Security experts are warning that the global cyberattack that began on Friday is likely to be magnified in the new workweek as users return to their offices and turn on their computers.
Many workers, particularly in Asia, had logged off on Friday before the malicious software, stolen from the US government, began proliferating across computer systems around the world. The true effect of the attack may emerge on Monday as employees return and log in.
Copycat variants of the malicious software behind the attacks have begun to spread, according to experts. "We are in the second wave," said Matthieu Suiche of Comae Technologies, a cybersecurity company based in the United Arab Emirates. "As expected, the attackers have released new variants of the malware. We can surely expect more."
The cyberattack has hit 200,000 computers in more than 150 countries, according to Rob Wainwright, executive director of Europol, the European Union's police agency.
“At the moment, we are in the face of an escalating threat,” he told ITV on Sunday. “The numbers are going up. I am worried about how the numbers will continue to grow when people go to work and turn their machines on Monday morning.”
Among the organisations hit were FedEx in the United States, the Spanish telecom giant Telefónica, the French carmaker Renault, universities in China, Germany's federal railway system and Russia's Interior Ministry. The most disruptive attacks infected Britain's public health system, where surgeries had to be rescheduled and some patients were turned away from emergency rooms.
Less vulnerable version
A 22-year-old British researcher who uses the Twitter name MalwareTech has been credited with inadvertently helping to stanch the spread of the assault by identifying the web domain for the hackers’ “kill switch” – a way of disabling the malware. Mr Suiche of Comae Technologies said he did the same for one of the new variants of malware to surface since the initial wave.
On Sunday, MalwareTech was one of many security experts warning that a less vulnerable version of the malware is likely to be released. On Twitter, he urged users to immediately install a security patch for older versions of Microsoft’s Windows, including Windows XP. The attack did not target Windows 10.
Robert Pritchard, a former cybersecurity expert at Britain's ministry for defence, said that security specialists might not be able to keep pace with the hackers. "This vulnerability still exits; other people are bound to exploit it," he said. "The current variant will make its way into antivirus software. But what about any new variants that will come in the future?"
All it would take is for a new group of hackers to change the original malware code slightly to remove the "kill switch" and send it off into the world, using the same email-based methods to infiltrate computer systems that the original attackers used, experts said. The Microsoft patch will help, but installing it across large organisations will take time.
Governments around the world were bracing themselves for the start of the workweek. “This is crucial for businesses when reopening on Monday: Please beware and anticipate, and take preventive steps against the WannaCry malware attack,” Indonesia’s communication and information minister, Rudiantara, who like many Indonesians uses only one name, said at a news conference.
Fallout in UK
In Britain, the fallout from the attack continues. The Labour Party and the Liberal Democrats claimed the Conservative Party had not done enough to prevent the attack. With a general election scheduled for June 8th, officials have been racing to get ahead of the problem.
Britain's defence minister, Michael Fallon, told the BBC on Sunday that the government was spending about £50 million to improve cybersecurity at the National Health Service, where many computers still run the outdated Windows XP software, which Microsoft had stopped supporting.
A government regulator warned the NHS last July that updating antiquated hardware and software was “a matter of urgency” and noted that one hospital had already had to pay £700,000, to repair a breach that began after an employee clicked on a web link in an unsafe email.
“The threat from cyber attacks has not only put patient information at risk of loss or compromise but also jeopardises access to critical patient record systems by clinicians,” the regulator, the Care Quality Commission, wrote in its report.
– (The New York Times News Service)