Hacking used to be restricted to sci-fi stories, or those told by early computer nerds who reckoned they had ‘hacked’ the FBI, or their local library. The threat level was a lot lower back when the internet was taking its first few baby steps, but over the last few years hacking has become a very serious and distressing threat that is attracting huge investment. It’s estimated that companies are losing up to $468 billion per year to hackers, and it has even driven the UK government to amend the data protection act to make cyber security its number one priority.
So what happened in 2017? Well, it was a total whirlwind of panic if you’re a data owner. Not only did we have the standard business ransoms that contributed to the billion-dollar figure above, but also attacks on public services and even governments. Almost the entire year was dominated by alleged hacking not only by individuals and criminal groups, but also allegedly by governments. Here are the five biggest and most devastating attacks of the year, so you can begin to get an idea about just how big a business hacking has become.
Wannacry
If you’ve ever experienced an instance of ransomware popping up on your PC or mobile device, it can make your heart skip a few beats until you realise that the police, intelligence agencies or local government don’t really want to charge you several hundred pounds to be able to gain access to your files again after scrutiny. ransomware is a nasty piece of software that freezes or disables computers, with the hacker demanding cash or pretty much anything else in exchange for things to go back the way they were. Now imagine a gigantic proportion of computers around the world, including those in the National Health Service, all of a sudden demanding money otherwise files would be deleted.
WannaCry’s powerful design allowed it to spread almost globally, with a threatening message backed up by complete freezing of the PC in question. Although a solution was found fairly quickly, thanks to a built-in kill switch mechanism exploited by security experts, the unknown crooks behind the WannaCry attack still managed to get away with 52 Bitcoins, or around $130,000 at the time. US officials announced with ‘moderate confidence’ that the attack originated from North Korea.
Goldeneye / Petya / NotPetya / various other names
In June, around a month after the WannaCry debacle, another ransomware attack hit private companies across the globe in the same way. Affecting computers at companies like US pharmaceutical giants Merck and Danish shipping company Maersk, users were once again denied access to files and told to send Bitcoins to encrypted addresses. Although the cyberattack’s perpetrators are still unknown, it’s reckoned that the hit was actually a masked attack on Ukrainian infrastructure, not the first time a cyber attack has been aimed at the country by ‘unkown entities’ (*cough* Russia.)
Macron Campaign hack
During the French presidential election in May, now leader Emmanuel Macron’s office was hacked just two days before voters went to the polls. Some 9GB of leaked emails were dumped on the web for all to see, a seeming coincidence that private emails were hacked and released at the time that would give the left-leaning frontrunner as little time to respond as possible. The En Marche! Party were quick to announce the breach and that nothing in the data dump should be viewed as legitimate, but it will have definitely caused several hours of stress at Macron HQ.
Funnily enough, it isn’t the first time that a political candidate has been targeted with a data breach to try and gain leverage. Democratic candidate Hillary Clinton also faced a similar problem with leaked emails, and opponent Donald Trump was quick to jump on the fact that she shouldn’t have been storing government emails on a private server, the piece of technology that was targeted. Macron likely had an advantage after watching the same trick unfold a year or so earlier, likely contributing to his eventual success rather than a tearing apart at the polls over questionable digital correspondence.
Shadow Brokers
First appearing in August 2016, The Shadow Brokers claimed that they had managed to get hold of NSA data and were looking to get auction off even more sensitive information, releasing chunks on Halloween and Black Friday 2016. It was April 2017 when the group managed their cyberattack breakthrough however,
They again announced that they had gained access to NSA tools, including EternalBlue, a Windows exploit that allows hackers to control computers and mine sensitive data, as well as transfer ransomware and Spyware such as WannaCry. In fact, it was Shadow Brokers who enabled the WannaCry attack to happen, with a large proportion of PCs under their umbrella then hit by WannaCry. Although Shadow Brokers are engaging in criminal acts, it highlights the importance of how secure these tools need to be kept, with intelligence-gathering in commercial products still a sore subject. As we’ll see below.
Wikileaks target the CIA
Even the organisation famous for intelligence gathering, hacking and exploiting data wasn’t safe in 2017. The ongoing Wikileaks campaign against hidden information continued to share its knowledge with the world, this time publishing almost 9,000 documents, labelled Vault 7, procured from the CIA that covered spying operations and hacking tools. Some of the choice revelations included iOS and Android vulnerabilities, as well as bugs in TVs that could turn them into listening devices.
There have been further, smaller disclosures throughout the year, such as tracking using Wi-Fi and surveilling Macs using some of the same exploits that left the Apple products open to security breaches later that year, but it again highlights just how Big Brother things are getting on the internet. The Wikileaks dump points towards an arsenal of malware, trojans, viruses, ransomware and weaponised exploits ready to be used on governments, but are being hijacked and turned on both the public and private companies.
These cryber attacks caused a lot of chaos, wasted time and of course wasted money in 2017, but 2018 could be even more devastating. We’re already discussing the ease of cutting undersea cables, a low-tech way of disabling entire nations, and we’ve already heard about new attacks on companies like Carphone Warehouse who suffered data breaches as far back as 2015. There’s a new battleground, and it will only get tougher to police as we train more people to become tech geniuses.