Another online seller has launched a tire installation network in the U.S. — eBay Motors.
All the tire dealer wanted to do was upgrade his point-of-sale software. He chose an in-house server-based system, and made sure his employees received the proper training.
After a “crazy busy” first few days, the training became second nature, some of the bugs worked themselves out, and the new system, he said, “normed down.”
Less than two weeks later, his system was hacked and held for ransom. He was asked to pay up or he would lose all his POS information.
“It’s nothing you want to re-live,” said the dealer when contacted by Modern Tire Dealer. “It’s nothing you want to explain. You think you’re smart enough to run your business.”
The cost of ransomware to U.S. businesses is hard to quantify. In 2016, businesses paid out an estimated $1 billion, compared to $24 million the previous year, based on FBI data. However, those numbers only take into account known victims.
Losses due to downtime also are not included. As of May 2016, the FBI estimated ransomware had cost U.S. small businesses more than $75 million in downtime alone in less than a year and a half.
In its 2016 report, “Hackerpocalypse: A Cybercrime Revelation,” cybersecurity company the Herjavec Group estimated the annual cost of global cybercrime will reach $6 trillion a year by 2021. Ransomware is expected to make up an increasingly larger percentage of that total over the next five years.
What is ransomware?
According to the FBI, ransomware “is a form of malware that targets your critical data and systems for the purpose of extortion.” It is frequently delivered through “spearphishing” emails.
“After the user has been locked out of the data or system, the cyber actor demands a ransom payment. After receiving payment, the cyber actor will purportedly provide an avenue to the victim to regain access to the system or data.”
Wayne Croswell, CEO and president of WECnology LLC, says ransomware attacks are typically carried out using a Trojan disguised as a legitimate file.
“They enter a system or network through, for example, a downloaded file or a vulnerability in a network service. The program then runs a payload, which locks the system in some fashion, or claims to lock the system but does not (e.g., a scareware program). Payloads may display a fake warning purportedly by an entity such as a law enforcement agency, falsely claiming that the system has been used for illegal activities, and contains content such as pornography and ‘pirated’ media.
“Payment is virtually always the goal,” he says, “The victim is coerced into paying for the ransomware to be removed — which may or may not actually occur — either by supplying a program that can decrypt the files, or by sending an unlock code that undoes the payload’s changes. Payment can be as little as $10 or even $1,000, and many victims quickly pay it to get their system back. The attacker can infect thousands of systems and collect millions of dollars in ransom.”
When ransomware first hit the scene, computers predominately became infected with it when users opened email attachments that contained the malware, says Croswell.
“But more recently, we’re seeing an increasing number of incidents involving so-called ‘drive-by’ ransomware, where users can infect their computers simply by clicking on a compromised website, often lured there by a deceptive email or pop-up window.
“Another new trend involves the ransom payment method. While some of the earlier ransomware scams involved having victims pay ‘ransom’ with pre-paid cards, victims are now increasingly asked to pay with Bitcoin, a decentralized virtual currency network that attracts criminals because of the anonymity the system offers.”
To pay or not to pay
It was a day he will never forget. “I came into the store and none of the computers were able to sign on to the server,” said the tire dealer. “So I went back to the server and logged in. There was a message on the screen that said my server had been encrypted, and to get it unlocked I needed to write to an obscure email address for more info.
“I immediately called anyone I knew in IT who would take my phone call, including my regular IT guy, who was on vacation. All of the feedback was not good. It was ‘pay what they ask for’ or ‘pull the server off-line and refresh it as new.’
“I decided on the latter. I wouldn’t pay.”
The dealer was lucky. He had only been using the new system for a short time, so he didn’t lose much information. “It was pretty mundane stuff anyway,” he said. “The data I collected wasn’t harmful. It was not like collecting social security numbers or blood types or financial information.”
What he did not do was contact law enforcement. The FBI, Central Intelligence Agency, U.S. Department of Homeland Security, Department of Justice, and the National Security Agency, among others, consider this a mistake.
“We strongly encourage you to contact a local field office of the Federal Bureau of Investigation (FBI) or U.S. Secret Service immediately upon discovery to report a ransomware event and request assistance,” says the U.S. government in an interagency technical guidance document, “How to Protect Your Networks from Ransomware” (https://www.justice.gov/criminal-ccips/file/872771/download).
“Law enforcement may be able to use legal authorities and tools that are unavailable to most organizations. Law enforcement can enlist the assistance of international law enforcement partners to locate the stolen or encrypted data or identify the perpetrator. These tools and relationships can greatly increase the odds of successfully apprehending the criminal, thereby preventing future losses.”
There are serious risks to consider before paying the ransom, according to the document.
The U.S. government does not encourage paying the ransom, but doesn’t prohibit it, either. “Whether to pay a ransom is a serious decision requiring the evaluation of all options to protect shareholders, employees and customers.”
“As with other forms of malware, security software might not detect a ransomware payload, or, especially in the case of encrypting payloads, only after encryption is under way or complete, particularly if a new version unknown to the protective software is distributed,” says Croswell. “New categories of security software, specifically deception technology, can detect ransomware. Deception technology can detect ransomware and notify cyber security teams, which can then shut down the attack and return the organization to normal operations.”
Using software or other security policies to block known payloads from launching will help to prevent infection, but will not protect against all attacks, he says. “There are several tools intended specifically to decrypt files locked by ransomware, although successful recovery may not be possible.
To help prevent being hacked and held for ransom, Croswell suggests the following eight preventive measures:
The Department of Justice has one more step to limit a ransomware infection: “No users should be assigned administrative access unless absolutely needed, and those with a need for administrator accounts should only use them when necessary.”
The attack was a wake-up call for the dealer, who requested anonymity in case the previous hacker decided to accept the “challenge” of his new system.
“I can tell you what I did wrong,” he says. “I did not go through a thorough process to put system controls in place that would have helped prevent this from happening. I needed an action plan in place to know what to do if it happened.”
“Also, by using and in-house server, it was easier to ‘open up the doors’ for hackers to come in. When we installed it, the ports got left open on the router.
“We don’t have a server in-house anymore. We’re using one in the cloud.” And he backs up the data regularly.
“It was a horrible experience,” he said. “Could it have been avoided? I think so. But hindsight is 20-20. If hackers really want to get in, they will, but I’m not going to help them.” ■
From Russia without love: Ransomware is a global phenomenon
“While initially popular in Russia, the use of ransomware scams has grown internationally,” says Wayne Croswell, CEO and president of WECnology LLC and a frequent contributor to Modern Tire Dealer. “In June 2013, security software vendor McAfee released data showing that it had collected over 250,000 unique samples of ransomware in the first quarter of 2013, more than double the number it had obtained in the first quarter of 2012.
“Wide-ranging attacks involving encryption-based ransomware began to increase through Trojans such as CryptoLocker, which had procured an estimated $3 million before it was taken down by authorities, and CryptoWall, which was estimated by the U.S. Federal Bureau of Investigation to have accrued over $18 million by June 2015.”
Can the cloud protect you? Not completely, says WECnology CEO
Discount Tire, the largest independent tire dealer chain in North America, recently announced a multi-year, multi-million dollar cloud-based service agreement with OneView Commerce plc.
“We found that the overall savings in time and cost make cloud-based delivery of a digital store platform the most efficient and economical arrangement for achieving the operational return and improved customer experience that is at the heart of our strategy,” said Tom Williams, senior vice president for Reinalt-Thomas Corp., which does business under the trade name Discount Tire in most of the U.S., America’s Tire in parts of California, and as Discount Tire Direct online.
But does a cloud-based system protect the company against ransomware? Not completely, says Wayne Croswell, CEO and president of WECnology LLC.
“Having a cloud solution doesn’t eliminate ransomware from happening,” he says. “But when you host your application with a trusted secure company, they have the highest level of protection software which can help prevent hacks from getting in.
“But you still have computers at the desks of employees and counters, and if someone there gets a ransomware attack, it could infect the cloud instead of their in-house network.”
Another online seller has launched a tire installation network in the U.S. — eBay Motors.
Popular Science has named the Hakkapeliitta 9 — the flagship winter tire by Nokian Tyres Inc. — a winner of the 2017 Best of What’s New Award.
Vogue Tyre & Rubber Co. has redesigned its website, mirroring it to the world class look and experience the company says its consumers expect.
Midas International Corp. is donating one meal to Feeding America for each tire installed in its stores through Dec. 31, 2017. The company is also running a simliar "one meal" promotion on social media.
What does the new $800 million consumer tire plant in Clarksville, Tenn., do for Hankook Tire America Corp. and its parent company? It “solidifies our presence in the U.S.,” said Seung Hwa Suh, CEO and vice chairman of Hankook Tire Co. Ltd., at the grand opening of the plant on Oct. 17.
Trek Tire LLC is recalling certain Dunlop GrandTrek PT3A passenger car tires, in size 275/50R21, manufactured between Dec. 1, 2016, and Dec. 7, 2016. The potential number of units affected is 1,400.
Michelin North America Inc. has acquired Lehigh Technologies Inc., a company that transforms rubber from end-of-life tires and industrial goods into materials for new tires and other products.
Yokohama Tire Corp. has promoted Andrew Briggs to a newly created position, vice president of marketing and product management. He replaces Fred Koplin, senior director of marketing and motorsports, who has retired after 12 years with the company.
The Automotive Lift Institute’s (ALI) new LiftLab features 12 vehicle lifts ranging from the smallest motorcycle lift and the most common two-post style to heavy-duty inground and mobile column lifts.
Nexen Tire America Inc. is greatly expanding its tire technology center dedicated to the North and South American markets, a move the company says will boost both its original equipment and replacement market share.
After a four-month streak of slight tire volume growth, the Northcoast Research Tire Demand Index took a big step backwards in September. And for better or worse, there’s no clear explanation for the month’s soft sell-out trends.
The new Extensa HP II from Toyo Tire U.S.A. Corp. is available in more than 50 sizes, from 15- to 20-inches, and in both V and W speed ratings.
The first Point S store has opened in Malaysia.
Tenneco Inc. has added 103 direct-fit catalytic converter, premium muffler/muffler assembly, pipe, resonator and hardware part numbers for passenger vehicles to its Walker Emissions Control product line.
Cooper Tire & Rubber Co. will announce its third quarter earnings on Monday, Oct. 30, 2017.