Ransomware Attacks and Cybersecurity

This assignment delves into the threat of ransomware attacks, examining the 2017 DocuSign breach as a case study. It analyzes how attackers exploited vulnerabilities, the consequences of the breach, and preventative measures against future incidents. Students will explore various aspects of cybersecurity, including attack methods, data protection strategies, and responsible disclosure practices.

Running head: INFORMATION SECURITY
Assignment
[Student Name Here]
[Institution’s Name Here]
[Professor’s Name Here]
[Date Here]

INFORMATION SECURITY 2
Table of Contents
Contents Page
Question 1...............................................................................................................................................3
The problem.........................................................................................................................................3
How and why it occurred.....................................................................................................................3
Why did the attack occur?...................................................................................................................4
Solution................................................................................................................................................5
Question 2...............................................................................................................................................6
The problem.........................................................................................................................................6
Who was affected and how?................................................................................................................6
Attack procedure..................................................................................................................................7
Solution (prevention)...........................................................................................................................8
References.............................................................................................................................................10

INFORMATION SECURITY 3
Question 1
DocuSign, a provider of electronic signatures was subject to a cyber-attack in May 2017. In
the attack, the intruders accessed one of the company’s system where they retrieved some
information owned by the customers. However, according to the organization, the customer’s
confidential information was unaffected by the attack (Daitch, 2017).
The problem
DocuSign offers customers the critical signature component of conducting business where
verification is needed. The company prides itself on having the most secure online system for
verifying business transactions. However, this attribute was tested when the said attack
happened. In the attack, intruders used a phishing malware that targeted the company’s
customers. Now, although the company’s analysis outlined a low-level intrusion, the attack
was troubling to many who saw it as an allowance to intruders attacks. According to Krebs
(2017), the main problem of the attack was the facilitation that the organization made to
intruders who were able to target users based on the functionalities of the systems used.
Furthermore, most of the users affected did not suspect the malicious components provided as
they regularly expected to click on different links served by DocuSign emails. Nevertheless,
the organization did promise to track the malicious content as provided by the phishing email
(DocuSign, 2017).
How and why it occurred
A technical analysis of the problem revealed the extent of attack which mainly focused on
the email addresses held by the company’s customers. In the attack, the intruder targeted
most of DocuSign customers by forwarding a series of phishing emails. These regularly sent
emails contained links that invited unsuspecting users to a word document that contained the
overall malicious code (malware). However, prior to the phishing attack that was conducted
by the customer, the organization had faced a temporary data breach that accessed the

INFORMATION SECURITY 4
information held the company’s servers/systems (Mathew, 2017). The system accessed was
hosted in a separate non-core infrastructure that was regularly used to communicate with the
customers. Therefore, two sequential attacks occurred, one on the communication system and
other on the users who were sent phishing malware. Nevertheless, the organization failed to
highlight how the first form of attack occurred and left experts to speculate on the course
which was outlined as user negligence.
Why did the attack occur?
Phishing attacks trick unsuspecting users to reveal their confidential information such as
identity numbers, financial data and transfer of funds. This process is conducted using replica
applications that disguise themselves as the legitimate systems used by the users. However, a
common trend uses electronic mail and messaging services to invite the victim to the
malicious system owned and regulated by the intruder (Chaudhry, Chaudhry, & Rittenhouse,
2016). Similarly, the attack conducted on DocuSign used a similar approach where the data
obtained from the company’s communication servers was used to send the invite links. In
most cases, this form of attack occurs because of user negligence as they blindly trust the
online process and activities. However, the attack at hand was carefully structured to have all
the credentials held by DocuSign including the official email. Therefore, the success of the
attack was caused by the initial breach that gave the intruders access to the communication
system
On the other hand, the communication system may have been breached using several
techniques most of which are inclined to the company’s negligence as it holds some of the
best security procedures. Therefore, DocuSign through its employees may have leaked access
information to the intruders who successfully accessed the communication system.
Furthermore, the same organization might also have been subject to a prior phishing attack
that led to the exposure of the access information. In all, the first form of attack occurred

INFORMATION SECURITY 5
because of user negligence (News, DocuSign users sent phishing emails after a data breach,
2017).
Solution
To outline the solution to the problem at hand, one must analyse the steps taken by this form
of attack. First, phishing attacks use three main elements to propagate their course; luring,
hooking and catching. In the first element or stage, the intruders lure the unsuspecting users
to the malicious systems, at this stage several security procedures can be used to protect the
user. The first should be user sensitization from either the host company (legitimate
organizations) or the security company employed by the user. Through this solution, the users
are recommended not to access any content sent by malicious websites or emails, the first line
of defence (Chaudhry, Chaudhry, & Rittenhouse, 2016). Secondly, the user should have in
place verifiable security firmware e.g. antivirus. Now, today’s anti-malware systems will
identify illicit applications based on their verification structures which will protect the user.
In the second element (stage), the hook function is conducted as the unsuspecting user is sent
to the malicious application where they surrender their information. In our case, DocuSign
had granted the intruders access to legitimate emails (communication system) which meant
most users trusted the link given thus were all at the hook stage. In this stage several solutions
exist, the first been access control be it either through access protocols or firewalls. These
security protocols would identify the illicit actions held by the malicious code thus deny
access to the link given. Finally, in the last stage, the user should not surrender his/her
information without verifying the connection or application, an outcome that can only be
guaranteed by using verified systems. In all, the main solution to phishing attacks is the
sensitization of the users who develop a keen eye for Software and services that invite them
to malicious systems (Kerbs, 2017).

INFORMATION SECURITY 6
Question 2
The problem
May 2017 saw one of the biggest cyber-attacks ever conducted, in the attack, a new version
of Ransonware infiltrated many systems in over 100 countries around the world. The
malware was initially thought to have originated from American systems, which were
accessed to release the new form of cyber weapon. Nevertheless, in spite gaining access in
many cyber systems around the world, England and Russia were the most hit countries as
they suffered the worst crisis in their computer systems. Furthermore, the same system also
gained significant traction into Spain’s cyber system where telecommunication, electrical and
natural gas facilities were affected (Wong & Solon, 2017).
Who was affected and how?
According to experts from Kaspersky labs (2017), at the start of the attack, more than 45, 000
intrusions had occurred in 99 countries. These countries included United Kingdom, Russia,
China and Egypt. The ransomware in question was known as WannaCry and it held
computers under ransom requesting money in exchange for user access. In England, the
National Health Service was greatly affected as employees were unable to access their
working stations. In their attack, NHS workers were demanded to pay $300 in Bit coin
amount in order to access their files. Consequently, medical activities were put on hold as
patients and practitioners could not access their records and in some instances were forced to
abandon serious medical procedures such as heart surgery (News, Massive ransomware
infection hits computers in 99 countries, 2017).
In other countries, such as Russia, the attacks had extended to almost all sectors of business
including banking, government ministries (health and interior) and state owned railway

INFORMATION SECURITY 7
companies. Moreover, the same attack had affected the countries second largest
telecommunication company which caused some minor setbacks. In addition to Russia, Spain
was largely affected in its private sector where companies such as Telefonica
(telecommunication) and Iberdrola (Power Company) were affected. In these firms, the
employees were directed to turn off their machines in an attempt to contain the attack
(Newman, 2017).
Attack procedure
In general, ransomware is a malicious program that gains access to user information and
threatens to publish them or block them until a ransom is paid. WannaCry executed its attack
the same way, however, unlike other ransomware attacks, its operation procedure was
impenetrable as it used NSA (National Security Agency) infiltration tools. To start with,
WannaCry used a recently discovered Windows vulnerability known as EternalBlue. This
vulnerability exploited the message blocks of Microsoft server 1.0 (SMB) which facilitates
sharing of files. In essence, the SMB acts as a networking protocol with the application layer
and allows computers to read and write files. Furthermore, the same protocol enables
computers to request services from any machine within their networks (Burgess, 2017).
Now, the vulnerability (EternalBlue) gave the intruders access to the ports used by SMB (port
445) which helped propagate the content they desired to the users within the attacked
networks. Now, the following procedure was used to spread WannaCry around the globe:
a. First, the EternalBlue vulnerability was triggered in the machines connected to
the networks. This action was done remotely using the SMB handshake.
b. Secondly, an encrypted program carrying the payload of the attack was loaded on
the respective machines. Now, the payload contained a starter or stager of the
malware itself.

INFORMATION SECURITY 8
c. Thirdly, the malware in the remote computer was launched which immediately
started scanning for any other existing connections. This scan was conducted on the
local networks of the remote machines and the internet in order to identify other
accessible SMB ports. In essence, this activity majorly facilitated the success of
WannaCry as it was able to replicate on its own in many different networks.
d. After accessing a different access port (unexposed i.e. not protected), the cycle
began again where the vulnerability was used to gain access completing the vicious
cycle.
NB: The attack conducted by WannaCry occurred very quickly that it was unstoppable once
it began, in fact, an entire local area network was penetrated in a few minutes (Islaim,
Oppenheim, & Thomas, 2017).
Now, the procedure identified above occurred throughout the globe using the internet as its
access medium. It accessed system in the UK, Russia and the rest in a similar fashion.
Solution (prevention)
Although WannaCry used the SMB vulnerability to access machines, it also depended on the
accessibility of network ports. These ports gave access to the intruders who delivered the
payload to the victim’s machines. Therefore, the first line of defence should have been
network protection where security procedures such as intrusion systems, firewalls and access
control would have been used. Now, firewalls would have isolated the user from the attack
which would have prevented the payload delivery. Similar actions would have been
conducted while using the access control which would have blocked off the access ports and
only grant access to the verified traffic (EMC, 2016). On the other hand, the intrusion
detection systems, either network or host would have kept an account of the attempts thus
notify the relevant parties.

INFORMATION SECURITY 9
In essence, isolating the network would have helped to contain the problem because only a
few machines within the unprotected network would have been affected. Now, network
isolation can be done using the security protocols identified above and also by disabling
application’s macro script as well as any other form of remote connection. Finally, as a
response, the organizations affected should have had adequate redundancy procedures in case
their systems were affected. This action would have facilitated the recovery of their files and
helped restore their operations to normalcy (Emling, 2017).

INFORMATION SECURITY 10
References
Burgess. (2017). Everything you need to know about EternalBlue – the NSA exploit linked to
Petya. Wired, Retrieved 24 August, 2017, from: http://www.wired.co.uk/article/what-
is-eternal-blue-exploit-vulnerability-patch.
Chaudhry, J., Chaudhry, S., & Rittenhouse, R. (2016). Phishing Attacks and Defenses.
International Journal of Security and Its Applications, Retrieved 24 August 2017,
from; http://www.sersc.org/journals/IJSIA/vol10_no1_2016/23.pdf.
DocuSign. (2017). Personal safeguard. Trust centre, Retrieved 24 August, 2017, from:
https://trust.docusign.com/en-us/personal-safeguards/.
EMC. (2016). Preventing a ransomware disastor. EMC, Retrieved 24 August, 2017, from:
https://www.google.com/url?
sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwiwgd
WRi_DVAhWIK8AKHdA9BKEQFggqMAA&url=https%3A%2F%2Fmozy.com
%2Fsystem%2Fresources
%2FW1siZiIsIjIwMTYvMDYvMjgvMTRfMTFfNDVfNjM1X2gxNTE3.
Emling, S. (2017). Ransomware Attack Wreaks Havoc Globally. AARP, Retrieved 24
August, 2017, from: http://www.aarp.org/money/scams-fraud/info-2017/how-to-
protect-against-ransomware-fd.html.
Islaim, A., Oppenheim, N., & Thomas, W. (2017). SMB Exploited: WannaCry Use of
"EternalBlue". Fire eye, Retrieved 24 August, 2017, from:
https://www.fireeye.com/blog/threat-research/2017/05/smb-exploited-wannacry-use-
of-eternalblue.html.
Kerbs. (2017). Breach at DocuSign Led to Targeted Email Malware Campaign. Retrieved 24
August, 2017, from: https://krebsonsecurity.com/2017/05/breach-at-docusign-led-to-
targeted-email-malware-campaign/.
Mathew, L. (2017). DocuSign Confirms Hack And The Stolen Data Could Put You At Risk.
Forbes cybersecurity, Retrieved 24 August, 2017, from:
https://www.forbes.com/sites/leemathews/2017/05/16/docusign-hack-phising-
emails/#5465d1216b76.
Newman, L. (2017). The biggest cybersecurity disastor of 2017 so far. Wired, Retrieved 24
August, 2017, from: https://www.wired.com/story/2017-biggest-hacks-so-far/.
News, B. (2017). DocuSign users sent phishing emails after data breach. Technology,
Retrieved 24 August, 2017, from: http://www.bbc.com/news/technology-39934832.

INFORMATION SECURITY 11
News, B. (2017). Massive ransomware infection hits computers in 99 countries. Technology,
REtrieved 24 August, 2017, from: http://www.bbc.com/news/technology-39901382.
Wong, J., & Solon, O. (2017). Massive ransomware cyber-attack hits nearly 100 countries
around the world . Cybercrime, Retrieved 24 August, 2017, from:
https://www.theguardian.com/technology/2017/may/12/global-cyber-attack-
ransomware-nsa-uk-nhs.