You must have heard about this huge cyber attack called ransomeware which is currently on now. These are data i got from Whatsapp and NITA.

The term ‘RANSOMWARE’ is related to some kind of ransom. It is a type of malware which gets into your computer and locks down all the files. Afterwards it seeks for money from the user in order to get access to the locked files.

The easiest way it can get into someone’s computer is through attachments of spam emails or by entering into any unknown link. The extension of these files are different than the conventional files. Usually users turn off the file extensions, so they can not know what kind of file they are clicking on. The virus file pretends like a doc file or any other text file. But if you turn on the file extension of your computer you will see that the file extensions are different. As you click on the file all your data start encrypting and eventually asking you for ransom.

In case if you are interested these are the possible real extensions of ransomware files.

(.ecc, .ezz, .exx, .zzz, .xyz, .aaa, .abc, .ccc, .vvv, .xxx, .ttt, .micro, .crypto, _crypt, .crinf, .r5a, .XRNT, .XTBL, .crypt, .R16M01D05, .pzdc, .good, .LOL!, .OMG!, .RDM, .RRK, .encryptedRSA, .crjoker, .EnCiPhErEd, .LeChiffre, .keybtc@inbox_com, .0x0, .bleep, .1999, .vault, .HA3, .toxcrypt, .magic, .SUPERCRYPT, .CTBL, .CTB2, .locky or 6-7 length extension consisting of random characters.)

Read the press release below from Jeff Konadu Addo of National Information Technology Agency

“On Friday, 12 May 2017, a large cyber-attack using wannacry ransomware program targeting Microsoft Windows was launched, infecting over 230,000 computers in 150 countries, demanding ransom payments in bitcoin in 28 languages. The attack spreads by multiple methods include phishing emails and on unpatched systems as a computer worm.

See Top 10 Affected countries below;

1. India – 9.6%
2. Russian Federation – 6.41%
3. Kazakhstan – 5.75%
4. Italy – 5.25%
5. Germany – 4.26%
6. Vietnam – 3.96%
7. Algeria – 3.9%
8. Brazil – 3.72%
9. Ukraine – 3.72%
10. United States 1.41%

WannaCry is believed to use the EternalBlue exploit, which was developed by the United States National Security Agency (NSA) to attack computers running Microsoft Windows operating systems. Although a patch to remove the underlying vulnerability for supported systems had been issued on 14 March 2017, delays in applying security updates and lack of support by Microsoft of legacy versions of Windows left many users vulnerable. Due to the scale of the attack, to deal with the unsupported Windows systems, Microsoft has taken the unusual step of releasing updates for all older unsupported operating systems from Windows XP onwards.
The attack affected Telefónica and several other large companies in Spain, as well as parts of Britain’s National Health Service (NHS), FedEx and Deutsche Bahn. Other targets in at least 99 countries were also reported to have been attacked around the same time.
Shortly after the attack began a researcher found an effective kill switch, which prevented many new infections, and allowed time to patch systems. This greatly slowed the spread. However, it has been reported that subsequently new versions of the attack have been detected which lack the kill switch, thus allowing them to spread to systems in which the vulnerability has still not been patched.

The National Information Technology Agency, Ministry of Communications and the Ministry of National Security are aware of the dare consequences of any attack by the ransomware and would like to assure the public that is working hard with agencies of state including the Bureau of National Communications, the National Communications Authority, Police CID Cybercrime Unit.
The National information Technology Agency through CERT-GH has been monitoring the situation since the outbreak and has sent advisories to several network operators and members of the national cybersecurity ecosystem to take preventive measures by patching unpatched Microsoft systems in their networks.

As at Sunday, 14 May 2017 at 4:00pm, no attacks has been detected in Ghanaian networks. In Africa, Kenya, Nigeria, South Africa and Tunisia have had wannacry ransomware attacks over the period of the attack.

The National Information Technology Agency (NITA) security team is on high alert to ensure that the Government network is secured. NITA has put in place several security interventions to ensure security and stability of government network.

A public information hotline has been established at NITA to receive request for assistance from the public and network operators.
Request can also be made directly on the CERT-GH portal at http://www.cert-gh.org or via email at [email protected]. The hotlines are:
0299009327
0299009329

We are still monitoring the situation closely and would be standing by to answer any question on the wannacry ransomware attacks and how to secure your computers from being infested.

NITA’s CERT-GH currently has also made the MS patches released in March 2017 and the just released patches for unsupported MS operating systems available on its web portal for citizens who would like to download.
As the attacks hold internet uses to ransom and encrypt the drives so no access to files and documents are possible, we recommends the following precautionary measure for users and system admins as follows:

1. Take all windows OS systems off the internet and off the network.
2. Create a backup of all files needed.
3. Store backup in an air gapped location.
4. Download windows update(KB4019472) in a sandbox environment.
5. Install the update without connecting to a network/internet.

For person who are using unlicensed operating systems software, patching may not be possible. NITA will thus recommend that such users purchase MS Operation Systems licences so they can patch their systems to prevent being attacked.”

Thank You
Signed
Jeff Konadu Addo
AG. Director General
National IT Agency (NITA)