Handsome where, the greatest threat facing society, and hackers exploit Zero Day to wipe my book live devices. These stories and more in this week's ISNG Security Report. Hi, I'm Anna Delaney. The head of Britain's National Cybersecurity Centre says the principal cyber threat facing society isn't nation state attackers, but ransomware wield criminals.
Linda Cameron is CEO of the NCSC and recently delivered the annual security lecture at Rusey, the world's oldest defence and security think tank. So what I find most worrying isn't the activity of state actors? Rule it, is it an improbable cyber Armageddon? What I worry about most is the cumulative effect of a potential failure to manage cyber risk and the failure to take the threat of cyber criminality seriously.
For the vast majority of UK citizens and businesses and indeed for the vast majority of critical national infrastructure providers and government service providers, the primary threat is not state actors but cyber criminals and in particular the threat of ransomware. Joining me to discuss is Mackie Short, Executive Editor of DataBeach Today and Europe. So Matt, are you surprised by Cameron's point of view? No, what I love is that it's a real dose of reality and it's so tied into what we have been seeing with attack trends.
So for years there are these warnings about cyber warfare or cyber Armageddon, that nation state actors, which is a fancy word for the likes of Russia, China, Iran, North Korea, could come gunning for our critical infrastructure. Now of course this is still a threat as are threats to the banking sector that might be launched under the guise of geopolitical conflict or any of the kind of attack that you can think of. But what's great here is that Cameron's coming out and saying when it comes to the threats that you as an individual, you as a business should be preparing against ransomware is really where you need to have your eye on the wall. So she had much more about this to say.
Ransomware has historically been the preserve of high-end cyber crime groups with access to advanced technical skills and capabilities. Based on overseas jurisdictions who turn a blind eye or otherwise fail to act or fail to pursue these groups. But the ecosystem is evolving through what we call ransomware as a service. And the as a service business model where ransomware variants and commodity listings such as the credentials are available off the shelf for a one-off payment or a share of the profits.
We know there are campaigns to recruit new affiliates and as a result, users and buy from developers without the costs and risks of developing it themselves. And that enables less experienced actors to acquire tools to conduct their own ransomware attacks. As that business model has become more and more successful with these groups securing significant amounts of payments from large and profitable businesses who can't afford to lose their data to encryption or decipher dine sign while their services are offline, the market for ransomware has become increasingly professional. If your files are encrypted by ransomware, you might be offered the services of a 24-7 help center to quickly pay the ransom, get yourself back and wine.
The ransom that accompanying the attack will give you the contact details to use to negotiate with the attackers and unlock your files. Everything is geared to make it as easy as possible to simply pay the ransom and move on. So this is a great overview of how ransomware has been evolving. The ransomware service model that she outlines has given criminals the ability to procure ransomware as a cloud service.
So you have these operations that build the ransomware executable, make it available via a portal. And if you're a criminal who wants to do this sort of thing, you can come along and subscribe. The agreement is that you will share in the profits. Oftentimes you'll keep 70% of every ransom payment, 30% or thereabouts goes to the ransomware service operator.
Unfortunately, this has led to incredible profits. It's brought a lot of individuals in who want to run these kinds of attacks. And it has more technically astute individuals and organizations running these service offerings. And so there's this level of specialization which is driven higher ransoms, unfortunately more effective attacks and has led to more organizations paying, giving us the sky high profits that just keep perpetuating, unfortunately, this very effective criminal business.
And so what can be done? How can we solve this? That's the million pound question. If you're in Britain, right, the National Cyber Security Center is highlighting its approach and Cameron in her speech noted that there are big moves of foot by allies, including the Biden administration to try to tackle this at a geopolitical level.
So a more high level to hopefully get countries like Russia thinking about the need to suppress criminality happening inside its borders, but being focused out with the country. So that's at the high level, but NCSC also has another mission which is to be the Brits of the ground. It is the National Incident Response Lead for Britain. And it's an interesting model because the NCSC is part of GCHQ.
You don't see this approach in some other countries. For example, the National Security Agency in the US is not handling private sector incidents. Culturally, I'm not sure that would fly. In Britain, though, they've made a go of it and it's worked really well.
And the model has been emulated elsewhere, for example, in Canada. So it's refreshing to see an official saying, we've heard these threats about cyber war, but when it comes to getting your cyber security house in order, I'm the lead cyber security official in the UK and I'm telling you, ransomware is really what you need to focus. This is exactly the message the government should be putting out. And they're also backing up with resources, such as NCSC to help.
So this is what we should be seeing and hopefully we'll see more of it. You're listening to the ISMG Security Report on ISMG Radio, ISMG, your number one source for information security news. The plot begins around how Aging Western Digital Network attached storage devices were remotely erased. Here's Jeremy Kirk on Managing Editor of Security and Technology with more on the story.
Two weeks ago, scores of Western Digital Network attached storage devices were remotely erased by attackers. This caused lots of anguish for lots of people. Why that happened is still fuzzy, but how it happened is becoming more clear. A newly discovered zero-day vulnerability now appears to have played a role.
The products affected were Western Digital's MyBookLive and MyBookLiveDuo NAS products. They were released around 2010 and here's the kicker, stopped receiving security updates in 2015. Nonetheless, tens of thousands of users continued to use the still functional devices after that year, but their security risks arguably increased over time. The situation highlights the problem of manufacturers discontinuing security support for devices that are still in wide use, which offers opportunity for attackers.
Brad Re is CTO of the IOXT Alliance, which is a trade group that develops baseline IOT security specifications. He tells me that devices like the Western Digital ones are, quote, taking time bombs as consumers expect that the security of the device will last as long as the drives can store data, end quote. One vulnerability that could have allowed attackers to tamper with those devices has been known about for a couple of years. Western Digital has said it is found evidence that attackers used that issue to install botnet code, but there also appears to be a zero-day vulnerability which can allow attackers to reset a drive to its factory settings.
In that process, all data is erased. Why attackers would trigger a factory reset on a mass scale is unknown. The action might not have been aimed at once in destruction, although that was the end result. Derek Abdein is CTO for Census, which is a company that helps organizations monitor their network resources.
He says that factory resetting a NAS device might have also reset its configuration to the default logging credentials. That would have allowed one group of attacker to rest control of the devices from another group. The real question is what to be done about all this. Abdein tells me that Western Digital should patch the old devices similar to the exceptions that Microsoft has made in the past for operating systems such as XP under grave circumstances.
It appears Western Digital has realized the gravity of the problem. In an update to its June 24th advisory, the company says it will provide data recovery services to those affected. Also, it will allow a training program that will allow customers to upgrade to a newer product line. There's growing support particularly in the IoT space for manufacturers to more clearly state their support periods and continue to patch devices that are widely used.
It's unlikely that manufacturers are going to be able to just ignore security problems in their products if people continue to use them. Can we imagine Tesla not updating the software in its vehicles after five years? That kind of extended support may mean we end up paying more initially for say a storage device, but perhaps there's comfort in knowing that vendors doing its best to prevent attackers from coming along one day and wiping out all your data. For Information Security Media Group, I'm Jeremy Kirk.
And finally, leaving you this week with another clip from our upcoming virtual government Cyber Security Summit on the 13th and 14th July. This is taken from a conversation between Elvis Chan, who manages an FBI squad responsible for investigating national cybersecurity matters and our senior VP of editorial, Tom Field. Elvis, we're in the second half of 2021 now. What are the trends you're going to be following most closely as we close up this year?
So definitely, I think there's going to be more ransomware. So we're already working with R on headquarters, with DOJ, with the other intelligence community partners to figure out. Like the DOJ ransomware task force plan is to look at the whole ransomware ecosystem, all of the identified parts. So specifically, the parts that we're looking at are the ransomware as a service itself, the dark web forums, the money mules, the cash out exchanges, those are the types of organizations that are enabling all the different parts of ransomware attacks.
And so what we're really focused on is prioritizing, racking and stacking, and then working with our international partners, because these types of organizations are spread out all over the world to do disruptions and really inflict consequences on people doing these types of formal activities.