San Francisco public transport system hack demonstrates how malware affects the real world

The ticket system of the The San Francisco Municipal Transportation Agency was compromised by ransomware, which forced the authorities to offer free tickets on some routes. The attack demonstrates two critical vulnerabilities in modern systems. One is that ransomware is a particularly vicious kind of malware that is dangerous to organisations. The second is the possibility of cyber threats leaking out of cyberspace, into the realm of the tangible, and affecting people and organisations in meatspace. Ransomware works by compromising the system and encrypting all the data on it. Affected users or companies have to transfer funds to the attackers, usually in the form of bitcoin, to get a key that would allow them to access their data again. Global losses because of ransomware attacks have crossed hundreds of millions of dollars, leading Symantec to classify ransomware as the most dangerous kind of malware . Due to outdated machines and unpatched systems, Indian companies and organisations are especially vulnerable to malware attacks. Over 180 Indian companies were attacked by ransomware in the first six months of 2016. Over one third of the attacks in the APAC region, in the third quarter of 2016, occurred in India . Hackers from Pakistan targeted 50 IT companies in Hyderabad in a ransomware campaign. Apart from companies, high value individual targets are gamers , who have saved games on their systems. In May this year, the Maharashtra State IT department, prevented the spreading of an image based ransomware known as Locky. The malware had got into the network through an email, and was encrypting files on a machine, when it was stopped in its tracks. The computers were isolated and sent for forensic testing . Just this month, a unique vector for spreading of Locky came to light because of the efforts by Check Point . Locky is spreading through disguised image files on Facebook and LinedIn. The real-world repercussions only increase with affects on IoT capable devices. The compromised devices are used to launch DDoS attacks. The problem is aggravated by the use of common passwords, and not changing the password from the default one. Based on the IP locations, more than half of the IoT attacks originate int the US and China.  The spate of cyber attacks have pushed IoT manufacturers to increase the security measures of their offerings .