Code and golem

How hackers block the databases of hospitals fighting Covid-19

The layman loves to savor the “full bottom”, in more youth transcription, also known as the “bottom”. In the hyperinformation space, this is quite normal: it is not interesting when someone nailed someone, a “bottom” element is certainly required. It is not interesting when he just died of cancer or stroke, it is necessary to make the Covid-19. If you stole, then a billion at once. If they were poisoned, then preferably the entire party in full force.

Today, such a plot acts as an information farm today: right now anonymous hackers attack computer systems of hospitals overloaded with a covid conveyor with viruses-robbers, and then they sit and calmly wait for the recruitment, while patients are quietly emitting spirit, because a modern hospital, devoid of access to their database, cannot function for a minute.

I'll start with the details of the plot. After the wave of attacks of the Militia Viruses disabled computer networks of medical institutions in the United States and the European Union, the information portal BleepingComputer on March 18 contacted the most large operators of such viruses in the world (yes, do not be surprised: cyberurics have long been organized and act on the pattern of legitimate business-official representatives, system administrators, system administrators, system administrators, system administrators, system administrators, system administrators, system administrators, system administrators. The press services, the advice of directors-everything is like adults, but only completely anonymously) and asked if they had the remnants of conscience, in the sense that they are going to continue to extort money from hospitals in which the work is carried out in an aral regime.

Of the seven operators, only two (Maze and Doppelpaymer) operators said they were going to refrain from attacks on medical institutions for a while. True, a week after this promise, Maze posted in open access on the Internet passport data and medical records of volunteers participating in experiments on the development of coronavirus vaccine conducted by the British company Hammersmith Medicines Research.

The reason for the drain of information:

British researchers refused to pay a ransom after Maze disabled their corporate network.

Passports and medical records are a warning. The next step, probably, will be the legend of the publicity of financial documentation and know-how of scientific developments. However, the case will not come to this, and Hammersmith Medicines Research, like the rest, will pay to the extortionists.

The operator of the Ryuk virus Ryuk appeal BleepingComputer generally ignored and continued to engage in his craft: in March, the Ryuk Ransomware operator attacked 10 medical institutions, including a network serving nine hospitals.

This is the plot background of our analysis. Of course, I could paint the “bottom” and further, having spoke, for example, about how now

In the Darknet, samples are sold by blood infected with coronavirus, previously injected into the circulatory system of bats,

But I think this is already superfluous. The new details will not bring any valuable information to comprehend the phenomenon of self -traffic to the bottom: and it is so clear that there is nowhere to go further.

I propose to start the analysis with a brief background. The first ransomware virus appeared in 2005. It was a simple code-trojan called Trojan.WinlocklockScreen, who infected the user's computer, prescribing a disk auto loading sector.

The user could not work, because the screen was completely closed by a message about the illegal actions supposedly committed by him. To get rid of the banner, it was proposed to pay a modest ransom - send a paid SMS, replenish someone else's mobile account and other children's pranks.

The main object of attacks was, as usual, the Windows operating system, however, users of “poppies” were also not happy for long: soon the carpets reached them, because they learned to spread in the most creative way-through the documents attached to the emails, vulnerabilities of web browsers, pictures and video clip, downloaded from game servers and botnet.

By the time the microsoft had the most odious holes in the defense of their OS, the hackers gained experience, drew up and moved to adult actions. From now on, the robber viruses were not exchanged for nonsense like the loading sectors of the disk, but encrypted the entire disk content-from programs and ending with all user documents.

The cryptorruption, which relieved the monetization of the ransom, has arrived in time, and it rushed: in February 2013, the Cryptolocker virus-carrier pulled $ 27 million from users. Petya (March 2016) demanded a ransom of 0.9 bitcoin ($ 380 for the current exchange rate at that time). Misha agreed to decipher the user's discs for 1.93 bitcoin ($ 875).

In 2017, a significant metamorphosis occurred in the history of robber viruses:

The Modification of Petya, which received the notpetya, massively attacked Ukrainian banks, airports, power plants, government sites and even the Chernobyl nuclear power plant,

However, this was done not for the sake of ransom, but for the sake of causing the most possible harm to attacked enterprises. NotPetya, although it required a ransom of $ 300 for the Promotion, however, regardless of whether it was paid or not, the encrypted data was not restored, since the possibility of decoding was not initially provided.

Modern robbers-Ryuk, Sodinokibi-reached the evil perfection: they pointedly attack corporate structures and encrypt the discs so that they leave practically no chances of restoration without redeeming. In this case, the redemption is installed by astronomical - from 15 to 50 bitcoins.

On April 13, the Sodinokibi virus operator announced the refusal to receive a ransom in bitcoins and the transition to a full-fledged anonymous Monero cryptocurrency. There is no doubt that the rest of the carpets will also follow Sodinokibi, because, unlike bitcoin, the blockchain of anonymous cryptocurrencies does not allow identifying the sender’s address, the recipient’s address, the transfer amount, nor the geographical location of the transaction participants.

Such is briefly the story of the most disgusting form of cyber terrorism (I think it's time to call the “bottom” with its name)-cargo viruses.

Now the question is: who is in reality for cyberbandas? According to official American departments,

The archire is North Korea,

Which is roofing the legendary Lazarus hacker group, hacking from February 2017 to September 2018 13 crypto-rope for a total of $ 882 million.

On April 15, 2020, the State Department, Treasury, ANB and FBI published a joint memo on the “prevention of North Korean Cyber ​​Thyat), in which they hung all dogs on Lazarus-from the Wannacry virus to halka, and the cryptocurrency attacks on the business structures of Western countries.

The opinion of the American authorities probably should have listened if not for their own track record. The Wannacry virus, created, presumably, Lazarus Group, associated with the North Korean regime, uses Windows OS vulnerability to infect computers, which was the first to discover the US National Security Agency. The NSA, however, did not report the “hole” of Microsoft, but ordered the Hacker group of Equation Group to develop an exploit that allowed to be introduced into a strange computer and withdraw data from it.

The state order has regularly completed the Equation Group: created the exploit of Eternalblue and Backdor DoublePulsar. In 2017, The Shadow Brokers hacker group hacked the National Security Information System and laid out in open access to the truth about the NSA cooperation with the Equation Group, and the Explat and Bacdor code itself.

It was this code stolen from the ANB that used Lazarus Group to create a Wannacry virus-carrier.

Such a wonderful creative symbiosis happened among the supporters of Kim Jong Ira with fighters for the triumph of world democracy.

The geography of attacks of robbers and the principle of Cui Bono (who benefits- “new” ), used in the analysis, leave no doubt that the creative of the American intelligence services received wide international recognition. Thus, the first Wannacry Brownian virus mainly impressed computers located in Russia, Ukraine and India. But the second - notpetya - raged almost exclusively in Ukraine. Finally, the most modern and cool Sodinokibi ransom virus, as if by the wave of a magic wand, bypasses the computers located in Iran and the countries of the former CIS.

I propose, however, to leave the masters of the cloak and dagger alone, since these htonic worlds initially abide outside of any ethics. It is enough to get acquainted with the history of any intelligence service of any country of any era in order to understand: all of them are twins-brothers. They have common logic and common morality. Rather, the absence of any morality in principle. Apparently, without this condition, it is impossible to effectively fulfill the obligations assigned to these structures.

If we want to deal with our momentary “bottom”-the attacks of operators of Medical Medical Medical Studies-we will have to switch from spies to merchants, because mercantile ears from hacker attacks in the midst of the coronavirus epidemic are too open.

The Netwalker Ransomware operator told BleepingComputer that he does not set himself the task of attacking hospitals and medical facilities, and if someone's network turned out to be encrypted by their virus, it probably happened by mistake.

“What will you advise to do an attacked hospital by mistake? Contact you and ask to send a decoder? " - asked the journalists BleepingComputer.

“If someone was encrypted, you can only do one thing-pay for the decoding,” answered Netwalker Ransomware hackers.

Who are these millennials fixed in earnings? Let me ... Why, in fact, millennials?! Why on earth does the author hang dogs to generation y? Is the principle of non olet pecunia (the money does not smell - “new” ) came up only yesterday? Didn't Flannery O'Connor describe in the breathtaking story “a good person to find” the abyss of the moral degeneration of Homo sapiens? And before O'Connor was Louis Ferdinan Selin with a “journey to the center of the night”. And to Selin - Dante with his tenth circle of hell and fraud in deception.

No matter how sad, but I attracted millennials to our topic not for the sake of a red word. This generation is similar to any preceding everyone except the historical combination of two circumstances. It was these two circumstances, in my opinion, that gave rise to a monstrous “bottom” that we today dissect: infection with the bending virus-carrier of computer networks of hospitals, immersed in a round-the-clock struggle against the epidemic.

The first circumstance is harmless in itself: this is a computer code. Yes, a banal computer code underlying the digital revolution and constitutes the unique specifics of labor preferences of the generation of millennials.

The fact, however, is that the computer code (as well as the process of its creation is programming) is a modern golem, which in the XVI century the righteous prague rabbi Lev Ben Bezalel blinded from clay and revived, drawing the word “emat” (truth) on his forehead. Rabbi Lev created a golem out of good motives - to protect compatriots from a bloody slander. The golem, however, was slightly overdue and began to crumble indispensing all civilians, so the righteous Rabbi Lev had to kill his brainchild. Again, it is very modern: the sage instead of the word "emat" painted the word "Mat" (death) on the forehead of Golem.

The myth of the golemum is a warning about the moral responsibility of Demiurge for the product of his mind, especially if this product is endowed with huge destructive potential. Golem is the horror of a materialized word devoid of moral guidelines.

The computer code today is the ideal metaphor of the golem, because the power of this code, embodied in the computer program, has no boundaries. The code in the literal sense of the word can kill, and at the same time is completely devoid of the slightest ethical retreats.

There is such a profession, called the Ethical Hacker. Even the exam is passed the corresponding - by the way, expensive: $ 1,199 plus 80 annually for extension. On the exam, the Soscant is proposed to hack the computer system in order to identify its weaknesses and vulnerabilities. This is done, presumably, for the sake of patching holes and strengthening the protection of the system in the future.

The thing is probably necessary, however, and morally doubtful. It is characteristic that in the most professional computer environment to this flaw of ethical hucking no one pays attention. Meanwhile, ethical hacking, proceeding from the belief that it is morally all that benefits is pure Machiavellism, for which a noble end justifies any vile means. The understanding that unethical actions that pursue noble goals are immoral per se is completely absent in the culture of computer code.

The computer code itself is neutral, because, like a goal, meekly fulfills the will of its demiurge. The logic “If the condition is true, do x, otherwise make y” - a weapon of phenomenal power, in itself is out of ethics. On this logic you can create good. And you can do evil. It all depends solely on the moral values ​​laid in the head of the demiurge. In our case, a mileful programmer.

And here we move to the second circumstance, which, in my opinion, only turns the neutral code into the “bottom” of the robber viruses that infect the hospitals.

The name of this circumstance is a resentment.

Poprazing Nietzsche, we can say that resentification is a “creativity” of a person who tragically experiences his insignificance, weakness and oppression. These states for the most part are caused by the weaknesses and disadvantages of the person who is experiencing resentification, but he subconsciously justifies himself, transferring responsibility to the outside world, to “non-set”, to “them”. “They” are to blame for the fact that I am miserable, insignificant, poor, unknown.

And then the “work” of resentification is born - revenge. In the real world - that in the time of Nietzsche, that today is the revenge of the resentment only imaginary, not manifested. However, oh, miracle! - The computer code allows you to turn the revenge of a resentment from an imaginary threat into a golem, a full -fledged murder tool.

The code allows the programmer covered by a resentment to give free revenge on his imagination and realize the revenge of “it”, the outside world, fed, beautiful and rich, to force this world to answer for the poverty and obscurity of a little millennial.

The resentment has one more feature: he knows how to recover to the level of nations. If the amount of resentment, spilled by the population, is high, if the overwhelming part of the citizens considers itself deceived, offended and robbed, revenge turns into state policy.

Thus, the groups like Lazarus, revenge on the level of geopolitics and confrontation between civilizations, are born. The scale and scope, however, does not change anything in the recipe for the elixir of the Devil, allowing moral monsters to attack hospitals: computer code plus resentification.