Technology News

Ransomware attack before holiday leaves companies scrambling

Businesses rushed Saturday to contain a ransomware attack that has paralyzed their computer networks, a situation complicated in the U.S. by offices lightly staffed at the start of the Fourth of July holiday weekend.

In Sweden, most of the grocery chain Coop’s 800 stores were unable to open because their cash registers weren’t working, according to SVT, the country’s public broadcaster. The Swedish State Railways and a major local pharmacy chain were also affected.

Cybersecurity experts say the REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attack that targeted a software supplier called Kaseya, using its network-management package as a conduit to spread the ransomware through cloud-service providers.

Kaseya CEO Fred Voccola said in a statement that the company believes it has identified the source of the vulnerability and will “release that patch as quickly as possible to get our customers back up and running.”

John Hammond of the security firm Huntress Labs said he was aware of a number of managed-services providers — companies that host IT infrastructure for multiple customers — being hit by the ransomware, which encrypts networks until the victims pay off attackers.

“It’s reasonable to think this could potentially be impacting thousands of small businesses,” said Hammond, basing his estimate on the service providers reaching out to his company for assistance and comments on Reddit showing how others are responding.

Voccola said fewer than 40 of Kaseya’s customers were known to be affected, but the ransomware could still be affecting hundreds more companies that rely on Kaseya’s clients that provide broader IT services.

Voccola said the problem is only affecting its “on-premise” customers, which means organizations running their own data centers. It’s not affecting its cloud-based services running software for customers, though Kaseya also shut down those servers as a precaution, he said.

The company added in a statement Saturday that “customers who experienced ransomware and receive a communication from the attackers should not click on any links — they may be weaponized.”

Gartner analyst Katell Thielemann said it’s clear that Kaseya quickly sprang to action, but it’s less clear whether their affected clients had the same level of preparedness.

“They reacted with an abundance of caution,” she said. “But the reality of this event is it was architected for maximum impact, combining a supply chain attack with a ransomware attack.”

Supply chain attacks are those that typically infiltrate widely used software and spread malware as it updates automatically.

Complicating the response is that it happened at the start of a major holiday weekend in the U.S., when most corporate IT teams aren’t fully staffed.

That could also leave those organizations unable to address other security vulnerabilities, such a dangerous Microsoft bug affecting software for print jobs, said James Shank, of threat intelligence firm Team Cymru.

“Customers of Kaseya are in the worst possible situation,” he said. “They’re racing against time to get the updates out on other critical bugs.”

Shank said “it’s reasonable to think that the timing was planned” by hackers for the holiday.

The federal Cybersecurity and Infrastructure Security Agency said in a statement that it is closely monitoring the situation and working with the FBI to collect more information about its impact.

CISA urged anyone who might be affected to “follow Kaseya’s guidance to shut down VSA servers immediately.” Kaseya runs what’s called a virtual system administrator, or VSA, that’s used to remotely manage and monitor a customer’s network.

The privately held Kaseya is based in Dublin, Ireland, with a U.S. headquarters in Miami.

REvil, the group most experts have tied to the attack, was the same ransomware provider that the FBI linked to an attack on JBS SA, a major global meat processor, amid the Memorial Day holiday weekend in May.

Active since April 2019, the group provides ransomware-as-a-service, meaning it develops the network-paralyzing software and leases it to so-called affiliates who infect targets and earn the lion’s share of ransoms.

The Brazil-based meat company said it paid the equivalent of a $11 million ransom to the hackers, escalating calls by U.S. law enforcement to bring such groups to justice.

Firm alerts county to ‘significant’ issues at condo complex

KISSIMMEE, Fla. (AP) — Engineers from a private firm alerted county officials in central Florida this week to significant structural problems that were discovered at a condominium complex two months ago but never addressed by the homeowners association.

The warning came days after another condominium, the 12-story Champlain Towers South, partially collapsed in Surfside, Florida, killing at least 18 and leaving 145 people still missing. The collapse there happened as repairs were beginning after inspections uncovered “significant” damage at the 40-year-old building.

In central Florida, the Orlando-based firm Farmer Architecture told Osceola County officials they had warned the homeowners association at the Images Condominiums in Kissimmee that three buildings at the complex were “unsafe and in danger of collapse” on April 30, the Orlando Sentinel reported.

Farmer and another company, Born Engineers, made the recommendations but never heard back from the association, according to emails released Thursday.

The emails sent to Miguel Ubiles of FirstService Residential, the HOA for Images Condominiums, described “significantly rotted wood framing” and additional rot in wooden columns, the report said. The firm recommended “closing these areas to traffic until further investigation can occur to determine the full extent of the rotted wood problem.”

On Tuesday, Todd Born, president and owner of Born Engineering, contacted county officials, saying property managers had never signed off on a proposal to make the repairs.

“We have not heard back from the Owner and are concerned that nothing is being done,” said Born’s email to William Grimes, Osceola’s chief building inspector. “In my opinion, what we encountered in our very limited review of the condition is a very serious condition. The walkways are in danger of collapse and could represent a threat to the safety of the public.”

Ubiles did not respond to the newspaper’s request for comment.

On Wednesday, the county declared 72 units at the complex unsafe. The newspaper reported that some residents opted for 14-day stays at nearby hotels paid for by the county while repairs are made. Others appeared to have stayed in their homes, in spite of the warning, the Sentinel reported.

It was unclear how long it would take to make the repairs.

“Everybody here, we work in the tourism industry and we’ve been hit by COVID hard, and to come home to this is really sad,” Jennifer Dodd, a resident affected by the closures, told the newspaper.

Osceola County spokesperson Chris Brumbaugh said the county received permission from the HOA to inspect the other eight buildings on the property.

“Repairing the existing structural issues is the responsibility of the condo association/management company,” Brumbaugh said.

Michael Allen, who is planning to move to the area from Michigan was scheduled to tour the complex before being told what was going on.

“I’m leaving. I don’t even want to go look,” Allen told the newspaper. He said it reminded him of the building collapse at the Champlain Towers South in Surfside.

Tesla delivers more than 200,000 vehicles in 2nd quarter

DETROIT (AP) — Tesla says it delivered 201,250 electric vehicles in the second quarter as it overcame a global computer chip shortage that has hit nearly every automaker.

The sales figures fell a bit short of Wall Street estimates of 207,000 vehicles, according to data provider FactSet. But it was better than first-quarter sales of 185,000 and put the company on a path to double last year’s annual deliveries of just under 500,000.

The Palo Alto, California, company says it only counts a car as delivered if it is transferred to the customer and all paperwork is correct. Final numbers could vary by up to 0.5% or more.

Sales from April through June more than doubled the same period last year, when the start of the coronavirus pandemic forced Tesla and other automakers to close factories for much of the quarter.

The Model 3/Y led the way with 199,360 in second-quarter deliveries, followed by the Model S/X at 1,890. Tesla produced 206,421 vehicles for the quarter, including 2,340 of the Model S/X.

Wedbush analyst Daniel Ives wrote in a note to investors that 200,000 deliveries was the bull case scenario for Tesla in the second quarter. He wrote that 195,000 Model 3 and Y deliveries could give Tesla the potential to hit 900,000 in annual sales this year.

Also during the quarter, Tesla had to deal with safety and quality issues in China, where it has built a huge factory to serve the world’s largest auto market.

In June Tesla Inc. had to recall about 285,000 vehicles in China because of a problem with the cruise control. Chinese authorities said it can activate accidentally and cause cars to suddenly speed up, creating a safety hazard. Chinese authorities and the company said Tesla plans to upgrade cruise-control software remotely so the owners don’t have to take their cars to a company store.

In early trading, Tesla shares edged up less than 1% to $681.54.

China watchdog launches review of Didi Global days after IPO

HONG KONG (AP) — China’s internet watchdog said Friday that it has launched an investigation into ride-hailing company Didi Global Inc. to protect national security and public interest, days after the company went public in New York.

In a statement on its website, the Cyberspace Administration of China said that it would conduct a cybersecurity review in accordance with China’s cybersecurity law. While the investigation is ongoing, Didi will not accept registrations of new users.

The watchdog did not give further details on the investigation.

“DiDi will fully cooperate with the relevant government authority during the review,” the company said in a statement.

“We plan to conduct comprehensive examination of cybersecurity risks, and continuously improve on our cybersecurity systems and technology capacities.”

The announcement of the investigation comes two days after the company had its stock market debut on the New York Stock Exchange. Its stock price fell 6% to $15.31 in morning trading Friday.

China’s government has grown increasingly concerned over the influence of China’s technology companies, as their services — such as e-commerce, payments and on-demand deliveries — become ubiquitous in the lives of millions of Chinese citizens.

Authorities have launched antitrust probes into firms like e-commerce company Alibaba and food delivery firm Meituan. In April, China’s market regulator fined Alibaba a record $2.8 billion for violating antitrust rules.

Authorities have also fined dozens of tech firms in recent months for not properly disclosing previous deals and acquisitions.

Didi Global, which is backed by companies such as Japan’s Softbank and Chinese technology giants Alibaba and Tencent, was initially founded in 2012 by Cheng Wei as a taxi-hailing app. It has since expanded to include other ride-hailing options such as private cars and bus rides.

Didi said it lost $5.5 billion over the past three years, though the firm also touted its global reach and investments in developing electric and self-driving cars.

Tally of missing in condo collapse falls to 128 after audit

SURFSIDE, Fla. (AP) — The number of people missing in the Florida condominium collapse fell substantially Friday, from 145 to 128, after duplicate names were eliminated and some residents reported missing turned up safe, officials said.

Authorities also announced the recovery of two more bodies, including the 7-year-old daughter of a Miami firefighter. That raised the confirmed death toll to 20 people.

Miami-Dade Mayor Daniella Levine Cava said the number of missing declined following an audit. In some cases, when detectives were able to contact people who had been reported as potentially missing, they found that not only were they safe, but other members of their families were safe, too. That pushed the list of people who have been accounted for up to 188 and reduced the number of missing, she said.

“So this is very, very good news,” she said, adding that the numbers are expected to keep changing because detectives are continually reviewing the list and verifying reports.

Detectives have worked around the clock to contact relatives and others. In some cases, English and Hebrew names have been offered for the same missing relative, officials have said.

The 7-year-old who perished in the collapse was “a member of our fire family,” Miami Mayor Francis Suarez said.

The discovery of the girl’s remains was especially hard on rescuers, Levine Cava said.

“It was truly different and more difficult for our first responders. These men and woman are paying an enormous human toll each and every day, and I ask that all of you please keep them in your thoughts and prayers,” she said at a news conference.

No one has been rescued since the first hours after the June 24 collapse of the 12-story Champlain Towers South condominium.

During a meeting Friday with relatives of the missing, Miami-Dade Assistant Fire Chief Raide Jadallah said that only one voice has been heard during the entire search. A woman’s voice was detected until about 10 a.m. or 11 a.m. on the morning of the collapse, which happened around 1:30 a.m. Rescuers were unable to reach her, and he said no other voices or human sounds have been heard since.

Jadallah also prepared the families members for a possible suspension of the search if Hurricane Elsa — now in the eastern Caribbean — brings strong winds to South Florida that would make the work too dangerous.

Some rescue workers who are now staying in tents will be moved to cruise ships, which can stay safe during a tropical storm, Jadallah said.

About 600 first responders will stay on the Royal Caribbean ship Explorer of the Seas, the cruise line said. The ship, which can accommodate more than 3,000 passengers, began housing rescue teams Thursday and likely will continue for the next month.

Friday’s announcements came a day after officials said they were working on plans to tear down what’s left of the building after concerns about the structure’s instability prompted a 15-hour halt to the search for survivors. Crews noticed widening cracks and up to a foot of movement in a large column.

It will likely be weeks before the demolition is scheduled, officials said.

The cause of the collapse is under investigation. A 2018 engineering report found that the building’s ground-floor pool deck was resting on a concrete slab that had “major structural damage” and needed extensive repairs. The report also found “abundant cracking” of concrete columns, beams and walls in the parking garage.

Just two months before the building came down, the president of its board wrote a letter to residents saying that structural problems identified in the 2018 inspection had “gotten significantly worse” and that major repairs would cost at least $15.5 million. With bids for the work still pending, the building suddenly collapsed last Thursday.

___

Associated Press Writer Bobby Caina Calvan contributed to this report from Tallahassee, Florida.

Technology News

Footer