Comment: The WannaCry attack should be a wake-up call for consumers, businesses and governments

The WannaCry ransomware attack may have been exploiting a vulnerability in Windows, but the lesson it provides – the importance of keeping both computers and mobile devices updated – is one applicable to all of us, Apple users included.

WannaCry itself targeted a vulnerability that had existed in Windows all the way through from XP to the latest Windows 10. Microsoft issued a patch to fix the issue for Windows Vista onwards back in March, but many organizations failed to update.

The scale of the attack – which caused widespread disruption around the world – should be a wake-up call to consumers, businesses and governments alike …

For consumers and businesses, it needs to be a reminder of the importance of keeping operating systems updated – and all data backed-up more than once. Windows may be the primary target, but Mac malware is growing – which includes ransomware.

McAfee said recently that Mac malware grew 744% last year. Most of it was adware, which is an irritation rather than a threat to data, but not all of it.

In January, we saw an attack which hijacks Safari and the Apple Mail app to cause Macs to crash and a separate attack that captures screenshots from them. In February, a Word macro specifically aimed at Macs allowed arbitrary code execution capable of anything from keylogging to webcam captures. In April, a fake macOS update allowed an attacker to spy on all Internet usage, including secure websites. In May, malware disguised as a Flash updater made its way from Windows to Mac, and a Handbrake mirror got hacked to allow a malicious version to be installed.

In case you thought I’d forgotten to include something from March, that was a doozy. That was when we learned from Wikileaks that the CIA has a hacking unit devoted to iOS malware and has lost control of most of it. Indeed, governments are probably the biggest customer for zero-day exploits, and have the biggest teams working on discovering new ones. The WannaCry attack itself uses an exploit developed by the NSA.

And this is the lesson that needs to be learned by governments. If you develop, buy and stockpile zero-day exploits, it’s only a matter of time before they leak. Tools intended to be used by governments – whether or not that’s an activity you support – will sooner or later be used by criminals.

And that is why – as I’ve argued on several different occasions – Apple was absolutely right to resist the FBI’s request for it to develop a weaker form of iOS designed to allow law enforcement agencies to access iPhones. And why Apple should continue to resist any future attempts to pressure it into doing so.

Photo: NBC