5 ms·

>The biggest cyberattack in history infected more than 200,000 Is that all? The media is blowing this up, I would have though there would be more prolific worm

by retox 9y ago

>The biggest cyberattack in history infected more than 200,000 Is that all? The media is blowing this up, I would have though there would be more prolific worms that this. Nimda? Sasser? Blaster? Storm Worm?

mike-cardwell 9y ago
They're journalists. You can't expect them to Google something before printing it.
c22 9y ago
I heard it referred to a couple times as "the biggest ransomware attack". Perhaps the writer heard this too and lost the nuance.
eriknstr 9y ago
Another couple of big ones I remember: Sobig, 2003. In particular I recall that media was talking about Sobig.F - https://en.wikipedia.org/wiki/Sobig https://en.wikipedia.org/wiki/Sobig Mydoom, 2004. https://en.wikipedia.org/wiki/Mydoom https://en.wikipedia.org/wiki/Mydoom
- creepydata 9y ago
  From my memory bank: Melissa - https://en.wikipedia.org/wiki/Melissa_(computer_virus) https://en.wikipedia.org/wiki/Melissa_(computer_virus) ILOVEYOU - https://en.wikipedia.org/wiki/ILOVEYOU https://en.wikipedia.org/wiki/ILOVEYOU Anna Kournikova - https://en.wikipedia.org/wiki/Anna_Kournikova_(computer_virus) https://en.wikipedia.org/wiki/Anna_Kournikova_(computer_viru... Slammer - https://en.wikipedia.org/wiki/SQL_Slammer https://en.wikipedia.org/wiki/SQL_Slammer And of course, the fastest spreading virus of all time, Sammy (which only effected Myspace profiles but still meets the definition of a computer worm) https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm) I don't think the media covers malware/viruses like the used to around the turn of the century.
kevhito 9y ago
It's strange, many news organizations report this as "200,000 organizations", but others as "200,000 computers". Which are very different. Some of the bigger universities alone probably have hundreds to thousands of infected computers. I'd bet it's closer to 200k organizations, but I don't know how that would be measured or tracked.
drzaiusapelord 9y ago
Cryptowall had an estimated 625,000 infections and that's August 2014 numbers[1]. I believe it had many other campaigns since. Then you have Teslacrypt and Locky which I believe to be just as large if not larger. I don't think anyone has any good data on how big these attacks are. I suspect they actually number in the tens of millions. I think Brian Krebs had an article or two about these malware authors walking away with literally millions of dollars of bitcoin. That's a lot of infections. One of the problems is that most ransomware will run, encrypt the files, then delete themselves to avoid detection. That means AV doesn't get a chance to catch it later after updated definitions arrive. So AV reporting is useless and AV reporting is how we used to know how big infections were. I also think the AV industry is incentivized to not make a big fuss about ransomware because the infection numbers are embarrassing to them. So far they can't stop it with traditional means. A lot of shops run things like RansomFree, InterceptX, CarbonBlack, etc on top of now near useless traditional AV. https://www.scmagazine.com/cryptowall-surpasses-cryptolocker-in-infection-rates/article/539552/ https://www.scmagazine.com/cryptowall-surpasses-cryptolocker...

by retox 9y ago

mike-cardwell 9y ago

They're journalists. You can't expect them to Google something before printing it.

c22 9y ago

I heard it referred to a couple times as "the biggest ransomware attack". Perhaps the writer heard this too and lost the nuance.

eriknstr 9y ago

Another couple of big ones I remember: Sobig, 2003. In particular I recall that media was talking about Sobig.F - https://en.wikipedia.org/wiki/Sobig https://en.wikipedia.org/wiki/Sobig Mydoom, 2004. https://en.wikipedia.org/wiki/Mydoom https://en.wikipedia.org/wiki/Mydoom

creepydata 9y ago
From my memory bank: Melissa - https://en.wikipedia.org/wiki/Melissa_(computer_virus) https://en.wikipedia.org/wiki/Melissa_(computer_virus) ILOVEYOU - https://en.wikipedia.org/wiki/ILOVEYOU https://en.wikipedia.org/wiki/ILOVEYOU Anna Kournikova - https://en.wikipedia.org/wiki/Anna_Kournikova_(computer_virus) https://en.wikipedia.org/wiki/Anna_Kournikova_(computer_viru... Slammer - https://en.wikipedia.org/wiki/SQL_Slammer https://en.wikipedia.org/wiki/SQL_Slammer And of course, the fastest spreading virus of all time, Sammy (which only effected Myspace profiles but still meets the definition of a computer worm) https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm) I don't think the media covers malware/viruses like the used to around the turn of the century.

kevhito 9y ago

It's strange, many news organizations report this as "200,000 organizations", but others as "200,000 computers". Which are very different. Some of the bigger universities alone probably have hundreds to thousands of infected computers. I'd bet it's closer to 200k organizations, but I don't know how that would be measured or tracked.

drzaiusapelord 9y ago

Cryptowall had an estimated 625,000 infections and that's August 2014 numbers[1]. I believe it had many other campaigns since. Then you have Teslacrypt and Locky which I believe to be just as large if not larger. I don't think anyone has any good data on how big these attacks are. I suspect they actually number in the tens of millions. I think Brian Krebs had an article or two about these malware authors walking away with literally millions of dollars of bitcoin. That's a lot of infections. One of the problems is that most ransomware will run, encrypt the files, then delete themselves to avoid detection. That means AV doesn't get a chance to catch it later after updated definitions arrive. So AV reporting is useless and AV reporting is how we used to know how big infections were. I also think the AV industry is incentivized to not make a big fuss about ransomware because the infection numbers are embarrassing to them. So far they can't stop it with traditional means. A lot of shops run things like RansomFree, InterceptX, CarbonBlack, etc on top of now near useless traditional AV. https://www.scmagazine.com/cryptowall-surpasses-cryptolocker-in-infection-rates/article/539552/ https://www.scmagazine.com/cryptowall-surpasses-cryptolocker...