Ransomware Compromises San Francisco's Mass Transit System (cbslocal.com)

Buses and light rail cars make San Francisco's "Muni" fleet the seventh largest mass transit system in America. But yesterday its arrival-time screens just displayed the message "You Hacked, ALL Data Encrypted" -- and all the rides were free, according to a local CBS report shared by RAYinNYC: Inside sources say the system has been hacked for days. The San Francisco Municipal Transportation Agency has officially confirmed the hack, but says it has not affected any service... The hack affects employees, as well. According to sources, SFMTA workers are not sure if they will get paid this week. Cyber attackers also hit Muni's email systems.
Though the article claims "The transit agency has no idea who is behind it, or what the hackers are demanding in return," Business Insider reports "The attack seems to be an example of ransomware, where a computer system is taken over and the users are locked out until a certain amount of money is sent to the attacker." In addition, they're reporting the attack "reportedly included an email address where Muni officials could ask for the key to unlock its systems."

One San Francisco local told CBS, "I think it is terrifying. I really do I think if they can start doing this here, we're not safe anywhere."

Comments

When do we switch to OpenBSD?

[rbrander]

...I don't mean running everything on OpenBSD literally, though it's an idea. I mean, "when do we get really serious about security?" Again and again, we find major hacks that are not the result of super-hackers defeating valiant protective efforts, it's script kiddies defeating idiots who kind of deserved it. The Sony hack came with many stories of multiple executives demanding the network be multiply-holed so that they could watch their favourite videos or whatever, hit their favourite sites.

I'm reading Andrew Ginter's book on SCADA security right now and reflecting on the insanity that there are SCADA systems, of all programming, being written on Windows, at all. There's one place the OpenBSD suggestion is quite serious. But even "OpenBSD" is just a buzzword unless you run your operations with security on your mind at all times. Schnier reduces this "mindfulness" argument to "read your logs", said it in three words.

Most of this stuff is not actually that *hard*...it requires *diligence* and *discipline*, but not nuclear science.

Re:When do we switch to OpenBSD?

[RhettLivingston]

A really smart attacker gets in, installs a piece of code that automatically activates if it senses that it has become active after a restoration, and waits a couple of months before they do anything overt so that they are sure they've infected the backups.

So, for a backup to really help, it has to carefully separate code and data so that you can wipe the system, install fresh code (not from a backup), and restore data only. Also, in this case, you don't want to lose even an hours worth of data, so the data needs to be a near live off-site backup. Few backups are this good and even fewer have actually tested the restoration process.

These attacks need to be stopped before they happen, not recovered from.

Re:When do we switch to OpenBSD?

[Dutch Gun]

It won't help in many cases, as I think you hit upon the real problem when talking about Sony execs. The weak point is *users*, not technology. We were to switch to OpenBSD tomorrow, we'd bring the idiot users along, who would happily allow a social engineering attack to compromise their system, or who insist on policies that, for convenience, ego, laziness, costs, whatever... fatally compromise their network. The DNC lost control of a Gmail account not through some masterful OS or network-level hack, but by using some simple social engineering to capture credentials, acquired through a spearphishing attack.

I wouldn't be surprised if this attack originated internally from a contractor or employee that was compromised, and had jack-all to do with the system's end-user-facing security itself, and will probably reveal lax or non-existent security policies internally. No system is secure when the malware has proper authentication. We really have no information yet, so it's hard to say.

likely over-reaction.

[nimbius]

disclosure: i worked as a contractor for LA Metro.
 
 

its arrival-time screens just displayed the message "You Hacked, ALL Data Encrypted"

not a hard feat to pull off. the data thats shown on these screens is either dynamically generated by track signal data thats processed through SCADA and into a windows system, or you can issue an override screen for construction/etc...removing this screen should not be hard.

and all the rides were free

there is no magic button to make all rides free centrally. This was likely done by Muni as a last ditch effort because their card transaction databases were offline or the system that handles accounting for this database was offline due to the hack. Muni simply put their turnstiles into bypass mode and sent their fare enforcement officers home for the day. it means when they run their fare-jump report for the month, theyll have to adjust for the days they had open fare points.

"The transit agency has no idea who is behind it, or what the hackers are demanding in return,"

nothing. chances are great they didnt expect to get this far. its possible the warning on muni transit screens is a side-effect of a wallpaper or start screen that machines are now forced into depending on what model of annunciation system they purchased. if thats the case, reimaging the screens will take 2-3 hours and can all be done centrally. as for the accounting database for oyster/muni cards, thats an easy restore from backup or calling transactions back from their VAN provider (value added networks, generally operated by IBM or Cisco.)

as for people worrying about getting paid, this happens a lot. ive once shut down live map systems on a handful of busses to upgrade the video drivers, and by the end of the day there was a rumor spreading that the payroll department was hacked. Drivers/operators are not brilliant minds.

Beyond that, fragile overall

[raymorris]

Even beyond that, systems that can be so completely broken are typically fragile systems, systems that break in ordinary use. As an example, here's a standard SQL injection, which was present all through a system I worked on recently:

SET lastname='$FORM_LASTNAME'

Sure that can be leveraged by an attacker, but what happens when the user's last name is O'Reilly? O'Reilly can't sign up for the service.

That example is typical. Code that's easily hacked is fragile, poor quality code in general, in most cases. Fixing security isn't JUST fixing security. Code that can't be broken is code that doesn't break.

Re:Enough!

[Anonymous Coward]

No foreigner would write "You hacked", no matter how poor their English is.

All your bus are belong to us

Re:SF...hmmm

[drinkypoo]

Isn't this the place that arrested its systems administrator because he wanted to keep the system password secret?

Yes. He insisted on doing his job to the letter to the very end and they boned him for it. Like a fish. He played Ahab and forgot to let go.