Privacy News Hackers are holding San Francisco’s light-rail system for ransom

Der.Reisende

Level 45
Thread author
Honorary Member
Top Poster
Content Creator
Malware Hunter
Dec 27, 2014
3,423
San Francisco Municipal Railway riders got an unexpected surprise this weekend after the system’s computerized fare systems were apparently hacked. According to the San Francisco Examiner, the MUNI system had been attacked on Friday afternoon.

MUNI riders were greeted with printed "Out of Service" and "Metro Free" signs on ticket machines on late on Friday and Saturday. MUNI first became aware of the intrusion on Friday, according to the Examiner.

Computer screens at MUNI stations displayed a message: "You Hacked, ALL Data Encrypted. Contact For Key(cryptom27@yandex.com)ID:681 ,Enter." MUNI Spokesman Paul Rose spoke to the Examiner and noted that his agency was "working to resolve the situation," but refused to provide additional details.

According to the source, the attacker contacted the Railway operator, telling them that it was quite easy to infect them due to an outdated OS.

Read more @ Hackers are holding San Francisco’s light-rail system for ransom
 

Der.Reisende

Level 45
Thread author
Honorary Member
Top Poster
Content Creator
Malware Hunter
Dec 27, 2014
3,423
I understand that the situation is not very clear, but it would be helpful to understand the vulnerability of the infrastructure, since potentially many people could be in danger.
It may not be accurate to call the authors of the malware “hackers,” because instead of trying to break into the transit agency’s computers by coding means, they generally “fish” for staffers who inadvertently download the malware either by targeted emails or other means.

This may be exactly what happened, according to Saolis.

It was not a targeted attack, they wrote, and infected an “admin” level computer after someone at SFMTA downloaded a torrented computer file, a software keycode generator.

Taken from updated article on Alleged Muni ‘hacker’ demands $73,000 ransom, some computers in stations restored

The classic ransomware infection combined with outdated software -
" we don't attention to interview and propagate news ! our software working completely automatically and we don't have targeted attack to anywhere ! SFMTA network was Very Open and 2000 Server/PC infected by software ! so we are waiting for contact any responsible person in SFMTA but i think they don't want deal ! so we close this email tomorrow!" - see quote @ Hackers are holding San Francisco’s light-rail system for ransom
 

tim one

Level 21
Verified
Honorary Member
Top Poster
Malware Hunter
Jul 31, 2014
1,086
It may not be accurate to call the authors of the malware “hackers,” because instead of trying to break into the transit agency’s computers by coding means, they generally “fish” for staffers who inadvertently download the malware either by targeted emails or other means.

This may be exactly what happened, according to Saolis.

It was not a targeted attack, they wrote, and infected an “admin” level computer after someone at SFMTA downloaded a torrented computer file, a software keycode generator.

Taken from updated article on Alleged Muni ‘hacker’ demands $73,000 ransom, some computers in stations restored

The classic ransomware infection combined with outdated software -
" we don't attention to interview and propagate news ! our software working completely automatically and we don't have targeted attack to anywhere ! SFMTA network was Very Open and 2000 Server/PC infected by software ! so we are waiting for contact any responsible person in SFMTA but i think they don't want deal ! so we close this email tomorrow!" - see quote @ Hackers are holding San Francisco’s light-rail system for ransom
Thanks Der now the situation is more clear, the keygen was the infection vector.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top