Riders of San Francisco’s metro system (SFMTA) were treated to free rides this weekend. But what appeared to be a pleasant holiday surprise, was actually the result of a nasty ransomware infection affecting the train\u2019s ticketing computers, which left no option but to allow free rides while the computer systems were down.<\/p>\n
Ransomware has been making headlines for the last few years. It is a type of malware that encrypts files on the infected computer, blocking access to them unless the user pays a ransom in bitcoin (or other untraceable methods). Ransomware has been so effective because it employs social engineering – the term given to attacks which rely on manipulating people – often spreading through phishing emails and documents claiming to be official invoices or bills.<\/p>\n
The full extent of the damage to the SFMTA is unclear, but reporting from SF Examiner<\/a> indicates that the ransomware is throughout its systems. Photographs <\/a>of station agent computers show they were infected, and on Sunday, drivers were being assigned routes \u201cvia handwritten notes posted to bulletin boards, as opposed to the usual computer printouts.\u201d Sources told KPIX 5<\/a> that computers handling payroll may also be affected, which could delay employees\u2019 paychecks.<\/p>\n Affected computers displayed the message:<\/p>\n \u201cYou Hacked, ALL Data Encrypted. Contact For Key(cryptom27@yandex.com<\/a>)ID:681 , Enter Key: \u00a0\u00a0Missing operating system.\u201d<\/p><\/blockquote>\n The San Francisco ransomware, believed to be a strain of HDDCryptor<\/a>, encrypts the MBR (Master Boot Record) of the computer, a system-critical function, without which, a computer is unable to start properly.<\/p>\n Hoodline.com<\/a> and The Verge<\/a> contacted the email address listed in the message. The attacker, going by the name \u2018Andy Saolis,\u2019\u00a0said:<\/p>\n \u201cWe do this for money, nothing else ! i hope it\u2019s help [sic] to company to make secure IT before we coming !\u201d<\/p><\/blockquote>\n The exact method of infection is not known, but it looks like it was one of the usual vectors of ransomware, which is usually delivered via phishing sites or emails. A list of infected computers obtained by CSO Online<\/a> suggests that a staff member\u2019s computer may have been the original entry point.<\/p>\n We do know that the SFMTA was not specifically targeted. Saolis wrote:<\/p>\n \u201cOur software working completely automatically and we don’t have targeted attack to anywhere! SFMTA network was Very Open and 2000 Server\/PC infected by software!\u201d<\/p><\/blockquote>\n To remove the ransomware and restore functionality, Saolis is demanding a ransom of 100 bitcoin, which is currently worth<\/a> approximately $73,000 USD. In exchange for that ransom, decryption keys are provided that can automatically un-encrypt the computers and return them back to normal.<\/p>\n According to Saolis, 2,112 of the 8,656 computers in the Municipal Transportation Agencies\u2019 network are infected. Though as of Sunday night, the ticketing machines were functioning again, which suggests that SFMTA may be solving the problem on its own.<\/p>\n If an organization has proper measures in place (most importantly, backups), it can avoid paying the ransom and restore the computers on their own with little to no data loss. Ransomware distributors often impose a deadline to force victims into action.<\/p>\n