The San Francisco Municipal Transportation Agency didn’t just get hacked. It got held for ransom.
In November, attackers took over a chunk of the agency’s network. By Thanksgiving Day, ticketing kiosks on the light rail went dark. Agency screens didn’t show error codes or maintenance notices. They displayed a chilling message: “You Hacked, ALL Data Encrypted. Contact For Key([email protected])ID:681 ,Enter.”
The demand was steep. 100 bitcoins. Roughly $73,000 at the time. Deadline? Tuesday.
It sounds like a headline from a dystopian novel. Yet, the most striking thing about the SFMTA breach isn’t the chaos. It’s how inevitable it feels. We treat these incidents as anomalies. They aren’t. They are the new baseline for digital security.
Зміст
The Ransomware Economy
Ransomware has graduated from a nuisance to a primary revenue stream for cybercriminals. Andrew Howard, CTO at Kudelski Security, puts it bluntly: attackers have promoted this technique from one of many options to one of the most effective tools in their toolbox.
Why the shift?
Other malware still exists. Trojans. Spyware. But they lack the direct financial payoff. Ransomware changes the game by removing the middleman.
Joe Opacki, VP of threat research at PhishLabs, notes the simplicity. “Instead of having to steal data and sell it or rent out botnets… ransomware offers direct payment.”
Infect the machine. Lock the files. Ask for cash. No data laundering. No black-market dealers. Just a direct transaction, usually in Bitcoin or MoneyPak, which are harder to trace than physical currency.
The volume is staggering. U.S. Homeland Security estimated an average of 4,000 ransomware attacks per day in 2016. That’s a 300 percent jump from the previous year.
Who Pays?
You might think corporations are the main target. They are. But home users are disproportionately affected.
A 2016 study by Kaspersky Labs found that of the 2.3 million users who encountered ransomware between April 2015 and March 2016, almost 87 percent were at home. The ransoms? Often just a few hundred dollars.
The total proceeds for the first three months of 2016 alone were estimated at $209 million. We don’t know exactly how many individuals paid up. But when the cost of recovery is zero if you pay, and high if you don’t, the math works for the attacker.
On a larger scale, the impact is physical. In February 2016, Hollywood Presbyterian Medical Center in Los Angeles held out for nearly two weeks before paying 40 bitcoins (about $17,000) to unlock its systems.
They didn’t lose patient records. The hackers never accessed them. But staff were forced to fill out forms and update records with pencil and paper for 13 days. Care slowed. Confusion grew. The hospital paid to get back to normal.
Why Defenses Fail
Nolen Scaife, a doctoral student at the University of Florida, describes ransomware as a “tough adversary.”
Defending against it is difficult. Each attack varies slightly. It looks like normal system administration activity until it’s too late. Encryption happens fast.
Scaife’s team developed CryptoDrop, a detection program designed to spot the encryption process and stop it. The goal is simple: the less data the malware encrypts, the faster you can restore from a backup.
But reversing the encryption? That’s nearly impossible with modern crypto.
“The reliability of good cryptography done properly and the rise of cryptocurrency have created a perfect storm for ransomware,” Scaife writes. If the ransomware is well-designed and you have no backups, paying is often the only way to get your files back.
This isn’t a new concept. The AIDS Trojan of 1989 used infected floppy disks mailed via snail mail. It encrypted a PC’s root directory. It was defeated quickly. But decades of refinement have made the delivery mechanisms invisible and the encryption unbreakable.
The Perfect Victim
Hospitals are ideal targets. Jérôme Segura, a security expert, told CBC News that their systems are often outdated, they hold confidential data, and they cannot afford downtime. If patient files lock up, they can’t just ignore it.
Law enforcement is no safer. In 2015, five Maine police departments fell victim to ransomware. At least one was running DOS, an obsolete operating system.
Police departments are popular targets. And they pay.
One New Hampshire police chief had a moment of brilliance. He paid the ransom, got the key, and cancelled the payment. When his department was hit again two days later, he didn’t try the trick. He just forked over the $500.
The irony is lost on no one. The institutions tasked with enforcing laws are outsourcing their security to criminals.
We are left with a system where encryption is weaponized against those who need it most. The SFMTA hack wasn’t an outlier. It was a preview. And we are still waiting for the rest of the country to catch up.
The Human Element Is the Weakest Link
Back in early 2016, the financial toll of ransomware was already mounting. A South Carolina school district wrote an $8,500 check in February. The University of Calgary dropped $16,000 in June, citing the need to protect world-class research stored on their networks. By November, just weeks before the San Francisco Municipal Transportation Agency (SFMTA) hack, an Indiana county paid $21,000 to unlock systems for its police and fire departments.
The SFMTA incident looked different. Reports suggest the ransomware launched from within. According to researcher Opacki, the attacker exploited a known vulnerability in Oracle’s WebLogic software. They were likely scanning the internet for this specific flaw and stumbled upon SFMTA’s system by chance.
But most attacks don’t rely on software bugs. The vulnerability is usually in people.
Opacki notes that we consistently overestimate our ability to spot a phishing scam. A 2016 study showed 30% of people open phishing emails, with 13% clicking the malicious link or attachment. Many still assume phishing emails are poorly designed spam with broken English. They fall for “employee payroll” spreadsheets sent by supposed HR staff. Phishing has evolved past Nigerian princes. Emails are now personalized, using real details scraped from social media.
Andrew Howard of Kudelski Group says that even in highly security-conscious organizations, 3% to 5% of employees fall for poorly constructed scams. In less guarded environments, the failure rate is much higher.
“It is rather disheartening,” he admits.
Hacking for Idiots
The rise in ransomware isn’t just about gullibility or sophisticated malware. It’s about ease. Running a ransomware scam is as complex as mugging someone on the street, but with far less risk.
Nolen Scaife argues that hackers don’t need much skill. The software isn’t sophisticated. It’s quick to create and deploy. More importantly, hackers don’t need to build it themselves. They buy it on the dark web.
Malware marketplaces sell countless variants. These often come as all-in-one apps. Sellers provide customer service and tech support to help inexperienced operators run scams smoothly. Dan Turkel of Business Insider highlights this support system. Some products even offer money-back guarantees. Many include call-in or email services to guide victims through payments. At least one ransomware family offers live chat customer service.
Developers even use distributors to sell their products. The market is robust.
This doesn’t bode well for anyone running the scam. Cybersecurity experts agree on one solution: back up your data. Without backups, paying the ransom might be the only way to recover your files.
Even then, you might not get your data back. A Trend Micro study found that 20% of UK businesses that paid ransoms in 2016 never received a decryption key.
SFMTA didn’t pay. A spokesperson told Fortune the agency never considered it. Systems were restored from backups. Most were back online within two days. San Franciscans rode the light rail for free during that time.
Two days later, hackers hacked the light-rail hacker’s email account. This revealed an estimated $100,000 in ransomware payments since August.
Now That’s Convenient
Some ransomware hackers accept Amazon gift cards.
