WannaCry & ATMs

WannaCry & ATMs:

Ransomeware has created havoc in the market .Every news channel, news paper almost everyone spoke about it. But worst part of it was, most of the information received through TV channels, print media were misleading .  In fact it was added to panic, as if nothing like this existed before in the cyber security world. 

WannaCry (ransomeware) exploited one of the available vulnerability in the Windows OS i.e., through SMB (port 445 and 139).  Let me don`t get into its technical details and confuse further like others. In fact what made me to write this blog is, hardly any news paper or news channels, gave information to user which can help to stay them protected from wannaCry or similar attacks to common people. Moreover what surprised me is, when I heard that even some of ATMs were shutdown because of this worm.  It was an utter shock to me. Lets understand how this wannaCry works in simplest possible manner. 

SMB protocol is used to share the files over network which runs on port 443 and 139 and in Windows this is default service, hence these ports are always open. So, for LAN users this is open gate always (with some user level authentication as security measure)   and wannaCry penetrates through this door in your PC (!@#$#@#$#@ with some known vulnerability in handshake ) . 

Let me equate with the real time example for non-techies: 

In your house you have multiple rooms, and you need to communicate across rooms frequently hence you have kept the door open all the time within rooms, since you consider this as internal matter within your house, you find its okay to keep these doors open connecting to each room.  But what happens if some outsider gains access to your home somehow (pretending something), he will be still able to use this open door to do anything.

                       Here wannaCry is an outsider, opened doors are same as port 443 and 139, and your home is same as the internal network or LAN and each rooms within home are like Laptops and PCs. 

What can be the lay man solution to this, about someone who is making use of this open door facility within a house upon someone somehow entering in the house? 

1. Try prohibit this person entering in house (which is difficult, as you can be just careful but can’t be annoying to every guest by suspecting them). 

2.  Put a lock on these doors till this guy is caught. 

Similarly users can do following to stay protected. 

1. Apply a firewall rule in PC to block these ports till you upgrade with security patch or apply the same in immediate router.  , this same as putting lock on doors till thief is caught. 

2. Install Linux OS, access windows File system through it (If you want to continue using internet and still stay unaffected confidently) in that case you can confidently ignore this ransomeware.
Opting Linux is like there is FREE option to move into your home in high security zone anyway where possibility of such event is very very rare. As Linux has default infra structure to prohibit, monitor or repair such things etc. etc.. 

And above remedies are ordinary, and even a fresh security engineer knows about it. 

Let me come to ATMs now. 

1. Most of ATMs which are deployed are white labelled licenses ( which means these are general products and can be labelled anything like SBI, HDFC etc.. ) it means underlying software is same in every ATM. Hence it mean problem in one ATM machine, then it exists in every other ATM machines.  

2. This is Bizarre now, most of ATM runs Windows OS with no security patch updates, which makes it more unsecure than our Home PC, and on the other hand we have Linux Operating System. 

   a. Which is open Source (Free License). 

   b. More stable, robust and secure.

Hence choosing/demanding Linux OS based ATM is matter of basic understanding and low cost too.

Its known fact that most of us, generally don’t consider cyber security at priority while choosing software (as we think we need security only for commercial transactions, lol), that’s the reason our evaluation criteria doesn’t involve most important aspects besides Functionality, while choosing a software product for our business. Hence besides functionality following considerations are important. 

1. Security 

2. Robustness 

3. Scalability 

4. Performance. 

5. Extendibility.

As every Software company can provide given functionality someway, it’s important also to consider above aspects at the same time.

What we learn from this episode? (While choosing software for your business):

1. Choose Linux based server side technologies (which makes it more secure, robust and less cost) and also legally safe and lowers the cost.

2. Try to consider closed system if possible.  Which is not exposed to wider audience unnecessarily?

3. Ask Questions about network protocols used, and see if those protocols have history or have possibility of threats, and see if alternate is possible for your application.

4. Find out how robust, scalable and performance oriented designed software system is!!!

Why it’s important to consider above points?

1.       Either way your data is important to you. It might be of any type, You definitely don’t want any ransomware to encrypt and ask ransom money to decrypt the same.

2.        Threat is not only ransomeware this is a very small example of number of threats/attacks or worms exists.  It just doesn’t makes sense to ignore it.  So don’t take a chance.  

Finally Security consideration is necessary if you don’t; worms like ramsomeware will force you to do that….