Hackers and public transportation do not go well together

End of November, the San Francisco Municipal Transportation Agency (SFMTA) went through a hacking nightmare. Last week, experts confirmed that the cyber-attack was cause by a ransomware dubbed Mamba. It still isn’t clear to us why Sophos Labs, who discovered the malware in the first place, decided to name it after a species of poisonous snakes, but so be it. We deem it more important to explain head on that Mamba encrypts all hard disks and shared resources present on the infected machine. 25% of the SFMTA computers were compromised during the incident, causing a breakdown of its ticketing service.

On Saturday, November 26, all terminal screens broadcasted the following message: “You are hacked, all data encrypted”. The threat urged the agency to contact a certain cryptom27@yandex.com in order to obtain the key and unlock the data taken hostage.According to the SFMTA’s website, the ransom request went up to $ 73,000. Knowing that this would mean maintaining the total blockage of tramway and metro terminals, the agency officials still refused to pay the price. This impossible situation is what ultimately led to people travelling for free throughout the entire Thanksgiving weekend.By opposing this digital blackmail, the city of California lost nearly $ 550,000, seven times more than the ransom demanded. Some of you will ask yourselves: why didn’t the SFMTA just go ahead and pay the hackers? Was this a testimony of their refusal to bow down to cybercrime? Or was it simply because of good old-fashioned pride? Mamba and cyber-snake huntAlthough it spreads pretty much the same way as a Trojan horse, Mamba (also called HDDCryptor) doesn’t exactly behave like your ordinary ransomware. The latter doesn’t just encrypt user personal data, but goes even further than the infamous Petya, who is known for attacking the Master File Table. The malware that picked a quarrel with the SFMTA profits aims to spread its venom at disk sector levels, including the MFT, the OS, the applications, the shared files, as well as the user’s personal data. But before going more into detail, let’s take a step back and look at how the incident actually started. It’s a typical click-a-suspicious-link that downloads an infected attachment. The funny thing is that Windows actually asks you for your permission to install Mamba, which it identifies as un unknown application.

What makes Mamba really sneaky is the fact that it runs its malicious code in the background and installs itself as a service on the machine in order to obtain admin privileges. It then triggers the stealthy installation of Netpass, a free network password recovery software, and DiskCryptor, a low-level software used for full disk encryption[1].Netpass.exe is used to scan all shared network files which the user might have previously accessed in order to retrieve login credentials. The infection continues with DiskCryptor, encrypting the files belonging to the very same user. Dccon.exe encrypts the contents of the hard disk itself, while Mount.exe encrypts the contents of all accessible network drives (either physically or physically).At the end of the encryption process, Mamba rewrites all MBRs (Main Boot Records). It then alters the boot sectors on all partitions of the hard disk. Once the computer is restarted, the Mamba effect becomes irreversible. You probably could have retrieved the encryption password by accessing the log of DiskCryptor in log_file.txt, but that would have required you to actually be aware of the ongoing encryption process. At this point, you have no access to the key used for encryption. Instead, a classic boot screen appears, instructing you on how to pay your ransom.

Source : The Charles Tendell ShowThe snake biting its own tailThe SFMTA hack is now over and the Californian railways are up and running again. Acting as one Andy Saolis, the hacker didn’t get a single bitcoin and user data remained uncompromised. Yes, the city hall of San Francisco had to replace all the infected machines, but it’s a relatively low cost to pay in order to prevent Mamba’s venom from spreading to the entire system.More than that, what goes around comes around – and Andy the hacker can’t deny this. Just a few days after the cyber-attack, the latter was hacked as well by a cybersecurity researcher. According to the Krebs on security blog, the expert, who preferred to remain anonymous, claims to have infiltrated the account belonging to “cryptom27@yandex.com”. The white hat vigilante was able to trace the history of the offender and reveal that the first ransom request was sent to the SFMTA on Friday, November 25, more specifically, to a Mr. Cunningham, in charge of the company’s network infrastructure.The investigation also showed that the cybercriminal wasn’t particularly targeting San Francisco’s municipal transportation agency. According to Kreb’s source, Andy Saolis wasn’t even at his first try. Among his other victims, the expert was able to identify mostly American SMEs, which is most likely the reason why he’s managed to stay under the radar so far.What brings a little humor to this whole situation is that the author of Mamba also offers to secure his victims’ network (in exchange for a more significant ransom, of course). Unfortunately, companies willing to pay the price will soon realize that this is no more than a scam. On the one hand, the proposal is coming from a person who wasn’t even able to protect his own account. On the other hand, the services proposed by Andy Saolis consist in showering his new “clients” with Oracle security patch links.

Our story ends with a happy ending this time, but the consequences could be devastating next time around. Mamba’s bite can impact any critical infrastructure, not just transportation networks. According to a report issued by the ICIT (the Institute of Critical Infrastructure Technologies), ransomware has already declared war on key service providers. Indeed, the examples are there. The SFMTA is just another ‘accomplishment’ in the disturbing list of essential operator hacks, including here health institutions, distribution networks – energy, electricity, water – and digital service providers, all victimized by either Mamba, Petya, Locky and so on.Instead of blindly placing our faith in the promise of a snake or applying a rigid incident response policy, ICIT calls for an approach tailored to the needs of each infrastructure. However, potential solutions must be built following two main axes: prevention and response. How to avoid being bitten by Mamba? We’ve said this time and time again: the answer lies in training and raising staff awareness.Still, to ensure success, one must always assume that this first axis will fail at one point or another, hence the need to have the right tools in place in order to detect malicious anomalies and stop the infection before it compromises the entire network. Better be known as a “cyber-pessimist” and always have a back-up, than face failure unprepared. This way, you also ensure the reaction axis, restoring your company’s services in record time. Whether we’re talking about the SFMTA or the Hollywood Presbyterian Hospital, the ultimate goal is to prevent black hats from disrupting your business. Right? [1] Do not mistake DiskCryptor with TrueCrypt, a similar type of tool used by a group of hackers dubbed Strong Pity, covered in one of our previous articles.

Link:https://www.reveelium.com/en/hackers-and-public-transportation/