安全專家 “想哭”增強版可能本週出爐

Businesses must brace for further cyber attacks this week on a potentially “significant scale”, British intelligence officials warned yesterday, less than 48 hours aFTer the debilitating WannaCry software virus swept across the world.

毒性較大的“想哭”(WannaCry)軟件病毒肆虐世界各地不到48小時之後，英國情報官員昨日警告，企業本週必須準備好對付進一步的網絡攻擊。

Data show more than 1.3m computer systems are still vulnerable to infection by WannaCry, which paralysed hospitals, disrupted transport networks and immobilised businesses, according to cyber security analysts.

據網絡安全分析人士介紹，數據顯示，超過130萬電腦系統仍然容易被“想哭”感染，這種勒索軟件已經致使醫院癱瘓、擾亂了運輸網絡，還使企業無法運轉。

So far, 200,000 computers across 150 countries are known to have been infected in the first wave of the cyber attack, Europol said yesterday. “The recent attack is at an unprecedented level and will require a complex international investigation to identify the culprits,” Europe’s police agency added.

歐洲刑警組織(Europol)昨日表示，迄今已有150個國家的20萬臺電腦在第一波網絡攻擊中受到感染。“最近這起襲擊達到前所未有的水平，將需要展開一場複雜的國際調查來找出幕後黑手，”該組織補充稱。

Intelligence agencies in Europe and the US spent the weekend warning companies and organisations that the threat from the ransomware — malicious software that encrypts machines’ hard drives and demands payment to release the data — may escalate.

週末期間，歐洲和美國的情報機構忙着警告企業和組織，來自勒索軟件（對電腦硬盤進行加密，然後要求交錢以換取釋放數據的惡意軟件）的威脅可能會升級。（上圖爲“想哭”軟件病毒的勒索信息。——編者注）

“We are aware of attempts to attack other UK centres beyond the health service,” Ciaran Martin, director of the National Cyber Security Centre, an arm of the electronic intelligence agency GCHQ, told the Financial Times.

“據我們掌握，有一些針對醫療部門以外的英國其他中心的攻擊企圖，”隸屬英國電子情報機構——政府通信總部(GCHQ)的國家網絡安全中心(National Cyber Security Centre)主任夏蘭?馬丁(Ciaran Martin)告訴英國《金融時報》。

He said although the agency had warned British organisations there were likely to be further attacks today, there was no evidence WannaCry had been updated by its creators to address the element in its coding that halted its spread late on Friday. Officials still believe WannaCry is the creation of a criminal group.

他說，儘管該機構已警告英國境內的組織：今日可能會發生進一步攻擊，但尚未有證據證明，“想哭”的作者已更新其代碼，以解決導致其在上週五停止傳播的編碼問題。官員們仍然相信，“想哭”是一個犯罪集團的產物。

“With the National Crime Agency we have an around-the-clock effort to work out who is responsible,” Mr Martin said. “We have a number of leads but we can’t comment on them.”

“我們正與國家打擊犯罪局(National Crime Agency)合作，全天候追查罪魁禍首，”馬丁表示。“我們有一些線索，但現在不能置評。”

Anthony Ferrante, a former director for Cyber Incident Response at the US National Security Council, said: “We could see activity on Monday morning when people show up for work.”

美國國家安全委員會(National Security Council)網絡事件響應(Cyber Incident Response)前主任安東尼?費蘭特(Anthony Ferrante)表示：“週一上午，當人們上班後，我們可能會看到一些活動。”

Mr Ferrante, now managing director at FTI Consulting’s forensics and litigation unit, said the US government was taking the threat “extremely seriously”.

如今擔任富事高諮詢(FTI Consulting)司法鑑定和訴訟部門董事總經理的費蘭特表示，美國政府“非常重視”這一威脅。

The list of organisations hit by WannaCry has lengthened in the past 48 hours: alongside Britain’s National Health Service, which saw more than a third of hospitals and clinics incapacitated, victims include German rail operator Deutsche Bahn, US logistics group FedEx, Russia’s interior ministry, French carmaker Renault, Spanish telecoms group Telefónica and state-owned China National Petroleum Corp.

“想哭”襲擊的組織名單在過去48小時變得更長：除了英國國家醫療服務體系(NHS)三分之一以上的醫院和診所陷於癱瘓，受害者還包括德國鐵路(Deutsche Bahn)、美國物流集團聯邦快遞(FedEx)、俄羅斯內務部、法國汽車製造商雷諾(Renault)、西班牙電信(Telefónica)以及國有的中國石油天然氣集團公司(CNPC)。

Despite urgent appeals from security authorities for organisations to address the critical Windows security vulnerability exploited by WannaCry, many still have not done so. “We must change our approach,” said Julian King, EU security commissioner. “We all need to take responsibility for cyber security.”

儘管安全部門緊急呼籲各組織堵上“想哭”利用的Windows嚴重安全漏洞，但仍有許多組織沒有這樣做。“我們必須改變我們的做法，”歐盟安全專員朱利安?金(Julian King)表示，“我們都需要對網絡安全負責。”