Workstations, servers, ticket machines derailed by malware
Hard-drive-scrambling ransomware infected more than 2,000 systems at San Francisco’s public transit agency on Friday and demanded 100 bitcoins to unlock data, The Register has learned.
Ticket machines were shut down and passengers were allowed to ride the Muni light-rail system for free on Saturday – a busy post-Thanksgiving shopping day for the city – while IT workers scrambled to clean up the mess.
A variant of the HDDCryptor malware hit 2,112 computers within the San Francisco Municipal Transportation Agency, according to correspondence with the ransomware’s masters seen by El Reg.
These systems appear to include office admin desktops, CAD workstations, email and print servers, employee laptops, payroll systems, SQL databases, lost and found property terminals, and station kiosk PCs.
It appears the malware was able to reach the agency’s domain controller and compromise network-attached Windows systems.
There are roughly 8,500 PCs, Macs and other boxes on the agency’s network.
After the vulnerable computers were infected and their storage scrambled, they were rebooted by malware and, rather than start their operating system, they instead displayed the message: “You Hacked, ALL Data Encrypted, Contact For Key (email@example.com) ID:601.”
HDDCryptor and its cousins encrypt local hard drives and network-shared files using randomly generated keys and then overwrite the hard disks’ MBRs, where possible, to prevent systems from booting up properly.
A machine is typically infected by an employee accidentally opening a booby-trapped executable in an email or download, and then the infection spreads out across the network.
When the 100 bitcoin ransom – right now about $73k – is paid, the crooks supposedly hand over the decryption keys to restore the ciphered drives and files.
A bitcoin wallet into which the transit agency is expected to pay remains empty.
You’ve been hacked … Message left on a PC screen at a San Francisco Muni kiosk on Saturday (Photo by Colin Heilbut)
Buses and the underground-overground Muni rail system continue to run.
The Muni’s turnstiles were left open from Friday night, though, allowing people to travel for free.
Ticketing systems were halted with “out of service” messages in the wake of the infection.
“There’s no impact to the transit service, but we have opened the fare gates as a precaution to minimize customer impact,” the transit agency’s spokesman Paul Rose said on Saturday. “Because this is an ongoing investigation it would not be appropriate to provide additional details at this point.”
San Francisco’s public transit system joins the ranks of hospitals, businesses, police stations and other organizations hit by ransomware.
Some cough up cash to the extortionists who spread the file-encrypting software nasties, some don’t. Meanwhile, Cisco-owned Talos has an open-source tool for protecting MBRs from ransomware and other malware. ®
Hat tip: Thanks to computer security researcher Mike Grover for his help with this article.
Sponsored: Customer Identity and Access Management