San Francisco MTA Forced To Give Free Rides After Network Infected With Ransomware

from the pwned dept

We've noted consistently how the medical industry has become a hotbed of ransomware attacks thanks to too many incompetent IT administrators, and too many hardware vendors for which security is a fleeting afterthought. In fact, hospitals are now seeing more than 20 ransomware attacks a day; attacks that in many instances have forced the cancellation of scheduled surgeries and wreaked havoc on the day-to-day operations of many in the healthcare sector.

But security incompetence isn't restricted just to the healthcare industry. Last week, the San Francisco mass transit system learned this the hard way when hackers effectively took over transit systems used by the San Francisco Municipal Transit Agency, infecting them with ransomware and refusing to return control unless the city was willing to pay $73,000 in bitcoin. The hack hasn't just disabled the city's transit systems, but apparently has crippled the SF MTA's payroll systems, email servers, Quickbooks, NextBus operations, various MySQL database servers, and staff training and personal computers for hundreds of employees.

All told, it's believed that hackers compromised about 2,112 of the 8,656 computers attached to the SF MTA's network. As a result, the city had to simply unlock all turnstiles and let riders ride the system for free as it tried to climb out from underneath the mess:Like most ransomware attacks, the SF MTA is being told to make a payment to an anonymous bitcoin wallet if they want the key to decrypt compromised data on its hard drives:

"if You are Responsible in MUNI-RAILWAY ! All Your Computer’s/Server's in MUNI-RAILWAY Domain Encrypted By AES 2048Bit! We have 2000 Decryption Key ! Send 100BTC to My Bitcoin Wallet , then We Send you Decryption key For Your All Server's HDD!! We Only Accept Bitcoin , it’s So easy! you can use Brokers to exchange your money to BTC ASAP it's Fast way!"

The SF MTA's backups don't appear to have been impacted, so it should be able to save at least some data (depending on how old they are). But local San Francisco news outlets say that SF MTA employees aren't sure they'll be getting paid this week, and the agency stands to lose around $559,000 per day for as long as it's forced to suspend charging fares. All told it's just another reminder that we have a lot of work to do securing necessary and highly vulnerable domestic infrastructure before we get too busy internationally expanding the cyber.

Filed Under: encryption, malware, ransomware, san francisco, sf muni
Companies: sfmta

The Battle Over Who Owns Bus Arrival Times

from the questions,-questions,-questions dept

We've had quite a few stories in the past about various public transportation authorities trying to stop others from creating iPhone apps that indicate train/bus schedule information. Often, the transit organizations claim intellectual property over the matter, saying that they want the ability to license the data themselves, or to sell iPhone apps themselves. This strikes many as being incredibly short-sighted. The core business of the transit groups should be to get more people using the trains and buses. Having good iPhone apps out there (often for free) would seem to get more people to use public transportation, and that benefit likely outweighs any money received from selling $5 iPhone apps.

However, a few people have sent in a story from San Francisco, where things are a bit more complex. The basics do seem to be the same, with a guy named Steven Peterson creating an iPhone app called Routesy to tell you when your Muni bus is arriving, only to have it shut down after complaints that it was violating intellectual property. Where it gets a bit more complex, is that it's not the public transit authority, Muni, that's complaining. In fact, Muni claims that it owns the data and says the public is entitled to use it (in fact, it claims to encourage it).

The issue is that Muni teamed up with a private company to put sensors on its buses and trains to note where the buses are and to predict when the buses would arrive. To make things even more confusing, the original company, NextBus, appears to have been separated into two separate companies: NextBus and NextBus Information Systems (I have to admit, the link above is really not at all clear on this). In a separate post, it appears that NBIS (who sent the complaint to Apple and had originally threatened the creator of the Routesy app) is actually claiming that it owns the prediction data.

While this is silly, it is a bit more defensible. NBIS seems to be claiming that since it owns the sensors and the data they produce, and then run it through some sort of algorithm to predict actual arrival times, it owns the predictions. You can't copyright facts... but you could potentially claim copyright over predictions on facts -- and I think that's what NBIS is actually doing here (no one arguing over this seems particularly clear). A big question: is a prediction a "creative expression"? Some could argue that it's not, but that seems to be what the claim hinges on. In theory, Muni could be right that the data on where each bus is can be freely used by the public, but the predictive data may be a bit different. In the end, it probably hinges on what sort of contract Muni signed with NextBus (or NBIS), and then the real question might be why Muni didn't make sure that the predictive data was made to be open to outside developers as well. My guess: when this deal was being done, no one even thought that outside developers would want to do anything like this, so it wasn't even a point of discussion.

Filed Under: bus schedules, copyright, data, predictions, sf muni
Companies: nextbus, nextbus information systems