Technology News

NEW YORK (AP) — Amazon founder Jeff Bezos stepped down as CEO on Monday, handing over the reins as the company navigates the challenges of a world fighting to emerge from the coronavirus pandemic.

Andy Jassy, who ran Amazon’s cloud-computing business, replaced Bezos, a change the company announced in February.

Bezos, Amazon’s biggest shareholder with a stake worth about $180 billion, will still hold sway over the company he started out of his Seattle garage in 1995. He takes over the role of executive chair, with plans to focus on new products and initiatives.

Jassy takes the helm of a $1.7 trillion company that benefited greatly from the pandemic, more than tripling its profits in the first quarter of 2021 and posting record revenue as customers grew ever more dependent on online shopping.

At the same time, Amazon faces activism from a restive workforce just as a rapid economic recovery causes a labor crunch that has retailers, manufacturers and other companies competing for workers with higher wages and other benefits. The company defeated an attempt by workers to unionize at an Alabama warehouse earlier this year, but faces a more formidable challenge as the International Brotherhood of Teamsters launches a broader effort to unionize Amazon workers.

In a blog post to employees earlier this year, Bezos said he planned to devote more time to side projects, including his space exploration company Blue Origin, his philanthropic initiatives and overseeing The Washington Post, which he owns.

First up, the richest man in the world by Forbes’ estimate will fulfill his childhood dream of traveling to space. Bezos, 57, will blast into space on July 20 when Blue Origin makes it first flight with a crew, bringing along his younger brother Mark, an investor and volunteer firefighter.

Bezos founded Amazon as an online bookstore and built it into a shopping and entertainment empire that is the second-largest private employer in the U.S., behind Walmart. Amazon, which is buying the MGM movie studio in its latest major acquisition, now makes movies and sofas, owns a grocery chain and has plans to send satellites into space to beam internet service to Earth.

Jassy, who has been with Amazon since 1997, ran the cloud-computing business that powers video-streaming site Netflix and many other companies, making it one of Amazon’s most profitable businesses.

Among Jassy’s challenges are growing calls for tighter regulation on tech giants. A report by the House Judiciary Committee in October called for possibly breaking up Amazon and others, making it harder for them to acquire companies and imposing new rules to safeguard competition.

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.

BOSTON (AP) — The single biggest ransomware attack yet continued to bite Monday as more details emerged on how a Russia-linked gang breached the exploited software company. The criminals essentially used a tool that helps protect against malware to spread it globally.

Thousands of organizations — largely firms that remotely manage the IT infrastructure of others — were infected in at least 17 countries in Friday’s assault. Kaseya, whose product was exploited, said Monday that they include several just returning to work.

Because the attack by the notorious REvil gang came just as a long Fourth of July weekend began, many more victims were expected to learn their fate when they return to the office Tuesday.

REvil is best known for extorting $11 million from the meat processor JBS last month. Security researchers said its ability to evade anti-malware safeguards in this attack and its apparent exploitation of a previous unknown vulnerability on Kaseya servers reflect the growing financial muscle of REvil and a few dozen other top ransomware gangs whose success helps them afford the best digital burglary wares. Such criminals infiltrate networks and paralyze them by scrambling data, extorting their victims.

REvil was seeking $5 million payouts from the so-called managed service providers that were its principal downstream targets in this attack, apparently demanding much less — just $45,000 — from their afflicted customers.

But late Sunday, it offered on its dark web site to make available a universal decryptor that would unscramble all affected machines if it’s paid $70 million in cryptocurrency. Some researchers considered the offer a PR stunt, while others thought it indicates the criminals have more victims than they can manage.

Sweden may be hardest hit — or at least most transparent about the damage. Its defense minister, Peter Hultqvist, bemoaned in a TV interview “how fragile the system is when it comes to IT security.” Most of the Swedish grocery chain Coop’s 800 stores were closed for a third day, their cash registers crippled. A Swedish pharmacy chain, gas station chain, the state railway and public broadcaster SVT also were hit.

A wide array of businesses and public agencies were affected, including in financial services and travel, but few large companies were hit, the cybersecurity firm Sophos said. The United Kingdom, South Africa, Canada, Argentina, Mexico, Indonesia, New Zealand and Kenya were among countries affected, researchers said.

In a statement Sunday, deputy U.S. national security adviser Anne Neuberger urged all victims to alert the FBI. A day earlier, the FBI said in an alert that the attack’s scale “may make it so that we are unable to respond to each victim individually.”

The vast majority of ransomware victims are loathe to publicly admit it, and many avoid reporting attacks to law enforcement or disclosing if they pay ransoms unless required by law.

President Joe Biden said Saturday that he ordered a “deep dive” by U.S. intelligence into the attack and that the U.S. would respond if it determines the Kremlin is involved. In Geneva last month, Biden sought to pressure Russian President Vladimir Putin to end safe haven for REvil and other ransomware gangs that operate with impunity in Russia and allied states as long as they avoid domestic targets. The syndicates’ extortionary attacks have worsened in the past year.

On Monday, Putin spokesman Dmitry Peskov was asked if Russia was aware of the attack or had looked into it. He said no but suggested it could be discussed during U.S.-Russian consultations on cybersecurity issues. No date has been set for such consultations, and few analysts expect the Kremlin to crack down on a crime wave that benefits Putin’s strategic objectives of destabilizing the West.

Kaseya said Monday that fewer than 70 of its 37,000 customers were affected, though most were managed service providers with multiple downstream customers. Most managed service providers were apt to know by Monday if they were hit but that may not be true for many of the small and medium-sized organizations they serve, said Ross McKerchar, chief information security officer at Sophos. The MSPs are flying blind because the very software tool they use to monitor customer networks was knocked out by the attack.

The hacked Kaseya tool, VSA, remotely maintains customer networks, automating security and other software updates.

In a Monday report on the attack, Sophos said a VSA server was breached with the apparent use of a “zero day,” the industry term for a previously unknown software security hole. Like other cybersecurity firms, it faulted Kaseya for aiding the attackers by asking customers not to monitor its on-premise “working” folders for malware. From inside those folders, REvil’s code could work undetected to disable the malware- and ransomware-flagging tools of Microsoft’s Defender program.

Sophos said REvil made no attempt to steal data in this attack. Ransomware gangs usually do that before activating ransomware so they can threaten to dump it online unless they are paid. This attack was apparently bare bones, only scrambling data.

In a Sunday interview, Kaseya CEO Fred Voccola would not confirm the use of a zero day or offer details of the breach — except to say that it was not phishing and that he was confident that when an investigation by the cybersecurity firm is complete, it would show that not just Kaseya but third-party software were breached by the attackers.

___

Associated Press reporters Jim Heintz in Moscow and Jan Olsen in Stockholm contributed to this report.

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.

Another holiday weekend in the U.S., another ransomware attack that has paralyzed businesses around the world.

This time it’s affecting an untold number of small and big companies that use IT software from a company called Kaseya.

High-profile ransomware attacks in May hit the world’s largest meat-packing company and the biggest U.S. fuel pipeline, underscoring how gangs of extortionist hackers can disrupt the economy and put lives and livelihoods at risk.

WHAT IS RANSOMWARE? HOW DOES IT WORK?

Ransomware scrambles the target organization’s data with encryption. The criminals leave instructions on infected computers for negotiating ransom payments. Once paid, they provide decryption keys for unlocking those files.

Ransomware crooks have also expanded into data-theft blackmail. Before triggering encryption, they sometimes quietly copy sensitive files and threaten to post them publicly unless they get their ransom payments.

WHAT’S A SUPPLY-CHAIN ATTACK?

The latest attack affecting Kaseya customers combines a ransomware operation with what’s known as a supply-chain attack, which typically involves sneaking malicious code into a software update automatically pushed out to thousands of organizations.

Kaseya says the ransomware affected its product for remotely monitoring networks; but because many of its clients are providers of broader IT management services, a large number of organizations is likely to be affected.

“What makes this attack stand out is the trickle-down effect, from the managed service provider to the small business,” said John Hammond of the security firm Huntress Labs. “Kaseya handles large enterprise all the way to small businesses globally, so ultimately, it has the potential to spread to any size or scale business.”

Until now, the best-known recent supply-chain attack was attributed to elite Russian hackers and targeted software provider SolarWinds. But the motive was different; it was a massive intelligence operation targeting government agencies and others, not an attempt to extort money.

HOW DO RANSOMWARE GANGS OPERATE?

The criminal syndicates that dominate the ransomware business are mostly Russian-speaking and operate with near impunity out of Russia and allied countries. Though barely a blip three years ago, the syndicates have grown in sophistication and skill. They leverage dark web forums to organize and recruit while hiding their identities and movements with sophisticated tools and cryptocurrencies like Bitcoin that make payments — and their laundering — harder to track.

Most experts have tied the Kaseya attack to a group known as REvil, the same ransomware provider that the FBI linked to an attack on JBS SA, a major global meat processor, amid the Memorial Day holiday weekend.

Active since April 2019, the group provides ransomware-as-a-service, meaning it develops the network-paralyzing software and leases it to so-called affiliates who infect targets and earn the lion’s share of ransoms.

WHO IS AFFECTED?

The scale of the attack affecting Kaseya is not yet clear, but it’s already been blamed for closing stores across a grocery chain in Sweden because their cash registers weren’t working.

Last year alone in the U.S., ransomware gangs hit more than 100 federal, state and municipal agencies, upwards of 500 health care centers, 1,680 educational institutions and untold thousands of businesses, according to the cybersecurity firm Emsisoft. Dollar losses are in the tens of billions. Accurate numbers are elusive. Many victims shun reporting, fearing the reputational blight.

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.

ISTANBUL (AP) — A Turkish national on the run after allegedly embezzling money from thousands of people in a Ponzi scheme has been extradited to Turkey and detained.

Mehmet Aydin, 30, is thought to have collected the equivalent of more than $131 million in Turkish lira from over 130,000 people through an online scheme called Ciftlik, or Farm Bank, an online game inspired by FarmVille where participants owned virtual animals and crops. Aydin fled abroad with some of that money.

Official Anadolu news agency said Sunday the indictment against Aydin included 3,672 complainants and 48 suspects. Prosecutors are seeking over 75,000 years in prison on charges including establishing and running an illegal organization, fraud and money laundering.

Turkey had an Interpol red notice out for Aydin, who turned himself in to authorities in Brazil after more than three years on the run. He was brought back to Turkey late Saturday and taken into custody.

The trial against the defendants began in 2019. The next hearing with Aydin will take place on Sept. 14.

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.

WASHINGTON (AP) — A ransomware attack paralyzed the networks of at least 200 U.S. companies on Friday, according to a cybersecurity researcher whose company was responding to the incident.

The REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attack, said John Hammond of the security firm Huntress Labs. He said the criminals targeted a software supplier called Kaseya, using its network-management package as a conduit to spread the ransomware through cloud-service providers. Other researchers agreed with Hammond’s assessment.

“Kaseya handles large enterprise all the way to small businesses globally, so ultimately, (this) has the potential to spread to any size or scale business,” Hammond said in a direct message on Twitter. “This is a colossal and devastating supply chain attack.”

Such cyberattacks typically infiltrate widely used software and spread malware as it updates automatically.

It was not immediately clear how many Kaseya customers might be affected or who they might be. Kaseya urged customers in a statement on its website to immediately shut down servers running the affected software. It said the attack was limited to a “small number” of its customers.

Brett Callow, a ransomware expert at the cybersecurity firm Emsisoft, said he was unaware of any previous ransomware supply-chain attack on this scale. There have been others, but they were fairly minor, he said.

“This is SolarWinds with ransomware,” he said. He was referring to a Russian cyberespionage hacking campaign discovered in December that spread by infecting network management software to infiltrate U.S. federal agencies and scores of corporations.

Cybersecurity researcher Jake Williams, president of Rendition Infosec, said he was already working with six companies hit by the ransomware. It’s no accident that this happened before the Fourth of July weekend, when IT staffing is generally thin, he added.

“There’s zero doubt in my mind that the timing here was intentional,” he said.

Hammond of Huntress said he was aware of four managed-services providers — companies that host IT infrastructure for multiple customers — being hit by the ransomware, which encrypts networks until the victims pay off attackers. He said thousand of computers were hit.

“We currently have three Huntress partners who are impacted with roughly 200 businesses that have been encrypted,” Hammond said.

Hammond wrote on Twitter: “Based on everything we are seeing right now, we strongly believe this (is) REvil/Sodinikibi.” The FBI linked the same ransomware provider to a May attack on JBS SA, a major global meat processer.

The federal Cybersecurity and Infrastructure Security Agency said in a statement late Friday that it is closely monitoring the situation and working with the FBI to collect more information about its impact.

CISA urged anyone who might be affected to “follow Kaseya’s guidance to shut down VSA servers immediately.” Kaseya runs what’s called a virtual system administrator, or VSA, that’s used to remotely manage and monitor a customer’s network.

The privately held Kaseya says it is based in Dublin, Ireland, with a U.S. headquarters in Miami. The Miami Herald recently described it as “one of Miami’s oldest tech companies” in a report about its plans to hire as many as 500 workers by 2022 to staff a recently acquired cybersecurity platform.

Brian Honan, an Irish cybersecurity consultant, said by email Friday that “this is a classic supply chain attack where the criminals have compromised a trusted supplier of companies and have abused that trust to attack their customers.”

He said it can be difficult for smaller businesses to defend against this type of attack because they “rely on the security of their suppliers and the software those suppliers are using.”

The only good news, said Williams, of Rendition Infosec, is that “a lot of our customers don’t have Kaseya on every machine in their network,” making it harder for attackers to move across an organization’s computer systems.

That makes for an easier recovery, he said.

Active since April 2019, the group known as REvil provides ransomware-as-a-service, meaning it develops the network-paralyzing software and leases it to so-called affiliates who infect targets and earn the lion’s share of ransoms.

REvil is among ransomware gangs that steal data from targets before activating the ransomware, strengthening their extortion efforts. The average ransom payment to the group was about half a million dollars last year, said the Palo Alto Networks cybersecurity firm in a recent report.

Some cybersecurity experts predicted that it might be hard for the gang to handle the ransom negotiations, given the large number of victims — though the long U.S. holiday weekend might give it more time to start working through the list.

___

Bajak reported from Boston; O’Brien contributed from Providence, Rhode Island.

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.