, personal or otherwise, was compromised" in Government of Canada systems.
A spokesperson for Public Safety Minister Ralph Goodale said the government doesn't comment on specific threats, but that the Canadian Cyber Incident Response Centre is focused on protecting vital systems outside the government, including hospitals.
Asian governments and businesses reported some disruptions Monday from the WannaCry ransomware worm.
The malware is most often spread via emails which trick the user into clicking on a link, according to Atty Mashatan, a professor at Ryerson University’s School of Information Technology Management in Toronto.
"It looks as if it’s from someone you know, in your contacts. You click on it, and bingo. The actual malware, the file, is downloaded."
Germany’s national railway was among the scores of companies and government agencies affected around the world by the attack, which began on Friday. (Fabrizio Bensch/Reuters)
Disrupting banks, transport
In China, universities and other educational institutions were among the hardest hit, about 15 per cent of the internet protocol addresses attacked, according to the official Xinhua News Agency.
That may be because schools tend to have old computers and be slow about updates of operating systems and security, said Fang Xingdong, founder of ChinaLabs, an internet strategy think tank.
Railway stations, mail delivery, gas stations, hospitals, office buildings, shopping malls and government services also were affected, Xinhua said, citing the Threat Intelligence Center of Qihoo 360, a Chinese internet security services company.
Elsewhere in Asia, officials in Japan and South Korea said they believed security updates had helped ward off the worst of the impact.
The most public damage in South Korea was to cinema chain CJ CGV Co. It was restoring its advertising servers at dozens of theaters after the attack left the company unable to display trailers of upcoming movies.
The attack was disrupting computers that run factories, banks, government agencies and transport systems in scores of countries, including Russia, Ukraine, Brazil, Spain, India and Japan, among others. Russia’s Interior Ministry and companies including Spain’s Telefonica, FedEx Corp. in the U.S. and French carmaker Renault all reported troubles.
Experts were urging organizations and companies to immediately update older Microsoft operating systems, such as Windows XP, with a patch released by Microsoft Corp. to limit vulnerability to a more powerful version of the malware — or to future versions that can't be stopped.
Paying the ransom will not ensure any fix, said Eiichi Moriya, a cyber security expert and professor at Meiji University.
"You are dealing with a criminal," he said. "It’s like after a robber enters your home. You can change the locks but what has happened cannot be undone. If someone kidnaps your child, you may pay your ransom but there is no guarantee your child will return."
The earliest signs of trouble came on Friday as computers throughout the U.K.’s National Health Service were hijacked. (Stefan Wermuth/Reuters)
Users held hostage
New variants of the rapidly replicating worm were discovered Sunday and one did not include the so-called kill switch that allowed researchers to interrupt its spread Friday by diverting it to a dead end on the internet.
Ryan Kalember, senior vice president at Proofpoint Inc. which helped stop its spread, said the version without a kill switch could spread. It was benign because it contained a flaw that prevented it from taking over computers and demanding ransom to unlock files but other more malicious ones will likely pop up.
‘Numbers are still going up.’ — Europol head Rob Wainwrigh
"We haven't fully dodged this bullet at all until we're patched against the vulnerability itself," Kalember said.
The attack held users hostage by freezing their computers, popping up a red screen with the words, "Oops, your files have been encrypted!" and demanding money through online bitcoin payment — $300 at first, rising to $600 before it destroys files hours later.
Just one person in an organization who clicked on an infected attachment or bad link, would lead to all computers in a network becoming infected, said Vikram Thakur, technical director of Symantec Security Response.
"That’s what makes this more troubling than ransomware was a week ago," Thakur said.
Microsoft’s top lawyer laid some of the blame for the attack on U.S. intelligence agencies, including the CIA and National Security Agency, for ’stockpiling’ software code that can be used by hackers. (Patrick Semansky/Associated Press)
The attack has hit more than 200,000 victims across the world since Friday and is seen as an "escalating threat," said Rob Wainwright, the head of Europol, Europe’s policing agency.
"The numbers are still going up," Wainwright said.
Microsoft’s top lawyer is laying some of the blame at the feet of the U.S. government. Brad Smith criticized U.S. intelligence agencies, including the CIA and National Security Agency, for "stockpiling" software code that can be used by hackers. Cybersecurity experts say the unknown hackers who launched this weekend’s "ransomware" attacks used a vulnerability that was exposed in NSA documents leaked online.
It was too early to say who was behind the onslaught, which struck 100,000 organizations, and what their motivation was, aside from the obvious demand for money. So far, not many people have paid the ransom demanded by the malware, Europol spokesman Jan Op Gen Oorth told The Associated Press.
Researchers who helped prevent the spread of the malware and cybersecurity firms worked around the clock during the weekend to monitor the situation and install a software patch to block the worm from infecting more computers in corporations across the U.S., Europe and Asia.
"Right now, just about every IT department has been working all weekend rolling this out," said Dan Wire, spokesman at Fireeye Security.
Installing the Microsoft patch is one way to secure computers against the virus. The other is to disable a type of software that connects computers to printers and faxes, which the virus exploits, O’Leary added.
Microsoft distributed a patch two months ago that could have forestalled much of the attack, but in many organizations it was likely lost among the blizzard of updates and patches that large corporations and governments strain to manage.