WannaCrypt: Cyber attack rolls into Asia but global spread slows

Some victims were ignoring official advice and paying the $US300 ($405) ransom demanded by the cyber criminals to unlock their computers, which was due to double to $US600 ($809) on Monday for computers hit by Friday's first wave.

So far only a few victims of the attack appeared to have paid, based on publicly available bitcoin accounts on the web, where victims have been instructed to pay.

This coming Friday, victims face being locked out of their computers permanently if they fail to pay the $US600 ransom, said Tom Robinson, co-founder of Elliptic, a London-based private security company that investigates ransomware attacks.

As of 1400 GMT, the total value of funds paid into anonymous bitcoin wallets the hackers are using stood at just $US55,169 (around $74, 000), from 209 payments, according to calculations made by Reuters using publicly available data.

Brian Lord, managing director of cyber and technology at cyber security firm PGI, said victims had told him "the customer service provided by the criminals is second-to-none," with helpful advice on how to pay: "One customer said they actually forgot they were being robbed."

Companies and governments spent the weekend upgrading software to limit the spread of the virus. Monday was the first big test for Asia, where offices had already mostly been closed for the weekend before the attack first arrived.

Renault-Nissan said output had returned to normal at nearly all its plants. PSA Group, Fiat Chrysler, Volkswagen, Daimler, Toyota and Honda said their plants were unaffected.

Shares in firms that provide cyber security services jumped on the prospect of companies and governments spending more money on defenses, led by Israel's Cyren Ltd and US firm FireEye Inc..

Cisco Systems rose 2.8 per cent, making it the leading gainer in the Dow Jones Industrial Average, which was up more than 100 points in afternoon trading, as investors focused more on opportunities the attack presented rather than the risk it posed to corporations.

British media were hailing as a hero a 22-year-old computer security whiz who appeared to have helped stop the attack from spreading by discovering a "kill switch" - an internet address which halted the virus when activated.

Individual European countries and the United States saw infections at a rate of only 10 per cent to 20 per cent of the most affected countries, according to the researcher who stumbled on the "kill switch".

The virus hit computers running older versions of Microsoft Corp software that had not been recently updated. Microsoft released patches last month and on Friday to fix a vulnerability that allowed the worm to spread across networks. The company's shares were down about 1 per cent on Monday, in a slightly higher broad market.

Infected computers appear to be largely out-of-date devices. Some have also been machines involved in manufacturing or hospital functions, difficult to patch without disrupting operations.

The US Senate Intelligence Committee is monitoring the attack and expects to receive a briefing in the coming days from the Trump administration, a panel aide said.

Attack used NSA-devised tool

In a blog post on Sunday, Microsoft President Brad Smith confirmed what researchers had already widely concluded: the attack made use of a hacking tool built by the US National Security Agency that had leaked online in April.

He poured fuel on a long-running debate over how government intelligence services should balance their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - against sharing those flaws with technology companies to better secure the internet.

Russian President Vladimir Putin, noting the technology's link to the US spy service, said it should be "discussed immediately on a serious political level."

"Once they're let out of the lamp, genies of this kind, especially those created by intelligence services, can later do damage to their authors and creators," he said.

In Britain, where the virus first raised global alarm when it caused hospitals to divert ambulances on Friday, it gained traction as a political issue just weeks before a general election. The opposition Labour Party accused the Conservative government of leaving the National Health Service (NHS) vulnerable.

"The government's response has been chaotic," the British Labour Party's health spokesman Jon Ashworth said. "If you're not going to allow the NHS to invest in upgrading its IT, then you are going to leave hospitals wide open to this sort of attack."

Britain's NHS is the world's fifth-largest employer after the US and Chinese militaries, Wal-Mart Stores and McDonald's. The government says that under a previous Labour administration the trusts that run local hospitals were given responsibility to manage their own computer systems.

Asked if the government had ignored warnings over the NHS being at risk from cyber attack, Prime Minister Theresa May told Sky News: "No. It was clear (that) warnings were given to hospital trusts."

British health minister Jeremy Hunt said on Monday it was "encouraging" that a predicted second spike of attacks had not occurred, but the ransomware was a warning to public and private organisations.

Impact in Asia

China appeared over the weekend to have been particularly vulnerable, raising worries about how well the world's second-largest economy would cope. However, officials and security firms said the spread was starting to slow.

"The growth rate of infected institutions on Monday has slowed significantly compared to the previous two days," said Chinese Internet security company Qihoo 360.

An official from Cybersecurity Administration China (CAC) told local media on Monday the ransomware had affected industry and government computer systems but the spread was slowing.

Energy giant PetroChina said payment systems at some petrol stations were hit although it had restored most of the systems.

Elsewhere in Asia, Conglomerate Hitachi Ltd said the attack had affected its systems over the weekend, leaving them unable to receive and send emails or open attachments in some cases.

At Indonesia's biggest cancer hospital, Dharmais Hospital in Jakarta, attacks affected scores of computers. By late morning, some people were still manually filling out forms, but 70 per cent of systems were online.

India's government said it received only a few reports of attacks and urged those hit not to pay any ransom. No major Indian corporations reported disrupted operations.

Reuters