Social Media, Brute Force Attacks, Passwords, Fake WAPs & Protecting Yourself

/in , ,

The video above shows a hack of Gmail, but your social media accounts can be just as vulnerable if you choose a common password like:

  • Password
  • 12345
  • QWERTY
  • iloveyou

Social media accounts are online assets, which no matter how big you build them, can still be a liability. This liability comes from how they can be exploited by hackers, especially when you do not take the proper steps to protect them.

You need to put as much effort into protecting your online assets as you do building them. You don’t need an entire IT team to do this, keep reading to learn the basics of what you need to do.

Defeat brute force hacks with better passwords

One of the most brainless hacks out there is known as a brute force hack. I hacker simply sets up a tool to target a specific account and the tool guesses passwords until it is right. You may know these tools as password recovery tools. They have be altered by hackers for nefarious purposes.

You have to defend against brute force hacks with better passwords that are complicated and use a mix of characters.

Fake WAPs: Use a variety of passwords

Let’s say that you took my advice above when you created a password that is “35IrulePLANETearthb1tches!” Good job, but now you have to come up with the new password for each of your social media accounts. This is important because of something known as the fake WAP. This is when a hacker will set up a free Wi-Fi network in a public location. They will then use the network to steal things like passwords.

Your first line of defense should be a good password manager. You can create a very strong password to get into the password manager, and then it could manage a wide variety of strong passwords for you. Good examples include:

Each one is going to help you protect your accounts by using a wide variety of passwords to defend against the fake WAP hack. Even if they do get one password to one of your social media accounts they won’t necessarily get access to all of your other accounts.

Secondary defense against fake WAP

Last failsafe to protect yourself against a fake WAP involves encryption. The problem with the fake WAP is the hacker will set up a hot spot that has no encryption on it. This means that they can see the following in plain text:

  • Confidential information that you send over your social media through private messages.
  • Any customer contact details that you sent back and forth.
  • Brand strategies discussed between related accounts.
  • Any credit card numbers that customers send through there.

The way that you are going to encrypt every single thing that you send over a hotspot, including your social media, is with a VPN with strong encryption. These tools are perfect for this job as they encrypt everything that is transferred to and from your device. All you have to do is connect to the VPN server and that takes care of your encryption, and your social media data.

Do your best against insider threats

Insider threats, especially recently fired employees that still have your social media, are very real. There have been a number of times when staff and being fired but they’re access to the social media has not been removed. The most embarrassing has probably been HMV.

 Here are ways that you can defend against this insider threat:

  • Make a record of all accounts that employees have access to.
  • Have plans in place to remove people from all accounts before they’re fired. Make sure a specific person is assigned to this.
  • If you have multiple accounts that multiple employees are given access to, it may be smart to consolidate these in one social media dashboard. You can use things like HootSuite, SocialFlow, or BufferApp.

The last point will make things easier ‘s that you only have one account to remove access from. Imagine having to remove access to twitter, Facebook, WordPress, Google, LinkedIn, etc.… Consolidate the accounts in one spot to minimize an insider threat caused by oversight on what accounts they have access to.

Social media and online security

Social media is a fantastic way to connect with your customers. It can be a very valuable asset to your company. The value that you get from that can be exploited by hackers for monetary reasons, or simply to troll you. Both of these will wind up costing you money. Invest in these tactics, make sure that your employees follow through on them, and you will save yourself a lot of money and heartache.

Samsung releases SoundAssistant app for improved audio experience on Galaxy phones

/in ,


Samsung has launched a new app to allow Samsung Galaxy owners to customize a wealth of audio settings on their devices.

Known as SoundAssistant, the app offers “150 steps” of volume adjustment, a floating EQ, mono and stereo balancing, as well as the chance to set individual volumes for different apps.

What’s more, SoundAssistant can alter the hardware volume keys so that they default to media volume control rather than call volume. Typically, these keys will automatically switch to control whatever sound is playing at the time, but this can be a little finicky and doesn’t always adjust the desired setting. As a person who usually has their phone on silent, though, having it default to media volume would be far more useful than call volume.

If you own a Galaxy S8 or S8 Plus, SoundAssistant can even allow you to set different outputs for different apps, like using a Bluetooth speaker for Spotify and the phone’s speaker for Clash of Clans.

On paper, the app looks like it could be a useful tool and I expect that many Android users would appreciate the features it offers: here’s hoping Samsung opens it up to non-Galaxy devices sometime (and non-Android 7.0 Nougat devices, as that’s another current restriction).

You can download SoundAssistant via the link below and let us know in the comments what your favorite Android audio customization tool is.

DOWNLOAD SAMSUNG SOUNDASSISTANT

Android Authority

Cyber attacks: how your devices can be used

/in

The massive global cyber attack that wreaked havoc in computer systems earlier this month caused plenty of visible disruption, not least in Britain’s National Health Service.

But in the brave new inter-connected world heralded by the internet of things (IoT), so-called “ransomware” attacks could have as their source something quite mundane and yet present in ever more modern households.

In a not so far-off future, the source of a software glitch with serious consequences for the simple consumer could be anything from a connected coffee machine or refrigerator to a techie toy or an outsmart-you television.

Web-connected gadgets are becoming all the rage with tech-aware professionals.

But the mere idea that it only needs a hacker to give the software a malevolent tweak to send them on the blink with disastrous consequences may yet threaten the development of such goods’ popular take-up.

“Regarding last weekend’s attack there is no risk for connected objects. That in particular hit systems running Windows …and today there are no mass market gadgets with Windows loaded in order to function,” says Gerome Billois, a consultant with Wavestone.

“In contrast, there have already been massive attacks on connected objects,” Billois told AFP.

The Mirai malware strain made from hacked IoT devices including badly secured routers and internet connected cameras recently infected hundreds of thousands of poorly secured connected objects.

The idea was not to stop them from working but to transform them into zombies or botnets with a view to using them as relay stations for future cyber attacks.

Last week at a timely cyber security conference in The Netherlands, American wunderkind Reuben Paul, just 11, stunned an audience of security experts by hacking into a teddy bear via bluetooth to show how interconnected smart toys “can be weaponised”.

His prowess showed just how easy it is for tech savvy individuals to use everyday objects to harvest data or use them as spy holes for covert surveillance.

According to documents released in March by Wikileaks, US intelligence can hack smartphones, computers and smart, web-connected TVs, to pilot them and eavesdrop.

“All the other connected objects can be pirated, that has been shown, be it a coffee machine, a refrigerator, a thermostat, electronic entry systems, the lighting system…,” warns Loic Guezo, a cyber security analyst for southern Europe with Japanese security software company Trend Micro.

Mikko Hypponen, head of research at Finnish security specialists F-Secure, has for his part come up with his eponymous Hypponen’s Law.

This states that “once a device is described as ‘intelligent’, you can consider it as vulnerable.”

Neglected security

The future might well spell connected cars – but they too are subject to potential remote hacking, the consequences of which barely need stating.

When hackers lurking with their laptops have finished conjuring what havoc they might wreak on distant roads there are plenty of other things to which they could turn their attention.

These include vases which tell you when they need fresh water, insulin pumps – or how about sex toys?

So, the worried tech consumer may be asking him or herself – can a cyber hacker deprive me of my morning slug of caffeine?

Or maybe keep my thermostat blocked at 10 Celsius – a chilling thought – or even take over my GPS if I don’t hand over a ransom?

Theoretically, yes, specialists tell AFP.

“The logic of a cybercriminal is to make money,” says Wavestone’s Billois. Such an individual will not feel the need to make do with small-scale attacks.

Connected TVs, having rapidly become widespread, are an ideal portal for making ransom demands.

“Tomorrow, one can imagine devices which attack your connected house, bringing it under control, and then you get sent a message by another channel,” muses Guezo.

All that would required would be to perfect the sort of virus one can find on offer within the murky confines of the “darknet”, off the beaten track for day to day netizens.

Cyber security specialists are very much aware of the need to keep working on solutions offering protection as more and more homes go “smart” and “connected” with various boxes as add-ons to their usual routers.

The specialists’ plan is to work with the makers of connected goods in order to incorporate a security interface right from the start, thereby offering what the profession calls “security by design”.

Some experts feel that, in the rush to bring fascinating and cutting edge technologies into the home, the need for commensurate security has been rather left behind.

“It is extremely difficult to calculate the solidity of a connected object in terms of cybersecurity,” Billois regrets.

“As a consumer it is today impossible to know if you are buying a secure connected object or not,” he adds.

“There’s no label such as a made in Europe kind of tag guaranteeing an object won’t catch fire, or won’t pose a risk to children.”

Fin24Tech

Critical flaw in Twitter’s code could let hackers take over your account

/in ,

A security researcher discovered a critical vulnerability in the advertising code of Twitter, the most popular micro-blogging website in the world, which if exploited could let hackers publish updates from any other account without needing access to the victim’s profile.

The white-hat hacker, writing in a blog post this week (22 May), claimed to have uncovered the issue while exploring Twitter’s code for bugs. He said the flaw could give cybercriminals the ability to “publish entries in Twitter-network by any user of this service.”

The vulnerability was initially found on 26 February 2017 and fixed two days later.

The hacker, known as kedrisch, reported the flaw via Twitter’s bug bounty service – a programme managed by the organisation HackerOne which lets researchers disclose bugs in exchange for rewards.

In this instance, kedrisch was handed a bounty of $7,560 (₦2,872,800) for his efforts.

The issue he found was in Twitter’s advertising code. Essentially, the researcher said flaws existed in how the service’s media library uploaded files such as videos, images and gifs to the platform.

Rules surrounding the responsible disclosure programme mean the flaw is only coming to light now.

In a statement, Twitter said: “The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user.

“By sharing media with a victim user and then modifying the post request with the victim’s account ID the media in question would be posted from the victim’s account. This bug was patched […] and no evidence was found of the flaw being exploited by anyone other than the reporter.”

Charlie Miller, a security expert well-known for being part of the collective which remotely hacked a 2014 Jeep Cherokee, tweeted: “As former appsec [Application Security] tech lead for Twitter, I’ll just say I’m not shocked this was in code from the ads team.” He did not elaborate further.

 Last December, kedrisch was awarded $1,120 (₦425,600) for finding a less critical flaw which could let a hacker change comments on Twitter’s official forums. This was publicly disclosed on 12 May 2017.
Most recently, Twitter issued a warning to users of its Vine service that a bug potentially exposed users’ email addresses and phone numbers to unnamed third parties. In an email sent to all impacted Vine users, it said the bug affected the Vine Archive for “less than 24 hours”.
Vine was bought by Twitter back in 2012 however the company decided to shut down the popular short video publishing application earlier this year amid a period of heavy job cuts.

“We want to emphasise that this information can’t directly be used to access your account, and we have no information indicating that it has been misused,” Twitter’s email to Vine users stressed. “We take these incidents very seriously, and we’re sorry this occurred,” it added.

IBTimes

Why Companies Shouldn’t Try to Hack Their Hackers

/in

During a recent cybersecurity competition, teams of students conducting a mock exercise unintentionally caused the U.S. to start a (fake) war. The students were given a variety of options, including diplomatic ones, for responding to a cyberattack by China. The majority of them took an aggressive approach, known as “hack back,” with disastrous consequences. The mock exercise shows how tempting it is to launch a counterstrike in response to a cyberattack — and the potential for significant unintended consequences.

As the CEO of a publicly traded security company, I would like to urge businesses and individuals to beware those very same dangers. In the United States, the Computer Fraud and Abuse Act (CFAA) prohibits private parties from accessing or damaging computer systems, even if they’re being used to attack you or your business.

But legislation in Congress would change that, giving private-sector businesses and individuals the right to strike back and hack their hackers. The idea behind the proposal is to empower people “to defend themselves online, just as they have the legal authority to do during a physical assault.” I believe the measure would do more harm than good. Here’s why.

Holes in the Self-defense Defense

It may sound reasonable that the same principle that allows homeowners to defend themselves against intruders, even if it involves causing harm to the attackers, should hold true for cyberattacks. But the reality is, unfortunately, that it would be akin to lobbing grenades from your front yard, hoping to get lucky and hit an attacker you haven’t seen as they flee the scene of the crime. Even if you do manage to hurt your attacker, you’ll likely hurt other people, too. In hack back, it’s almost impossible to ensure that an action targeted at a specific actor or group of actors will affect only the intended targets. After all, the internet is designed specifically for the purpose of systems interacting and communicating. Technology and users are increasingly interconnected.

It’s Difficult to Identify Your Attacker

Another significant challenge is that cyberattacks, which are sometimes discovered years after a security breach, are difficult to attribute to the correct actor. Hackers are constantly evolving their techniques to stay one step ahead of defenders and law enforcement. Sometimes they use deception techniques to plant indicators that point to some other perpetrator, either to throw off suspicion or to incriminate another party.

This is even more problematic when you consider that devices operating as unwilling parts of a botnet may be used to carry out an attack. These infected devices — and their owners — are as much victims of the attacker as the primary target, yet any attempt to hack back could cause them harm. Even governments, which possess the large-scale, sophisticated intelligence-gathering programs needed to accurately attribute cyberattacks, can take a long time to do so. Private-sector organizations typically do not have these resources.

Running Afoul of the Law of Proportionality

In the wake of a cyberattack, even if the attacker has been identified, it is difficult to judge motivation accurately and to determine an appropriate response. Remember the students competing in the mock cybersecurity exercise, the ones who ended up at war? They thought their response was proportional, but the situation quickly got out of hand.

Sometimes the need for information is used as an argument for hacking back. The argument is that it can help with intelligence gathering. However, intelligence gathering is not the same as mounting a digital counterstrike. There are a number of intelligence-gathering measures that U.S. organizations can take that do not run afoul of the CFAA. For example, organizations can deploy honeypots in their own networks to capture information on the attacker and their methods.

Essentially, hack back legislation would put the ability to launch cyberattacks, decide proportional responses, and infiltrate systems into the hands of companies and individuals. If hack back is legalized and private-sector companies have it in their arsenals, I fear it could become the de facto response — rather than considering the broad range of options that do not involve hacking back.

New Pressure on Company Resources

Clearly, hacking back effectively would require specialized skills and costly investments. Were it legalized with an authorization framework that is insufficiently stringent, I fear that many organizations may try to participate without the necessary tools and expertise to carry it out. That is likely to be ineffective, damaging, or both.

Other companies cannot afford a great deal of in-house security expertise and technologies to protect themselves today. Hack back capability is a nonstarter for them. That will make them even more vulnerable if hack back is legalized. Profit-motivated attackers may try to avoid companies that threaten to strike back. Instead, they’ll target the unfortunate organizations below this security poverty line.

Legal Landmines in a Lawless “Land”

While the internet is a borderless space accessed from every country in the world, each of those countries has its own legal system and expects its citizens to abide by it. It would be very risky for companies and individuals who hack back to avoid running afoul of the laws of another country and international law.

When national governments do this, it tends to occur within existing international legal frameworks and under some regulatory oversight. It must meet a stringent burden of proof for attribution. There are parameters determining the types of targets that can be pursued and which actions can be taken. Any hack back authorization would need considerable government oversight to avoid abuse by the private sector and minimize collateral damage.

For example, what if a company hacks back and accidentally hurts another company or individual? The company could incur expensive legal proceedings, reputational damage, and loss of trust. Making organizations exempt from this kind of legal action around unintended consequences is problematic. How could we spot and stop accidental or intentional abuses of the system? Giving the private sector hack back capability would require a complex legal framework and oversight system. Who would run it? How would it be funded? This seems impractical and costly.

It’s hard to blame companies for feeling helpless in the wake of cyberattacks that have shut factories, paralyzed hospitals, and publicized proprietary corporate data. From phishing scams to ransomware to vulnerabilities in medical devices, connected electronics, and even the entire power grid, no one likes to feel that they are constantly on the losing end of a shadowy war against clandestine cyberattackers, with no hope in sight. That feeling of helplessness is behind a growing call for companies to be able to hack back.

Yet the potential costs of a misstep and the unintended consequences should deter business leaders from undertaking such an effort. We must instead work together to find solutions to our complex cybersecurity problems that are better than legitimizing vigilantism, particularly given its significant risks and dubious benefits. It’s one thing for students to unintentionally trigger a disaster in the safe confines of a competitive mock scenario. It’s another thing entirely to be a business leader that does so in the real world.

Harvard Business Review

Amazon launches new training and certification portal to lure talent to AWS

/in

As cloud services continue to pick up steam, Amazon wants to make sure there is no shortage of talent to maintain your cloud computing operations and take care of your AWS needs.

Yesterday, the e-commerce giant announced it is launching its own dedicated training and certification portal to offer aspiring ASW solution architects the opportunity to independently manage and monitor their progress in one convenient place.

“Previously, you had to rely on multiple websites to find and manage training and certification offerings,” Amazon said in a blog post.

“Now you have a central place where you can find and enroll in AWS Training, register for AWS Certification exams, track your learning progress, and access benefits based on the AWS Certifications you have achieved.”

Amazon hopes the move will make it easier for technical professionals to build up their AWS skills and advance towards earning an actual certification to back up their competence in the area.

To access the portal, you can create a new account or simply log in with your existing Amazon account. Owners of AWS Training accounts will have the option to migrate their existing training history to the new platform.

While the new training portal will certainly make it easier for ambitious AWS rookies to catch up with the latest and greatest trends and practices in managing cloud infrastructures, it is worth noting employers tend to bet on candidates that can back up their certifications with practical experience.

So make sure you have some actual working experience to compliment your glowing AWS training certifications if you really want to impress potential talent hunters.

Check out more details about the AWS Training and Certification portal here.

TnW

Interconnected smart toys “can be weaponised”

/in , ,

An audience of security experts attending a cybersecurity conference at the World Forum in The Hague (The Netherlands) on Tuesday were shocked when a demonstration done by an 11-year-old “cyber ninja” showed the dismal cyber security standards that are prevailing in technology. He hacked into the Bluetooth devices to manipulate a teddy bear and show how interconnected smart toys “can be weaponised”.

The wonder kid in question is American Reuben Paul, a cyber security expert and white hat hacker who’s currently studying in the sixth standard of a school in Austin, Texas. Techworm had reported about the hacking skills of Reuben way back in 2015 when he warned an audience about the dangers of smartphone hacking while delivering a keynote address as a 9-year-old.

“From airplanes to automobiles, from smartphones to smart homes, anything or any toy can be part of the” Internet of Things (IOT),” Reuben told the crowd. “From terminators to teddy bears, anything or any toy can be weaponised.”

As part of his live demonstration and to prove his point, Reuben deployed his cuddly looking teddy bear ‘Bob’, which connects to the iCloud via Wi-Fi and Bluetooth smart technology to receive and transmit messages.

He then plugged a “Raspberry Pi” – a tiny and low cost computer – into his laptop on stage and started scanning the hall for available Bluetooth devices. To the astonishment of everyone in the hall, Reuben was able to download dozens of numbers including some of top officials.

Then, using the programming language called Python, he went on to hack into his Internet-connected teddy bear via one of the numbers and turned on Bob’s lights and transferred a recorded message from the audience through to the bear.

“Most internet-connected things have a blue-tooth functionality … I basically showed how I could connect to it, and send commands to it, by recording audio and playing the light,” he told AFP explaining his demonstration.

“IOT home appliances, things that can be used in our everyday lives, our cars, lights refrigerators, everything like this that is connected can be used and weaponised to spy on us or harm us.”

For instance, they could be used to steal private information such as passwords, as remote surveillance devices to spy on kids, or to locate a person using GPS.

More terrifyingly, toys could even be programmed to say “meet me at this location and I will pick you up,” Reuben said.

Besides being a cyber-ninja, Reuben is also the youngest American to earn a black belt in Shaolin Kung Fu. With the help from his family, Reuben has set up a non-profit organisation called CyberShaolin whose purpose is to spread awareness about “the dangers of cyber-insecurity”.

Since his talk, Reuben has been receiving congratulatory messages on Twitter from various experts in the infosec community applauding his work.

Reuben’s father, Mano Paul, an IT expert, said that his kid’s cyber skills emerged at the age of six, when he began exploring how software systems worked.

“He has always surprised us. Every moment when we teach him something he’s usually the one who ends up teaching us,” he told the AFP.

Reuben hopes to study cyber-security at either CalTech or MIT universities.

TechWorm

3 Cybersecurity Practices That Small Businesses Need to Consider Now

/in , ,

All businesses, regardless of size, are susceptible to a cyberattack. Anyone associated with a company, from executive to customer, can be a potential target. The hacking threat is particularly dangerous to small businesses who may not have the resources to protect against an attack let alone ransomware.

Norman Guadagno, a senior marketing officer at Carbonite, has said that “almost one in five small business owners say their company has had a loss of data in the past year,” with each data hack costing anything ranging $100,000 to $400,000 [about ₦37,500,000 to ₦150,000,000]. It, therefore, pays to understand cybersecurity to better protect you and your business.

Ransomeware Risks
Ransomware attacks can be especially devastating for small business owners. When hackers seize your data, encrypt it, and demand money in exchange for the key to unlock that data, you are truly at the mercy of the criminals.

Given that smaller businesses are likely to have weaker protection than larger ones, it is important that adequate steps are taken to properly secure your information. Ensure that software and hardware is up to date and change passwords often.

Cloud-Based Security
Using some sort of central data vault is a popular solution for business security. There are a great many companies which provide this service, from the large Nokia Networks to smaller bespoke groups.

The advantage of this approach is that you will have access to the cyber expertise of the vault company while also possessing a significant degree of control over the cloud system you will be using. The disadvantage is that adopting this approach does not make your company immune to hackers since there are points of attack either at the vault company or at your own. But you are at least in expert hands.

Biometric Security
Smartphones are already using thumbprints for user identification purposes, but 2017 promises to deliver even more advancements along these lines. Biometric systems will be able to analyze and evaluate every part of your company’s security features. Touch pads will have sensors able to identify a user from their computer habits like typing speed and even online browsing taste.

The Internet of Things (IoT) is such that security measures are under increasing scrutiny as multiple devices, over ever-expanding distances, can be linked together. This facilitates speedier data sharing and storage as the hardware (and the businesses using the hardware) becomes more familiar to users. But it also means that device-level security must be effective if it is to minimize the risk of an effective cyber attack – multiple-factor authentication is needed.

Increased Automation Assists Security Staff
Biometrics, the cloud, and the increasing prevalence of the IoT are signposting an expanding role for automation in cybersecurity. When the smart systems already mentioned combined with the human element of a security process, a strong deterrent against criminals can be created. Automated technology constantly reviews your protection arrangements, looking for possible gaps and plugging them. The use of these systems complements the work of your staff and safeguards your business against all but the most determined attackers.

Cybersecurity is evolving as it tries to keep pace with increasingly sophisticated hack attacks. This is why it is important to secure your business effectively by taking expert advice. The cost to businesses of cyberattacks is already monumental, and it is growing. Consumers are also becoming more aware of the dangers of computer crime and they will often take their custom to those businesses which take data security seriously. Being small is no excuse for businesses – they must pay heed to industry advice and ensure that they are properly protected against cybercrime in 2017.

Tech.co

Twitter co-founder: ‘Yeah, I’m sorry’ if Twitter helped Trump get elected

/in ,

Twitter co-founder Evan Williams wants you to know he’s super sorry for any role the social media platform played in the election of President Donald Trump.

The sort-of apology was made in an interview with The New York Times published on Saturday. Williams’ remorse for possibly helping to create a political monster comes after Trump’s claims that Twitter was key in helping him clinch the election.

“I think that maybe I wouldn’t be here if it wasn’t for Twitter, because I get such a fake press, such a dishonest press,” Trump told Fox News in March.

The Times reports that Williams has only recently heard Trump’s claim for the first time, reflecting on it for a while before speaking out.

“It’s a very bad thing, Twitter’s role in that,” Williams told the Times. “If it’s true that he wouldn’t be president if it weren’t for Twitter, then yeah, I’m sorry.”

Trump’s use of Twitter has long been the source of criticism, especially now as he holds the highest office in the country. The Wall Street Journal reported earlier this week that Trump’s aides recently held a social media intervention with the president due to concerns his tweets could have political and legal ramifications.

The White House did not respond to a request for comment on Williams’ remarks, according to the Times

WATCH: Trump’s outrageous insults throughout his campaign

Windows 7, not XP, was the reason last week’s WCry worm spread so widely

/in ,

Wanacry stats

Eight days ago, the WCry ransomware worm attacked more than 200,000 computers in 150 countries. The outbreak prompted infected hospitals to turn away patients and shut down computers in banks and telecoms. Now that researchers have had time to analyze the self-replicating attack, they’re learning details that shed new and sometimes surprising light on the world’s biggest ransomware attack.

Chief among the revelations: more than 97 percent of infections hit computers running Windows 7, according to attacks seen by antivirus provider Kaspersky Lab. By contrast, infected Windows XP machines were practically non-existent, and those XP PCs that were compromised were likely manually infected by their owners for testing purposes. That’s according to Costin Raiu, director of Kaspersky Lab’s Global Research and Analysis Team, who spoke to Ars.

While the estimates are based only on computers that run Kaspersky software, as opposed to all computers on the Internet, there’s little question Windows 7 was overwhelmingly affected by WCry, which is also known as “WannaCry” and “WannaCrypt.” Security ratings firm BitSight found that 67 percent of infections hit Windows 7, Reuters reported.

The figures challenge the widely repeated perception that the outbreak was largely the result of end users who continued to deploy Windows XP, a Windows version Microsoft decommissioned three years ago. In fact, researchers now say, XP was largely untouched by last week’s worm because PCs crashed before WCry could take hold. Instead, it now appears, the leading contributor to the virally spreading infection were Windows 7 machines that hadn’t installed a critical security patch Microsoft issued in March

The Kaspersky figures are illuminating because they show Windows 7 x64 Edition, which is widely used by large organizations, being infected close to twice as much as Windows 7 versions mostly used in homes and small offices. It’s not clear if that means enterprises are less likely to patch or if there are other explanations.

Also on Friday, researchers published convincing evidence that malicious spam e-mails played no role in initially seeding last week’s ransomware worm. Rather, according to a blog post published by AV provider Malwarebytes, it spread through a mechanism that scanned the Internet for computers with open Server Message Block ports. The worm then used a modified version of “EternalBlue,”—the advanced SMB exploit that was developed by the National Security Agency and leaked by the Shadow Brokers group—to install WCry on vulnerable computers. From there, WCry propagated from vulnerable machine to vulnerable machine inside local networks.

“Developing a well-crafted campaign to identify just… a few thousand vulnerable machines would allow for the widespread distribution of this malware on the scale and speed that we saw with this particular ransomware variant,” Malwarebytes Senior Malware Intelligence Analyst Adam McNeil wrote.

A third revelation: more people than previously known may have been repackaging EternalBlue and other recently leaked NSA exploits in the weeks before the WCry outbreak. Security firm Secdo said on Friday that it unearthed evidence showing that multiple groups exploited the SMB vulnerabilities to install a separate ransomware package, steal login credentials, and to conscript computers into a botnet.

According to Secdo researcher Gil Barak:

Based on these findings, we suspect that the scope of the damage is much greater than previously thought and that there are at least three different groups that have been leveraging the NSA exploit to infect enterprise networks since late April… These attacks demonstrate that many endpoints may still be compromised despite having installed the latest security patch.

Researchers from a separate security firm already showed that criminals were using EternalBlue to make vulnerable computers part of a cryptocurrency mining botnet. A Secdo representative said the attacks the company reported occurred around the same time.

Meanwhile, EternalRocks—a separate self-replicating exploit also developed by the NSA and released in last month’s Shadow Brokers release—is also being repackaged in active attacks. Researcher Miroslav Stampar has details here.

Finally, as reported by Wired on Friday, attackers have been using a knock-off of the powerful Mirai Internet-of-things botnet to attack two servers that are currently preventing WCry and a WCry copycat variant from spreading. Before executing on a vulnerable computer, the worms are programmed to reach out to hardcoded domain names. If the domains respond, the worm aborts without infecting or spreading. Researchers suspect developers intended the mechanism to function as a killswitch they could use to stop the worm, should attackers lose control of it. Should the distributed denial-of-service attacks knock the servers out of commission, there is the possibility the self-replicating infections could start again.

MalwareTech, the pseudonymous researcher who registered the domain that stopped last Friday’s WCry worm, said he’s not concerned about the attacks. He explained to Ars: “at this point, very few samples are actually spreading, so even if the sinkhole were to go offline, the damage would be limited.”

Just to be on the safe side, he has sought the help of an unnamed DDoS mitigation service.