Instagram and Snapchat are the worst social media platform for young people’s mental health, and YouTube is the most positive, a new study suggests.

The ranking comes in a report from the British Royal Society for Public Health, which ranked the sites’ impact on young people.

“Social media has been described as more addictive than cigarettes and alcohol, and is now so entrenched in the lives of young people that it is no longer possible to ignore it when talking about young people’s mental health issues,” said Shirley Cramer, the chief executive of the RSPH.

“It’s interesting to see Instagram and Snapchat ranking as the worst for mental health and well being, both platforms are very image-focused and it appears they may be driving feelings of inadequacy and anxiety in young people.”

For the study, researchers surveyed about 1,500 young people age 14 to 24 from Britain, asking them to score the impact social media sites had on 14 “health and well-being” issues. Those include anxiety, depression, quality of sleep, body image, loneliness and real-world friendships and connections.

According the RSPH, YouTube was the most positive, followed by Twitter, Facebook, Snapchat and Instagram.

“Social media has dramatically shifted how we socialize, communicate, and form relationships with each other,” said Laci Green, a professional health YouTuber with 1.5 million subscribers. “Its impact cannot be understated.”

She added that since Instagram and Facebook “present highly curated versions of the people we know and the world around us, it is easy for our perspective of reality to become distorted.”

To combat the negative influence of social media, the researchers recommend adding pop ups that warn users of heavy usage, which was supported by 71 percent of the people surveyed.

Another recommendation is for social media companies that can tell from a user’s post that they’re in distress could discretely point them toward help. That was supported by 80 percent of those surveyed. Finally, nearly 70 percent said social media sites should note when a photo has been manipulated.

“As the evidence grows that there may be potential harms from heavy use of social media, and as we upgrade the status of mental health within society, it is important that we have checks and balances in place to make social media less of a wild west when it comes to young people’s mental health and well being,” said Cramer. “We want to promote and encourage the many positive aspects of networking platforms and avoid a situation that leads to social media psychosis which may blight the lives of our young people.”
…

Amazon founder Jeff Bezos has promised to donate $1 million to support press freedom, the Reporters Committee for Freedom of the Press announced Tuesday.

“This generous gift will help us continue to grow, to offer our legal and educational support to many more news organizations, and to expand our services to independent journalists, nonprofit newsrooms and documentary filmmakers,” Reporters Committee Chairman David Boardman said. “We’ll also be better positioned to help local newsrooms, the places hit hardest by the disruption in the news industry and whose survival is every bit as crucial to American democracy as those entities headquartered in Washington and New York.”

The gift from Bezos, who also owns The Washington Post newspaper, is the largest the organization has ever received.

The Reporters Committee also announced that it will support First Look Media and help administer its Media Press Freedom Defense Fund of up to $6 million. First Look Media was established by eBay founder Pierre Omidyar.

Bezos and Omidyar have cited a need for efforts to support an independent press.

Last month, Omidyar’s philanthropy, the Omidyar Network, promised $100 million over the next three years to support journalism and fight fake news.
…

Several hundred middle school and high school students from Senegal and surrounding countries spent last week in Dakar building robots. Organizers of the annual robotics competition say the goal is to encourage African governments and private donors to invest more in science and math education throughout the continent. Ricci Shryock reports for VOA from Senegal’s capital.
…

Several hundred middle school and high school students from Senegal and surrounding countries spent last week in Dakar building robots, and organizers hoped to encourage African governments and private donors to invest more in science and math education throughout the continent.
…

Russian cybercriminals used malware planted on Android mobile devices to steal from domestic bank customers and were planning to target European lenders before their arrest, investigators and sources with knowledge of the case told Reuters.

Their campaign raised a relatively small sum by cybercrime standards — more than 50 million roubles ($892,000) — but they had also obtained more sophisticated malicious software for a modest monthly fee to go after the clients of banks in France and possibly a range of other western nations.

Russia’s relationship to cybercrime is under intense scrutiny after U.S. intelligence officials alleged that Russian hackers had tried to help Republican Donald Trump win the U.S. presidency by hacking Democratic Party servers.

The Kremlin has repeatedly denied the allegation.

The gang members tricked the Russian banks’ customers into downloading malware via fake mobile banking applications, as well as via pornography and e-commerce programs, according to a report compiled by cybersecurity firm Group-IB, which investigated the attack with the Russian Interior Ministry.

The criminals — 16 suspects were arrested by Russian law enforcement authorities in November last year — infected more than a million smartphones in Russia, on average compromising 3,500 devices a day, Group-IB said.

The hackers targeted customers of state lender Sberbank, and also stole money from accounts at Alfa Bank and online payments company Qiwi, exploiting weaknesses in the companies’ SMS text message transfer services, said two people with direct knowledge of the case.

Although operating only in Russia before their arrest, they had developed plans to target large European banks including French lenders Credit Agricole, BNP Paribas and Societe General, Group-IB said.

A BNP Paribas spokeswoman said the bank could not confirm this information, but added that it “has a significant set of measures in place aimed at fighting cyberattacks on a daily basis.” Societe General and Credit Agricole declined comment.

The gang, which was called “Cron” after the malware it used, did not steal any funds from customers of the three French banks. However, it exploited the bank service in Russia that allows users to transfer small sums to other accounts by sending an SMS message.

Having infected the users’ phones, the gang sent SMS messages from those devices instructing the banks to transfer money to the hackers’ own accounts.

The findings illustrate the dangers of using SMS messages for mobile banking, a method favored in emerging countries with less advanced internet infrastructure, said Lukas Stefanko, a malware researcher at cybersecurity firm ESET in Slovakia.

“It’s becoming popular among developing nations or in the countryside where access to conventional banking is difficult for people,” he said. “For them it is quick, easy and they don’t need to visit a bank. … But security always has to outweigh consumer convenience.”

Cybercriminals

The Russian Interior Ministry said a number of people had been arrested, including what it described as the gang leader.

This was a 30-year-old man living in Ivanovo, an industrial city 300 km (185 miles) northeast of Moscow, from where he had commanded a team of 20 people across six different regions.

Four people remain in detention while the others are under house arrest, the ministry said in a statement.

“In the course of 20 searches across six regions, police seized computers, hundreds of bank cards and SIM cards registered under fake names,” it said.

Group-IB said the existence of the Cron malware was first detected in mid-2015, and by the time of the arrests the hackers had been using it for under a year.

The core members of the group were detained on November 22 last year in Ivanovo. Photographs of the operation released by Group-IB showed one suspect face down in the snow as police in ski masks handcuffed him.

The Cron hackers were arrested before they could mount attacks outside Russia, but plans to do that were at an advanced stage, said the investigators.

Group-IB said that in June 2016 they had rented a piece of malware designed to attack mobile banking systems, called Tiny.z for $2,000 a month. The creators of the Tiny.z malware had adapted it to attack banks in Britain, Germany, France, the United States and Turkey, among other countries.

The Cron gang developed software designed to attack lenders including the three French groups, it said, adding it had notified these and other European banks at risk.

A spokeswoman for Sberbank said she had no information about the group involved. However, she said: “Several groups of cybercriminals are working against Sberbank. The number of groups and the methods they use to attack us change constantly.”

“It isn’t clear which specific group is being referred to here because the fraudulent scheme involving Android OS [operating system] viruses is widespread in Russia and Sberbank has effectively combated it for an extensive period of time.”

Alfa Bank did not provide a comment. Qiwi did not respond to multiple requests for comment.

Google, the maker of Android, has taken steps in recent years to protect users from downloading malicious code and by blocking apps which are insecure, impersonate legitimate companies or engage in deceptive behaviors.

A Google spokesman said: “We’ve tracked this malware family for several years and will continue to take action on its variants to protect our users.”

Fake mobile apps

The Russian authorities, bombarded with allegations of state-sponsored hacking, are keen to show Russia too is a frequent victim of cybercrime and that they are working hard to combat it. The interior and emergencies ministries, as well as Sberbank, said they were targeted in a global cyberattack earlier this month.

Since the allegations about the U.S. election hacking, further evidence has emerged of what some Western officials say is a symbiotic relationship between cyber criminals and Russian authorities, with hackers allowed to attack foreign targets with impunity in return for cooperating with the security services while Moscow clamps down on those operating at home.

The success of the Cron gang was facilitated by the popularity of SMS-banking services in Russia, said Dmitry Volkov, head of investigations at Group-IB.

The gang got their malware on to victims’ devices by setting up applications designed to mimic banks’ genuine apps. When users searched online, the results would suggest the fake app, which they would then download. The hackers also inserted malware into fake mobile apps for well-known pornography sites.

After infecting a customer’s phone, the hackers were able to send a text message to the bank initiating a transfer of up to $120 to one of 6,000 bank accounts set up to receive the fraudulent payments.

The malware would then intercept a confirmation code sent by the bank and block the victim from receiving a message notifying them about the transaction.

“Cron’s success was due to two main factors,” Volkov said.

“First, the large-scale use of partner programs to distribute the malware in different ways. Second, the automation of many [mobile] functions which allowed them to carry out the thefts without direct involvement.”
…

Leaked Facebook documents reveal the company walks a fine line between free speech and violent or hateful content.

The Guardian newspaper says it obtained the “more than 100 internal training manuals, spreadsheets and flowcharts” outlining how the social media giant decides what content can stay and what gets taken down.

According to the documents, Facebook does allows certain posts that contain violent language. For example, it’s OK to post “let’s beat up fat kids,” but prohibited to post “someone shoot Trump.”

“People commonly express disdain or disagreement by threatening or calling for violence in generally facetious and unserious ways,” reads one of the documents.

Images showing non-sexual physical abuse or bullying of children as long as there is not a “sadistic or celebratory element.” Live streams of people harming themselves is also allowed, the documents say because Facebook doesn’t want to “censor or punish people in distress.”

A Facebook representative said the company’s top priority is keeping users safe.

“We work hard to make Facebook as safe as possible while enabling free speech,” said Monica Bickert, Facebook’s head of global policy management. “This requires a lot of thought into detailed and often difficult questions, and getting it right is something we take very seriously.”

Facebook has been under increased pressure to prevent violent content from appearing, as a stream of violent videos have been allowed to stay on the site for hours before being deleted.

One particularly gruesome video showed the brutal murder of Cleveland grandfather Robert Godwin in a crime posted on Facebook Live.

The company recently hired 3,000 more humans to help curb objectionable material, and The Guardian documents reveal the moderators are overwhelmed with requests to review material.

“These reviewers will also help us get better at removing things we don’t allow on Facebook, like hate speech and child exploitation, “ Facebook founder Mark Zuckerberg wrote in a post about the hiring. “And we’ll keep working with local community groups and law enforcement who are in the best position to help someone if they need it – either because they’re about to harm themselves, or because they’re in danger from someone else.”

The company also employs algorithms to mark objectionable content.

Facebook also faces criticism when it does take down material deemed offensive.

Last fall, the company removed an iconic photo showing a naked Vietnamese girl running from a napalm attack during the Vietnam War. Facebook later allowed the image to be posted.
…

China’s biggest online retailer, JD.com Inc., announced plans Monday to develop drone aircraft capable of carrying a ton or more for long-distance deliveries.

The company said it will test the drones on a network it is developing to cover the northern Chinese province of Shaanxi. It said they will carry consumer goods to remote areas and farm produce to cities.

JD.com, headquartered in Beijing, says it made its first deliveries to customers using smaller drones in November. Other e-commerce brands including Amazon.com Inc. also are experimenting with drones for delivery.

“We envision a network that will be able to efficiently transport goods between cities, and even between provinces, in the future,” the chief executive of JD’s logistics business group, Wang Zhenhui, said in a statement.

JD.com operates its own nationwide network of thousands of delivery stations manned by 65,000 employees. The company says it has 235 million regular customers.

Drones are part of the industry’s response to the challenge of expanding to rural areas where distances and delivery costs rise.

Drone delivery in China and other countries faces hurdles including airspace restrictions and the need to avoid collisions with birds and other obstacles. In the United States, regulators allow commercial drone flights only on an experimental basis.

A 1-ton payload is heavier than what most drones available now can carry, though some can carry hundreds of kilograms and major drone makers are working on devices able to carry more.

China is home to the world’s biggest manufacturer of civilian drones, DJI, in the southern city of Shenzhen.

JD.com said its planned drone delivery network in Shaanxi would cover a 300-kilometer (200-mile) radius and have drone air bases throughout the province.

The company said it will set up a research-and-development campus with the Xi’an National Civil Aerospace Industrial Base to develop and manufacture drones.

JD.com earlier reported first-quarter revenue rose 41.2 percent over a year ago to 76.2 billion yuan ($11.1 billion). It reported profit of 843.1 million yuan ($122.4 million) compared with a loss of 864.9 million yuan a year earlier.
…

Robot teammates and “snake” arms that can find a crack .005 millimeter long were just two of the U.S. military’s latest technological innovations on display at the Pentagon this week.

The Defense Laboratory Enterprise showcased more than 80 exhibits on its biennial Lab Day on Thursday. The enterprise is a network of 63 defense laboratories, warfare centers and engineering centers that operate across the United States, and the event provided the Defense Department community with an up-close look at projects in various stages of development and readiness.

Here are some of VOA’s favorites:

Soldier Visual Integrated Technology

Imagine a soldier comes across a suspicious object that she has never seen before. As she stops to explore, she immediately sees an enemy fighter and has to spring into action without time to fully raise her weapon’s sight up to her eye. And she’s unable to see another enemy lurking around the corner.

With Soldier Visual Integrated Technology, the soldier can better see her surroundings and needs less time to react to dangers accurately.

Ronald Geer, a staff sergeant assigned to the Army’s Communications-Electronics Research, Development and Engineering Center, says SVIT wirelessly links three pieces of technology on the soldier: a reticle eyepiece, a thermal device on the gun and a communications system attached to the chest.

“What this is going to do is increase my speed and lethality on the battlefield, especially in a close combat situation,” Geer said. “I don’t have to worry so much about raising my weapon to an exact point where I’m able to view through this [his thermal device], because as I raise the weapon, what this is looking at, I’m able to immediately see pulled into the reticle device.”

The connectivity also allows soldiers to use their guns to see what’s around a corner without having to move their bodies into harm’s way.

SVIT updates in real time as well, providing a way to virtually “mark” obstacles or enemy weaponry so that other soldiers can see what the SVIT user views.

Remote Access Nondestructive Evaluation

Jokingly called a “snake on a plane” by some at the Air Force Research Laboratory, R.A.N.D.E. (pronounced Randy) is a robotic arm that can wriggle through an opening as small as 7 centimeters to inspect the interior of aircraft wings or other structures without dismantling them.

Senior Materials Engineer Charles Buynak told VOA that any sensing device can be attached to R.A.N.D.E. to look for minute structural defects.

“We’re looking for things on the order of 1/50,000th of an inch [.00508mm] — before a crack becomes a major thing … and becomes a serious problem to the aircraft,” Buynak said.

The system is driven by a controller from an Xbox 360 home video game console. Buynak said that makes R.A.N.D.E. easy for young operators to use. Another reason is that the Air Force wanted to take advantage of technologies already available.

“Why go spend money developing something that’s easily available that we can adapt to our application here?” he said.

Robots as teammates

The U.S. Army is developing ways to use robots not as tools but as teammates. The Army Research Laboratory displayed several robots this week that can be used as hosts for developing software algorithms for artificial intelligence and machine learning purposes.

Stuart Young, chief of the Asset Control and Behavior Branch, told VOA the goal is to protect soldiers by using technology to “manipulate unknown objects in an unknown world.”

His team is trying to develop AI algorithms that can generalize and understand what’s going on in a robot’s environment. “And then once we have that information,” Young said, “we can manipulate it to accomplish the mission that the robot needs to accomplish.”

Such robot missions could range from breaching an enemy’s defensive position to removing improvised explosive devices, or just moving large objects out of the way while soldiers are in a safer location.
…

One day instead of visiting a doctor in person for health information or searching online, you could be asking for advice from a medical expert’s avatar. A new app is being developed that can be used on a smartphone to ask a virtual doctor about various medical conditions and their treatments. VOA’s Deborah Block has more on this innovative technology.
…

A couple of things about the WannaCry cyberattack are certain. It was the biggest in history and it’s a scary preview of things to come. But one thing is a lot less clear: whether North Korea had anything to do with it.

Despite bits and pieces of evidence that suggest a possible North Korea link, experts warn there is nothing conclusive yet, and a lot of reasons to be dubious.

Within days of the attack, respected cybersecurity firms Symantec and Kaspersky Labs hinted at a North Korea link. Google researcher Neel Mehta identified coding similarities between WannaCry and malware from 2015 that was tied to the North. And the media have since spun out stories on Pyongyang’s league of hackers, its past involvement in cyberattacks and its perennial search for new revenue streams, legal or shady.

Meet Lazarus

But identifying hackers behind sophisticated attacks is a notoriously difficult task. Proving they are acting under the explicit orders of a nation state is even trickier.

When experts say North Korea is behind an attack, what they often mean is that Pyongyang is suspected of working with or through a group known as Lazarus. The exact nature of Lazarus is cloudy, but it is thought by some to be a mixture of North Korean hackers operating in cahoots with Chinese “cyber-mercenaries” willing to at times do Pyongyang’s bidding. 

Lazarus is a serious player in the cybercrime world.

It is referred to as an “advanced persistent threat” and has been fingered in some very sophisticated operations, including an attempt to breach the security of dozens of banks this year, an attack on the Bangladesh central bank that netted $81 million last year, the 2014 Sony wiper hack and DarkSeoul, which targeted the South Korean government and businesses.

“The Lazarus Group’s activity spans multiple years, going back as far as 2009,” Kaspersky Labs said in a report last year. “Their focus, victimology, and guerrilla-style tactics indicate a dynamic, agile and highly malicious entity, open to data destruction in addition to conventional cyberespionage operations.”

WannaCry doesn’t fit

But some experts see the latest attack as an anomaly.

WannaCry infected more than 200,000 systems in more than 150 countries with demands for payments of $300 in Bitcoin per victim in exchange for the decryption of the files it had taken hostage. Victims received warnings on their computer screens that if they did not pay the ransom within three days, the demand would double. If no ransom was paid, the victim’s data would be deleted. 

As ransomware attacks go, that’s a pretty typical setup.

But that’s not — or at least hasn’t been — the way North Korean hackers are believed to work. 

“This is not part of the previously observed behavior of DPRK cyberwar units and hacking groups,” Michael Madden, a visiting scholar at the Johns Hopkins School of Advanced International Studies and founder of North Korea Leadership Watch, said in an email to The Associated Press. “It would represent an entirely new type of cyberattack by the DPRK.” 

Madden said the North, officially known as the Democratic People’s Republic of Korea, if it had a role at all, could have instead been involved by giving or providing parts of the packet used in the attack to another state-sponsored hacking group with whom it is in contact. 

“This type of ransomware/jailbreak attack is not at all part of the M.O. of the DPRK’s cyberwar units,” he said. “It requires a certain level of social interaction and file storage, outside of those with other hacking groups, that DPRK hackers and cyberwar units would not engage. Basically they’d have to wait on Bitcoin transactions, store the hacked files and maintain contact with the targets of the attack.”

Attack not strategic

Other cybersecurity experts question the Pyongyang angle on different grounds. 

James Scott, a senior fellow at the Institute for Critical Infrastructure Technology, a cybersecurity think tank, argues that the evidence remains “circumstantial at best,” and believes WannaCry spread because of luck and negligence, not sophistication.

“While it is possible that the Lazarus group is behind the WannaCry malware, the likelihood of that attribution proving correct is dubious,” he wrote in a recent blog post laying out his case. “It remains more probable that the authors of WannaCry borrowed code from Lazarus or a similar source.”

Scott said he believes North Korea would likely have attacked more strategic targets — two of the hardest-hit countries, China and Russia, are the North’s closest strategic allies — or tried to capture more significant profits. 

Very few victims of the WannaCry attack appear to have paid up. As of Friday, only $91,000 had been deposited in the three Bitcoin accounts associated with the ransom demands, according to London-based Elliptic Enterprises, which tracks illicit Bitcoin activity.
…

Two-thirds of those caught up in the past week’s global ransomware attack were running Microsoft’s Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found.

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying “patient zero” could help catch its criminal authors.

They are having more luck dissecting flaws that limited its spread.

Security experts warn that while computers at more than 300,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences.

“Some organizations just aren’t aware of the risks; some don’t want to risk interrupting important business processes; sometimes they are short-staffed,” said Ziv Mador, vice president of security research at Israel’s SpiderLabs Trustwave.

“There are plenty of reasons people wait to patch and none of them are good,” said Mador, a former long-time security researcher for Microsoft.

WannaCry’s worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations & incident response at UK consulting firm MWR InfoSecurity.

Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 percent of infections, although it represents less than half of the global distribution of Windows PC users.

Computers running older versions, such as Windows XP used in Britain’s NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported.

In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread.

Windows 10, the latest version of Microsoft’s flagship operating system franchise, accounts for another 15 percent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated.

Computer basics

Any organization which heeded strongly worded warnings from Microsoft to urgently install a security patch it labeled “critical” when it was released on March 14 on all computers on their networks are immune, experts agree.

Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs.

“Clearly people who run supported versions of Windows and patched quickly were not affected”, Trustwave’s Mador said.

Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government canceled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts.

Seeking to head off further criticism in the wake of the WannaCry outbreak, the U.S. software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers.

Microsoft declined to comment for this story.

On Sunday, the U.S. software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret – in order to conduct espionage and cyber warfare – and sharing those flaws with technology companies to better secure the internet.

Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 percent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic.

By contrast, the United States accounts for 7 percent of WannaCry infections while Britain, France and Germany each represent just 2 percent of worldwide attacks, Kryptos said.

Dumb and sophisticated

The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from the U.S. National Security Agency, creating a vastly potent class of crimeware.

“What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption”, said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic.

Last Friday, the company’s British-based 22-year-old data breach research chief, Marcus Hutchins, created a “kill-switch”, which security experts have widely hailed as the decisive step in halting the ransomware’s rapid spread around the globe.

WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home.

An unknown number of computers sit behind the 300,000 infected internet connections identified by Kryptos.

Because of the way WannaCry spreads sneakily inside organization networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday.

Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: “The attack shows how sophisticated ransomware has become, forcing even unaffected organizations to rethink strategies.”

Security Experts Find Clues to Ransomware Worm’s Lingering Risks

Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed.

However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: “Users unlikely to get files restored”, the company’s Security Response team tweeted.

The rapid recovery by many organizations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said.

While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree.

These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims.

Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever.

The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organizations install major new software security patches.

WannaCry landed nine weeks after Microsoft’s patch arrived.

“The same things are causing the same problems. That’s what the data shows,” MWR research head Pratley said.

“We haven’t seen many organizations fall over and that’s because they did some of the security basics,” he said.

 
…

The European Union’s competition watchdog has fined Facebook 110 million euros ($122 million) for providing misleading information over its buyout of mobile messaging service WhatsApp.

The European Commission said Thursday that when Facebook informed the Commission of the 2014 buyout, it said it would be unable to “establish reliable automated matching” between Facebook and WhatsApp user accounts.

But the Commission says that in 2016, WhatsApp offered updates including the possibility of linking user phone numbers with Facebook user IDs.

Competition Commissioner Margrethe Vestager said the fine is proportionate and serves as a deterrent.

She said “the Commission must be able to take decisions about mergers’ effects on competition in full knowledge of accurate facts.”
…