Zaha Hadid Architects held to ransom by cybercriminals

Guest post by Michael Prewett.

This is definitely not something you want to see when you turn on your computer Monday morning! This screenshot is from the infamous NotPetya Ransomware that wreaked havoc on the world mid-2017, causing approximately $10 billion dollars’ worth of damage to businesses worldwide.

Ransomware has continued to rise in popularity as the tool of choice for cyber-criminals and unfortunately has gone from an “It will never happen to me” to a “When might it happen to me?” question for most businesses. It doesn’t matter how big or small your business is, or whether you hold valuable information, the aim is to stop you from accessing the files that matter to you.

The idea behind ransomware, a form of malicious software, is simple: Lock and encrypt a victim’s computer or device data, then demand a ransom to restore access. Additionally, ransomware gangs are now purportedly also releasing stolen information on the dark web if the ransom demands are not paid.

For those in the AEC industry, it’s particularly notable that Zaha Hadid Architects (ZHA) suffered a ransomware attack on April 21, after finding messages left on its server saying internal company data had been encrypted and would only be released if it negotiated a ransom settlement with the cyber criminal. A spokesperson from the firm issued the below statement:

“With all our 348 London-based staff working from home during this pandemic and cybercriminals poised to exploit the situation, we strongly advise the architectural community to be extremely cautious.”

Fortunately, ZHA was in a good position as the data was backed up so the encryption of some server information was not a serious problem. It is unknown though, how much information has been stolen. Additionally, its employees were locked out of the server and forced to reset passwords and as such there was significant downtime and therefore lost revenue in order to remedy the situation.

Initially the firm had not notified their clients as they could not guarantee the security of its communication systems but later issued the following:

“Data protection and privacy is extremely important to us and this is why we regretfully have to announce that on 21 April we experienced a security breach and theft of data in a ransomware attack.”“We immediately worked to secure our network and reported the incident to the authorities. With minimal disruption to the work of our teams, we continue to investigate any criminal theft of data with cyber specialists.”

In Australia, legislation requires any data breaches must be reported to the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breach Scheme.2

Unfortunately, there is no “magic bullet” for defeating ransomware but there are some helpful guidelines published by the Australian Government that can help put your company in a strong position to minimise the risks these attacks pose.

This list is called The Essential Eight3 and covers items such as using Multi-Factor Authentication, having Daily backups and restricting applications on your computers.

If you would like help reviewing your cybersecurity posture – please contact us on 1300 735 926 or email us at support@pkcg.com.au

Sources

1. https://www.architectsjournal.co.uk/news/zaha-hadid-architects-held-to-ransom-by-cyberhacker/10046940.article

2. https://www.oaic.gov.au/privacy/notifiable-data-breaches/

3. https://www.cyber.gov.au/publications/essential-eight-explained

More about Michael

Michael Prewett is passionate about cyber security, innovation and new technology, and how to apply it to real world business cases. He also likes to find ways to use existing technology in new ways to improve the customer experience.

You can connect with him on LinkedIn at https://www.linkedin.com/in/michael-prewett/

Time to Restart

How often should I restart? Should I shutdown every day? I’ve restarted but it didn’t fix the issue!

These are some of the most common phrases we hear from our clients. Let’s break down these questions and provide a little insight as to why restarting is so important.

We’ve all heard the phrase “Have you turned it off and on again?” As trivial as it sounds, this simple process can resolve a lot of day to day issues. You’ve been working all day but now your application wont open. “What changed?” you may be asking yourself.

Let’s break down the system start-up process and why this can fix most of these issues.

During a restarting your system undergoes 3 main processes:

1. POST / Pre-boot

2. System Initialisation

3. User Session initialisation

POST / Pre-Boot

During the POST (Power On Self Test) your system is running a diagnostic sequence testing of all components to ensure your system is ready to begin.

System Iinitialisation

At this point in the start-up your computer is loading the Operating System, Drivers and Services into your RAM (Random Access Memory)

If part of the operating system or services has suffered an unrecoverable crash, this is where your system will restart these applications and services. Examples below of what you may have experienced that will resolve in this stage of the restart.

• Printers all offline

• Sound card no long working

• Unable to access the internet

User session initialisation

When you log into your computer, your user session is created. This loads all your personal start-up applications, profile settings and configurations into your RAM.

Ever had an application crash that wouldn’t reopen? If an application doesn’t close correctly there may be parts of it still running inhibiting your program from opening again. Restarting flushes your RAM of all your running application allowing to have a fresh clean start.

With the complexities of your user session, applications starting and stopping, Windows Updates, application updates, driver updates you can start to understand the importance of the restart and why it’s the most common phrase you’ll hear from your IT person.

Windows 10 – sometimes a bit too smart for its own good

Windows 10 has tried to make our lives better by making it faster and introduced a feature called Fast Boot.

Fast Boot does cause some issues, as when you “shutdown” your system it isn’t getting the refresh it needs. It saves your session, instead of closing everything down, and then just reloads your session, errors and all. To get around this its important to choose Restart and not Shutdown.

Audio Conferencing for Microsoft Teams

Guest post by Michael Prewett.

With a possible staged “return to work” happening soon, many companies will be in the position of some of their workforce being in the office and some still working from home. In addition, face to face meetings may still not be feasible in some situations due to maintained social distancing requirements.

As many people have recently discovered, Microsoft Teams has been a great tool to facilitate collaboration when we have been physically apart. Sometimes though it is easier for your team or your clients to “dial in” to a meeting rather than having to be in front of their devices for video chats. Having Microsoft Teams Audio Conferencing is great for those situations where internet connectivity may be limited or even when the call quality is better when dialing in. It also allows meeting attendees to connect easily without software installs or logins.

Microsoft Teams Audio Conferencing can replace costly traditional dial-in phone conference bridges, which when charging by the minute definitely adds up to a hefty sum at the end of the month!

When you create a Microsoft Teams meeting as a user assigned with Audio Conferencing, a dial in number and conference ID is added to the invitation. This number can be configured at setup to be a toll or toll free number located in your choice of most major cities too.

You can call in to these details from the meeting or when joining the meeting through Teams, you can click the Phone Audio button to join and it will display the dial in information to you:

PKCG recently implemented Microsoft Teams Audio Conferencing for a client and managed to save them over $2000 a month from their existing audio conferencing solution!

If you would like our help reviewing your teleconferencing costs or help with getting more out of your Microsoft 365 subscription – please contact PKCG on 1300 735 926 or email us at support@pkcg.com.au

More about Michael

Michael Prewett is passionate about cyber security, innovation and new technology, and how to apply it to real world business cases. He also likes to find ways to use existing technology in new ways to improve the customer experience.

You can connect with him on LinkedIn at https://www.linkedin.com/in/michael-prewett/