Hackers have managed to infect and take over more than 2,000 computers used to operate San Francisco’s public transport system, forcing the Municipal Transportation Agency (MTA) to open the gates and allow passengers to ride for nothing.
The attackers used a variant of the HDDCryptor malware to infect 2,112 computers on Friday, encrypting their data and preventing them from operating normally – holding them to ransom for 100 bitcoin (£58,514, $73,086), according to the Register,.
Every computer was left displaying a black screen with a ransom note written across it stating: “You Hacked, ALL Data Encrypted. Contact For Key ([email protected])ID:681, Enter.”A San Francisco MTA spokesperson declined to comment beyond saying: “There’s no impact to the transit service, but we have opened the fare gates as a precaution to minimise customer impact.”
The MTA’s operational and worker machines were affected, disrupting email, payment services, but not core operations, which allowed trains to continue running without payment.
The hackers said in a statement given to the Verge on Sunday: “We don’t attention to interview and propagate news ! our software working completely automatically and we don’t have targeted attack to anywhere ! SFMTA network was Very Open and 2000 Server/PC infected by software ! so we are waiting for contact any responsible person in SFMTA but i think they don’t want deal ! so we close this email tomorrow!”
Ransomware infects a computer and encrypts all the data on its storage drives while spreading to any other vulnerable computer connected to it. It typically starts when someone opens an infected email attachment or downloaded file, spreading through any computer networks.
Once the data is encrypted the user is locked out of the computer and a ransom note is displayed promising to decrypt and release the data in exchange for money.
The SFMTA is not the first public sector institution or company to be hit by ransomware. The Hollywood Presbyterian Medical Centre in Los Angeles was attacked in February forcing it to return to paper charts and fax machines.
In 2013 the Cryptolocker ransomware infected an estimated 234,000 computers, including at least 50,000 in the UK, and required a global police operation to neutralise it.
[Source:-TECH GUARDIAN]