{"id":58777,"date":"2018-02-23T17:16:06","date_gmt":"2018-02-23T23:16:06","guid":{"rendered":"https:\/\/www.pcmatic.com\/blog\/?p=58777"},"modified":"2018-04-06T17:33:03","modified_gmt":"2018-04-06T22:33:03","slug":"ransomware-takes-colorado-dot-systems","status":"publish","type":"post","link":"https:\/\/www.pcmatic.com\/blog\/ransomware-takes-colorado-dot-systems\/","title":{"rendered":"The Blacklist Fails Again – Colorado DOT Corrupted with Ransomware"},"content":{"rendered":"

Update 4\/6\/2018:\u00a0<\/em>Six weeks after the ransomware variant, SamSam infiltrated Colorado DOT’s networks, systems are still not running at full efficiency.\u00a0 The remediation cost have totaled approximately $1.5 million<\/a>, and networks are only working at 80%.\u00a0 The costs included in the estimate only include the overtime costs and other unexpected costs.<\/p>\n

Update 3\/6\/2018:\u00a0<\/em>This just keeps getting worse.\u00a0 Approximately 20% of the CDOT systems were back up and running, when more malicious activity was detected.\u00a0 The ransomware variant, SamSam, that originally took down the DOT’s systems began morphing to reinfect systems.\u00a0 Brandi Simmons, a representative for the state’s Office of Information Technology states<\/a>,<\/p>\n

“The tools we have in place didn\u2019t work. It\u2019s ahead of our tools.\u201d<\/p><\/blockquote>\n

The issue is — the tools they’re using, implement a blacklist technology.\u00a0 The blacklist will only block known bad files.\u00a0 Once a hackers morphs the known bad file, it becomes unknown, or unclassified.\u00a0 Therefore, allowing the malicious file to execute under the blacklist.<\/p>\n

Perhaps it is time the CDOT began using a security solution that uses a default-deny approach<\/a>, which only permits known trusted files to execute.\u00a0 This means, no matter how many times SamSam, or any other malicious variant, morphs — it will still be blocked from infecting systems.<\/p>\n

Ransomware Corrupts Colorado Department of Transportation Systems<\/h3>\n

The Colorado Department of Transportation has been offline since Wednesday following a ransomware attack.\u00a0 The ransomware that infected the system was a variant of the SamSam ransomware.\u00a0 The Colorado DOT was running McAfee at the time of the solution.\u00a0 The Denver Post reported<\/a>,<\/p>\n

“Only employee computers \u2014 running Windows and equipped with McAfee security software \u2014 were impacted.”<\/p><\/blockquote>\n

Officials stated they disclosed the infection to the security solution vendor, and they issued a patch to prevent further execution.\u00a0 But why didn’t it stop it to begin with?\u00a0 McAfee uses a blacklist technology as its primary method of malware detection — meaning, unless it is a known bad file, it will execute.\u00a0 Unfortunately, new variants of cyber threats are released every second.\u00a0 Simply put, the blacklist cannot keep up.<\/p>\n

According to The Denver Post<\/a>, DOT officials stated they do not plan to pay the ransom demands.\u00a0 At this time, they are hopeful they can restore the systems using their backup files.<\/p>\n

Other Ransomware Attacks<\/h4>\n

For a list of ransomware attacks that have already taken place in 2018, you may click here<\/a>. We have also created a ransomware map, see below, of the ransomware attacks that have taken place in the U.S.
\n