This article is from the source 'nytimes' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at https://www.nytimes.com/2017/05/14/world/europe/ransomware-cyberattack-wannacry-hacking.html

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
How to Catch Hackers? Old-School Sleuthing, With a Digital Twist How to Catch Hackers? Old-School Sleuthing, With a Digital Twist
(about 2 hours later)
LONDON — Bank robbers wear masks and escape in vans with stolen license plates. Kidnappers compose ransom letters from newsprint to elude handwriting experts. Burglars target houses with the upstairs window ajar.LONDON — Bank robbers wear masks and escape in vans with stolen license plates. Kidnappers compose ransom letters from newsprint to elude handwriting experts. Burglars target houses with the upstairs window ajar.
Cybercriminals do much the same.Cybercriminals do much the same.
They hide behind software that obscures their identity and leads investigators to look in countries far from their actual hide-outs. They kidnap data and hold it hostage. And they target the most vulnerable companies and people whose information is poorly protected.They hide behind software that obscures their identity and leads investigators to look in countries far from their actual hide-outs. They kidnap data and hold it hostage. And they target the most vulnerable companies and people whose information is poorly protected.
Cybercrimes, like the global ransomware attack that began Friday and has affected hundreds of thousands of computers in more than 150 countries, are in a way an updated version of ancient criminal methods.Cybercrimes, like the global ransomware attack that began Friday and has affected hundreds of thousands of computers in more than 150 countries, are in a way an updated version of ancient criminal methods.
And in the global search for the criminals that continued Sunday, investigators are following much the same process that detectives in the physical world have used for decades: secure the crime scene, collect forensic evidence and try to trace the clues back to the perpetrator.And in the global search for the criminals that continued Sunday, investigators are following much the same process that detectives in the physical world have used for decades: secure the crime scene, collect forensic evidence and try to trace the clues back to the perpetrator.
But for all of their similarities to traditional crimes, cyberattacks have major digital twists that can make them much harder to solve and can greatly magnify the damage done.But for all of their similarities to traditional crimes, cyberattacks have major digital twists that can make them much harder to solve and can greatly magnify the damage done.
The latest attack has claimed at least 200,000 victims worldwide, according to an estimate on Sunday by Europol, Europe’s police agency, and new variants of the malware are emerging, leading security experts to warn that the fallout could spread as people return to work on Monday.The latest attack has claimed at least 200,000 victims worldwide, according to an estimate on Sunday by Europol, Europe’s police agency, and new variants of the malware are emerging, leading security experts to warn that the fallout could spread as people return to work on Monday.
Such a large, complex and global crime outbreak means any hope of a successful investigation will require close teamwork among international law enforcement agencies — like the F.B.I., Scotland Yard and security officials in China and Russia — often wary of sharing information with one another.Such a large, complex and global crime outbreak means any hope of a successful investigation will require close teamwork among international law enforcement agencies — like the F.B.I., Scotland Yard and security officials in China and Russia — often wary of sharing information with one another.
“With cybercrime, you can operate globally without ever having to leave your home,” said Brian Lord, a former deputy director for intelligence and cyberoperations at Government Communications Headquarters, Britain’s equivalent of the National Security Agency. “Catching who did this is going to be very hard, and will require a level of international cooperation from law enforcement that does not come naturally.”“With cybercrime, you can operate globally without ever having to leave your home,” said Brian Lord, a former deputy director for intelligence and cyberoperations at Government Communications Headquarters, Britain’s equivalent of the National Security Agency. “Catching who did this is going to be very hard, and will require a level of international cooperation from law enforcement that does not come naturally.”
The only institutional arrangement for international cooperation on cybercrime is the so-called Budapest Convention, whose membership is largely restricted to Western democracies, said Nigel Inkster, a former assistant chief of Britain’s secret intelligence service, MI6.The only institutional arrangement for international cooperation on cybercrime is the so-called Budapest Convention, whose membership is largely restricted to Western democracies, said Nigel Inkster, a former assistant chief of Britain’s secret intelligence service, MI6.
Authoritarian states such as Russia and China have refused to sign on to the agreement because it permits the digital equivalent of hot pursuit: A police force investigating a cybercrime can access networks in other jurisdictions without first seeking permission.Authoritarian states such as Russia and China have refused to sign on to the agreement because it permits the digital equivalent of hot pursuit: A police force investigating a cybercrime can access networks in other jurisdictions without first seeking permission.
“Any investigation of the recent ransomware attack will have to be done by a coalition of the willing,” Mr. Inkster said.“Any investigation of the recent ransomware attack will have to be done by a coalition of the willing,” Mr. Inkster said.
There are signs a coalition is coming together, at least in parts of the international system. Europol said its team of cybersecurity specialists — made up of agents from countries like Germany, Britain and the United States — was investigating the attack.There are signs a coalition is coming together, at least in parts of the international system. Europol said its team of cybersecurity specialists — made up of agents from countries like Germany, Britain and the United States — was investigating the attack.
Europe and Asia were the regions most affected by the crime, with hospitals, car plants and even the Russian Ministry of Interior falling prey to the malware, which takes over a computer, locks down the machine and releases it only when the owner has paid a ransom.Europe and Asia were the regions most affected by the crime, with hospitals, car plants and even the Russian Ministry of Interior falling prey to the malware, which takes over a computer, locks down the machine and releases it only when the owner has paid a ransom.
Hours after the attack was first reported in Britain, where the computer systems of the National Health Service were crippled, law enforcement agencies across Europe, Asia and the United States began looking for clues that could trace the assault to specific people or organizations.Hours after the attack was first reported in Britain, where the computer systems of the National Health Service were crippled, law enforcement agencies across Europe, Asia and the United States began looking for clues that could trace the assault to specific people or organizations.
As with a physical crime scene, the first step with any cyberinvestigation is to make sure the criminal is no longer hiding out, about to pounce again.As with a physical crime scene, the first step with any cyberinvestigation is to make sure the criminal is no longer hiding out, about to pounce again.
“Before we get into who did it, we try to figure out if the bad guys still have access,” said Theresa Payton, a former chief information officer of the White House and founder of Fortalice, a cybersecurity firm. “Are they still hiding? Are they going to come back tomorrow? Is the door that let them in still ajar? Can they inflict more pain?”“Before we get into who did it, we try to figure out if the bad guys still have access,” said Theresa Payton, a former chief information officer of the White House and founder of Fortalice, a cybersecurity firm. “Are they still hiding? Are they going to come back tomorrow? Is the door that let them in still ajar? Can they inflict more pain?”
“And if so, where are they?” she added. “How do we cordon them off to mitigate further damages?”“And if so, where are they?” she added. “How do we cordon them off to mitigate further damages?”
Instead of searching the closets of a property that has been broken into, investigators will examine the affected server, online software caches and emails to identify any malware that might not have been activated yet.Instead of searching the closets of a property that has been broken into, investigators will examine the affected server, online software caches and emails to identify any malware that might not have been activated yet.
In the case of the ransomware that was unleashed Friday and is known as WannaCry, Wcry or Wanna Decryptor, it was quickly determined that updating Windows software with the latest security patch was enough to inoculate computers that had not been infected.In the case of the ransomware that was unleashed Friday and is known as WannaCry, Wcry or Wanna Decryptor, it was quickly determined that updating Windows software with the latest security patch was enough to inoculate computers that had not been infected.
Then the forensic work begins, with agents looking for digital fingerprints.Then the forensic work begins, with agents looking for digital fingerprints.
Because of the highly technical nature of these investigations, private data security teams can be expected to help in the search. That includes working directly with law enforcement to uncover clues left behind by the attackers, as well as tracking the virus and its effects separately to protect their corporate clients. Because of the highly technical nature of these investigations, private data security teams can be expected to help in the search. That includes working directly with law enforcement to uncover clues left behind by the attackers, as well as tracking the virus and its effects separately to protect their corporate clients. These firms have been instrumental in solving some cases.
In the WannaCry case, the phishing emails sent by the criminals with the infected link are a key piece of evidence. Patricia Lewis, the international security research director at Chatham House in London, likened the text of the email to a physical letter and its metadata to the envelope it arrives in.In the WannaCry case, the phishing emails sent by the criminals with the infected link are a key piece of evidence. Patricia Lewis, the international security research director at Chatham House in London, likened the text of the email to a physical letter and its metadata to the envelope it arrives in.
“An envelope has lots of information on it: the stamp with the time and place it was sent from, the handwriting or printer type, a sender’s address, maybe a fingerprint or DNA from saliva on the seal,” Ms. Lewis said.“An envelope has lots of information on it: the stamp with the time and place it was sent from, the handwriting or printer type, a sender’s address, maybe a fingerprint or DNA from saliva on the seal,” Ms. Lewis said.
Criminals are aware their emails contain revealing clues, and they try to cover their tracks. “People use cloakers, which hide your identity, making you look as if you are someone and somewhere else,” she said.Criminals are aware their emails contain revealing clues, and they try to cover their tracks. “People use cloakers, which hide your identity, making you look as if you are someone and somewhere else,” she said.
Like tracing the license plates of a stolen car back to the wrong person, this can lead investigators astray. “But a good detective can track them,” Ms. Lewis said. “They always leave digital bread crumbs that can be followed.”Like tracing the license plates of a stolen car back to the wrong person, this can lead investigators astray. “But a good detective can track them,” Ms. Lewis said. “They always leave digital bread crumbs that can be followed.”
Investigators will check whether the email address the malware came from is linked to social media accounts, past cybercrimes or other locations on the web. They will study the domain name it is linked to. And they will look for patterns to try to connect one crime to others.Investigators will check whether the email address the malware came from is linked to social media accounts, past cybercrimes or other locations on the web. They will study the domain name it is linked to. And they will look for patterns to try to connect one crime to others.
Success often depends on whether law enforcement can tie small digital details, including potential mistakes or a certain style in the programming code, back to the criminals. The location of where some of the ransom money is withdrawn can also help connect the dots.Success often depends on whether law enforcement can tie small digital details, including potential mistakes or a certain style in the programming code, back to the criminals. The location of where some of the ransom money is withdrawn can also help connect the dots.
Sometimes the patterns that lead investigators to their target can be surprising. One state-sponsored hack was traced to Russia because detectives noticed those responsible were online only from 9 a.m. to 5 p.m. Moscow time, Ms. Lewis recalled. In another case, hackers were observing Chinese holidays.Sometimes the patterns that lead investigators to their target can be surprising. One state-sponsored hack was traced to Russia because detectives noticed those responsible were online only from 9 a.m. to 5 p.m. Moscow time, Ms. Lewis recalled. In another case, hackers were observing Chinese holidays.
When Sony was hacked, officials linked the malware that was used to one that had been used before in North Korea. “That was a big clue,” Ms. Lewis said. “But of course it could have been deliberately planted.”When Sony was hacked, officials linked the malware that was used to one that had been used before in North Korea. “That was a big clue,” Ms. Lewis said. “But of course it could have been deliberately planted.”
In the recent hack of the political campaign of the new president of France, Emmanuel Macron, for instance, security experts were able to link the registration of certain website domains used in the attack to Russian hackers.In the recent hack of the political campaign of the new president of France, Emmanuel Macron, for instance, security experts were able to link the registration of certain website domains used in the attack to Russian hackers.
Investigators in the latest attack are looking for clues in the ransom notes written in more than 20 languages. Some suggested that the assailants might have connections to China because the Mandarin version of the text was better written than its English equivalent.Investigators in the latest attack are looking for clues in the ransom notes written in more than 20 languages. Some suggested that the assailants might have connections to China because the Mandarin version of the text was better written than its English equivalent.
Once equipped with enough identifying data to start narrowing down suspects, investigators will go undercover to listen to the chatter on technology boards where cybercriminals are known to spend time. “It’s like using an undercover operative purporting to be part of a criminal gang, except it’s online,” Mr. Inkster said.Once equipped with enough identifying data to start narrowing down suspects, investigators will go undercover to listen to the chatter on technology boards where cybercriminals are known to spend time. “It’s like using an undercover operative purporting to be part of a criminal gang, except it’s online,” Mr. Inkster said.
“Half the dark web are cyberagents these days,” Ms. Lewis joked. “They’re tripping over each other.”“Half the dark web are cyberagents these days,” Ms. Lewis joked. “They’re tripping over each other.”
One of the most challenging new developments for investigators is the use of Bitcoin, a digital currency with little oversight.One of the most challenging new developments for investigators is the use of Bitcoin, a digital currency with little oversight.
In the latest attack, the criminals demanded ransoms ranging from $300 to $600, to be paid in Bitcoin.In the latest attack, the criminals demanded ransoms ranging from $300 to $600, to be paid in Bitcoin.
Bitcoin accounts, or wallets, are extremely difficult to trace. While law enforcement agencies have cracked cases by tracking Bitcoin transactions, the process is arduous and expensive. Bitcoin accounts, or wallets, are extremely difficult to trace. While law enforcement agencies have cracked cases by tracking Bitcoin transactions, the process is arduous.
It could take months, if not years, for law enforcement agencies to pinpoint the identity of the attackers.It could take months, if not years, for law enforcement agencies to pinpoint the identity of the attackers.
Ultimately, in the world of computers, as in the physical world, investigators rely on criminals to make a mistake.Ultimately, in the world of computers, as in the physical world, investigators rely on criminals to make a mistake.
As Adam Malone, a former cyberagent for the F.B.I., put it, “A lot of times we catch bad guys because they get sloppy.”As Adam Malone, a former cyberagent for the F.B.I., put it, “A lot of times we catch bad guys because they get sloppy.”