Hard-drive-scrambling ransomware menaced more than 2,000 systems at San Francisco’s public transit agency on Friday and demanded 100 bitcoins to unlock data, The Register has learned.
Ticket machines were shut down and passengers were allowed to ride the Muni light-rail system for free on Saturday ? a busy post-Thanksgiving shopping day for the city ? while IT workers scrambled to clean up the mess.
These systems appear to include office admin desktops, CAD workstations, email and print servers, employee laptops, payroll systems, SQL databases, lost and found property terminals, and station kiosk PCs. We told that the worm-like malware automatically attacked the agency’s network, and was able to reach the organization’s domain controller and compromise network-attached Windows systems. There are roughly 8,500 PCs, Macs and other boxes on the agency’s network.
After the vulnerable computers were infected and their storage scrambled, they were rebooted by the malware and, rather than start their operating system, they instead displayed the message: “You Hacked, ALL Data Encrypted, Contact For Key (email@example.com) ID:601.”
HDDCryptor and its cousins encrypt local hard drives and network-shared files using randomly generated keys and then overwrite the hard disks’ MBRs, where possible, to prevent systems from booting up properly. A machine is typically infected by an employee accidentally opening a booby-trapped executable in an email or download, and then the infection spreads out across the network.
When the 100-bitcoin ransom ? right now about $73k ? is paid, the crooks supposedly hand over a master decryption key to restore the ciphered drives and files. A bitcoin wallet into which the transit agency is expected to pay remains empty.
The extortionists behind the malware have complained that no one at the agency has so far spoken to them let alone offered to pay. The crooks said they will give Muni officials another day or so to get in touch before walking away. They also offered to decrypt one machine for one bitcoin to prove restoration is possible.
“Our software [is] working completely automatically and we don’t [launch] targeted attacks … SFMTA’s network was very open and 2,000 server/PCs [were] infected by software,” the ransomware’s masterminds claimed in a statement in broken English on Sunday via email. “So we are waiting for contact [from] any responsible person in SFMTA but I think they don’t want a deal. So we close this email [account] tomorrow.”
You’ve been hacked … Message left on a PC screen at a San Francisco Muni kiosk on Saturday (Photo by Colin Heilbut)
Buses and the underground-overground Muni rail system continue to run. The Muni’s turnstiles were left open from Friday night, though, allowing people to travel for free. Ticketing systems were halted with “out of service” messages in the wake of the infection.
“There?s no impact to the transit service, but we have opened the fare gates as a precaution to minimize customer impact,” the transit agency’s spokesman Paul Rose said on Saturday. “Because this is an ongoing investigation it would not be appropriate to provide additional details at this point.”
San Francisco’s public transit system joins the ranks of hospitals, businesses, police stations and other organizations hit by ransomware. Some cough up cash to the extortionists who spread the file-encrypting software nasties, some don’t. Meanwhile, Cisco-owned Talos has an open-source tool for protecting MBRs from ransomware and other malware. ?
Hat tip: Thanks to computer security researcher Mike Grover for his help with this article.
The state of mobile security maturity