Thought For the Week: On Remaining Hopeful

It  has been a very challenging 24 hours in our World as we have been witness to the horrific attack in Manchester with live coverage on our Al Jazeera Feed on our main property at http://www.thedailyoutsider.com.    The UK Prime Minister, Teresa May, raised the threat level to critical as she prepared to order the Army into the streets.    We could not agree more as the World was reminded that love triumphs hate.   We also were witness as the Philippines was witness to the horror of Daesh (known as ISIS/ISIL in the west) as it laid stage to a major City in the southern Island of Mindanao.   The Philippine President declared Marshal Law and cut short a trip to Russia to return to oversee operations.   This is as our team continued to assess the travels of President Trump and on-going meetings for which our Social Media Team provided updates over out Twitter Channel (and our Founder was also quite busy on his personal Twitter Feed as well).  

In this day, we decided to share this uplifting thought our team received courtesy of the Mission we will feature on all our properties as a sign of hope and optimism and note that "We Shall Overcome":

You Can’t Sail If You Never Leave the Harbor

A ship in harbor is safe, but that is not what ships are built for. –Grace Hopper

She knew something was wrong.

Culture creates prisons, and she was trapped inside one.

Teachers told her she wasn’t good enough. Professors told her the same, and she dropped out.

Her father begged her to reconsider.

But she wasn’t having any of it.

Her father had a choice. He could try to guilt her into college and be content with her taking the “safe” path. Many people went in that direction, and some of them were happy. Or, he could make the heart-wrenching choice of encouraging his daughter to find her own path.

If he simply gave her “freedom” or an easy path, it would be like giving her an inheritance. The easy way carried serious tradeoffs. The easy path carried diseases of comfort. He saw what those tradeoffs did to all the people around him.

People became automatons seeking greater levels of comfort with reduced amounts of personal risk. They became angry at any minor disturbance or lapse in comfort. They were ready to lash out at the systems of cooperation or their peers the moment they felt anyone was getting more than their “fair share.” The thought of his daughter becoming one of those comfort-craving zombies made him shudder.

He visualized her path in the short term, and didn’t want to see her struggle. But then he considered the long term, and thinking of her sacrificing her full potential was unbearable.

Freedom had to be earned, in order to be appropriately valued.

Individuality could only be forged in the furnaces of adversity.

He heard the passion in his daughter’s voice, the yearning for freedom.

So he presented her with a simple offer.

“You can skip college.”

The girl’s eyebrows raised. And her father knew what she wanted most… the family sailboat.

“And I’ll give you the boat.”

Her eyes lit up and a smile from ear to ear crept over her face.

“But…” sighed her father.

She was frozen in anticipation.

“You have to sail it around the world.”

She moved her lips to protest but he held up a finger.

“No protests and no negotiation. You want freedom, and that’s wonderful. But you’ll have to face a challenge in order to earn it. The ocean and the real world are the best teachers I know.”

The 26-foot boat glistened in the sun. In a mixture of fear, elation, and confusion, she spoke before she could think.

“I’ll do it.”

Her father’s heart sank but he knew he made the right choice.

At 18 years old, with no formal training, no GPS, and no crew, Tania Aebi took that 26-foot boat and sailed around the world. She became the first solo female sailor to circumnavigate the world. She took a sextant for celestial navigation, a radio direction finder, and a few other simple supplies and embarked on a year and a half adventure.

Sunset, Photo Twenty20.

She faced storms, almost had her boat crushed, and came face to face with the ultimate enemy: herself and her mindset.

She returned. Unscathed.

Biologists have a term called neoteny. They use it to describe species they’re studying who retain juvenile features well into adulthood.

Many of our cultural institutions have become training grounds for neoteny.

More twenty and thirtysomethings live at home than ever before.

Americans in the top 1% of global wealth whine about how they don’t have enough. Meanwhile, they have pocket supercomputers more powerful than the ones NASA used to get to the moon. Instead of using them to become learning machines, hike across the country, or connect with like minds to build new things, they use them to play games.

Tania Aebi isn’t a household name. She’s not “rich” but she’s free.

Your name doesn’t have to become “known.” You don’t have to do what the crowd does. All of us can become free, unique individuals through adversity. There are safe paths always waiting for us. There are those who profess to “love” us by helping keep us in comfort. Their fear of the unknown can keep us from the adventures that make life worth living.

The challenge is to find and earn love from those willing to endure the pain of watching us struggle.

The struggle doesn’t have to lead to a million or a billion dollars. Most of the world lives on a few dollars per day. When Elon Musk was taking jobs from the Canadian unemployment office, he taught himself to live on $2 a day (hotdogs and oranges) to remove his fear of poverty. Culture has an endless buffet of fears and hamster wheels for you to run on. Escape them and kill your fears with direct real-world experience.

Take massive action, and then cut off any possibilities of regret. Face adversities and take full agency for your choices. Leave the safe harbor, but if you find yourself riding tumultuous waves or shipwrecked, don’t breathe a word of complaint. There are always gifts and lessons for those who take radical agency of their own lives.

Culture wants to keep you infantile. Those who are addicted to comfort have an allergic reaction when they spend time around those who can ensure uncomfort. Do you want to be addicted to comfort, or addicted to achievement?

While certain comfort-addicted neo-maniacs in the world worship “the coming machine singularity,” you can become a real singularity through facing and overcoming adversity.

You can become a unique individual if you find someone who loves you enough to allow you to endure challenges. It won’t be easy, and it will mean intense isolation from most people. But do you want to be like most people?

“It happens rarely, but whenever I do read a newspaper, listen to the radio, or watch television, on a variety of topics, I find myself wondering, “How? How can this happen? How can people be so gullible?”

[I’m renewed with] gratitude to my father for having given me the chance to dodge full immersion in the homogenizing machine, and makes me more determined than ever to pass this gift of becoming an individual on to my own children.”

— TANIA AEBI, world record holder, first circumnavigation of the world by a solo female sailor

Don’t be afraid to leave the harbor.

View of the Week (Weekly Edition): The World in 2050

Devon Energy Plant outside Riverton, Wyoming (Source NY Times) 

The Sunday May 20 Edition of the New York Times featured a Front Page Story about the closeness of the EPA Administrator, Scott Pruitt,  and the closeness he has had with Fossil Fuel Producers epitomized by Devon Energy.      In the meantime, the World moves on to create a new and sustainable future as epitomized by this produced by the BBC.      It is a compelling 38 Minutes which is worth noting:

Poem of the Week: Life is Too Short....

Ella Wheeler Wilcox

Please enjoy this "Poem of the Week":

Life is Too Short

    by Ella Wheeler Wilcox

Life is too short for any vain regretting;

Let dead delight bury its dead, I say,

And let us go upon our way forgetting

The joys and sorrows of each yesterday

Between the swift sun's rising and its setting

We have no time for useless tears or fretting:

Life is too short.

Life is too short for any bitter feeling;

Time is the best avenger if we wait;

The years speed by, and on their wings bear healing;

We have no room for anything like hate.

This solemn truth the low mounds seem revealing

That thick and fast about our feet are stealing:

Life is too short.

Life is too short for aught but high endeavor--

Too short for spite, but long enough for love.

And love lives on forever and forever;

It links the worlds that circle on above:

'Tis God's first law, the universe's lever.

In His vast realm the radiant souls sigh never

"Life is too short."

View of the Week (Special Thursday Edition): On the Ultimate Display

As Virtual Reality looms, our team chose this courtesy of @Futurism to remember where it all started:

See Full Infographic

Notations On the Grid (Special Mid-Week Edition): On A Primer On Aritifical Intelligence

One of the emerging fields that we focus on here at The Daily Outsider is Artificial Intelligence.  We wanted to report on two key things we picked up on it which we hope the team find  of interest  as we begin our on-going assessment: 

	Danielle Guzman (@guzmand)
5/14/17, 20:30 A strategists guide to #ArtificialIntelligence. @stratandbiz #AI #ML #industry40 #futureofwork #insurtech #fintech strategy-business.com/article/A-Stra… pic.twitter.com/p9aNiUE4ba

Thought For the Week

Please Enjoy This "Thought 4 the Week" as a token of our Appreciation.

Notations From the Grid (Special Weekly Edition): On #WannaCry (Good Reminders)

As the aftermath of #WannaCry continues, we wanted to feature this we received from the team at @McAfee that provides some key updated reminders for all:

Dear McAfee Customer, This past Friday we witnessed a coordinated global cyberattack known as WannaCry. It is one of the biggest cyberattacks that we have ever seen impacting over 150 countries and infecting more than 250,000 machines. WannaCry is a type of malicious software (malware) classified as ransomware. It encrypts essential files on your Windows device and requires that you pay a ransom to unlock those files. Although it primarily focuses on organizational or business networks - as was the case with WannaCry - you can do your part to stop the spread of this by doing the following: Since our security products are automatically updated, as a McAfee customer you are protected from this ransomware when you connect to the Internet and update your security software. As new variants of this ransomware arise, we will continuously update our software to keep you protected. You can confirm your McAfee security is up-to-date by following these instructions. Apply any Microsoft Windows security patches that Microsoft has sent you. If you are using an older version of Microsoft’s operating systems, such as Windows XP or Windows 8, click here to download emergency security patches from Microsoft. Be careful what you click on. This malware was distributed by phishing emails. You should only click on emails that you are sure came from a trusted source. Click here to learn more about phishing emails. Be sure to back up all your computing devices. Regularly backing up your devices helps you recover your information should your computer become infected with ransomware. We are actively working on a free decryption tool that, if successful, we will make it available as soon as possible. We are also working with law enforcement agencies around the world to understand who conducted this attack and will do everything we can to bring them to justice. You can learn more about WannaCry by clicking here. Sincerely, Gary J. Davis Chief Consumer Security Evangelist McAfee, LLC Follow me on Twitter @GaryJDavis for breaking cybersecurity news.

On the Eve of The New Week Before Us....

 As our team finished a newsflash on #WannaCry, we wanted to share some uplifting thoughts.   We believe that "This too shall pass" although we implore all to be careful out there as we have also been dealing with challenges in our network as well:

Onward to the New Week w/all its' possibilities....

An #Outsider Newsflash (Special Edition): @USCERT Indicators Associated With WannaCry Ransomware

 

National Cyber Awareness System:

TA17-132A: Indicators Associated With WannaCry Ransomware

05/12/2017 09:36 PM EDT

Original release date: May 12, 2017 | Last revised: May 15, 2017

Systems Affected

Microsoft Windows operating systems

Overview

According to numerous open-source reports, a widespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages.
The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicates a requested ransom of .1781 bitcoins, roughly $300 U.S.

This Alert is the result of efforts between the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) and the Federal Bureau of Investigation (FBI) to highlight known cyber threats. DHS and the FBI continue to pursue related information of threats to federal, state, and local government systems and as such, further releases of technical information may be forthcoming.

Description

Initial reports indicate the hacker or hacking group behind the WannaCry campaign is gaining access to enterprise servers either through Remote Desktop Protocol (RDP) compromise or through the exploitation of a critical Windows SMB vulnerability. Microsoft released a security update for the MS17-010 vulnerability on March 14, 2017. Additionally, Microsoft released patches for Windows XP, Windows 8, and Windows Server 2003 operating systems on May 13, 2017. According to open sources, one possible infection vector is via phishing emails.

Technical Details

Indicators of Compromise (IOC)

IOCs are provided within the accompanying .xlsx file of this report.

Yara Signatures

rule Wanna_Cry_Ransomware_Generic {        meta:               description = "Detects WannaCry Ransomware on Disk and in Virtual Page"               author = "US-CERT Code Analysis Team"               reference = "not set"                                                       date = "2017/05/12"        hash0 = "4DA1F312A214C07143ABEEAFB695D904"        strings:               $s0 = {410044004D0049004E0024}               $s1 = "WannaDecryptor"               $s2 = "WANNACRY"               $s3 = "Microsoft Enhanced RSA and AES Cryptographic"               $s4 = "PKS"               $s5 = "StartTask"               $s6 = "wcry@123"               $s7 = {2F6600002F72}               $s8 = "unzip 0.15 Copyrigh"               $s9 = "Global\WINDOWS_TASKOSHT_MUTEX"                      $s10 = "Global\WINDOWS_TASKCST_MUTEX"                $s11 = {7461736B736368652E657865000000005461736B5374617274000000742E776E7279000069636163}              $s12 = {6C73202E202F6772616E742045766572796F6E653A46202F54202F43202F5100617474726962202B68}              $s13 = "WNcry@2ol7"              $s14 = "wcry@123"              $s15 = "Global\MsWinZonesCacheCounterMutexA"        condition:               $s0 and $s1 and $s2 and $s3 or $s4 and $s5 and $s6 and $s7 or $s8 and $s9 and $s10 or $s11 and $s12 or $s13 or $s14 or $s15 } /*The following Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.*/ rule MS17_010_WanaCry_worm {        meta:               description = "Worm exploiting MS17-010 and dropping WannaCry Ransomware"               author = "Felipe Molina (@felmoltor)"               reference = "https://www.exploit-db.com/exploits/41987/"               date = "2017/05/12"        strings:               $ms17010_str1="PC NETWORK PROGRAM 1.0"               $ms17010_str2="LANMAN1.0"               $ms17010_str3="Windows for Workgroups 3.1a"               $ms17010_str4="__TREEID__PLACEHOLDER__"               $ms17010_str5="__USERID__PLACEHOLDER__"               $wannacry_payload_substr1 = "h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j"               $wannacry_payload_substr2 = "h54WfF9cGigWFEx92bzmOd0UOaZlM"               $wannacry_payload_substr3 = "tpGFEoLOU6+5I78Toh/nHs/RAP"        condition:               all of them }

Initial Analysis

The WannaCry ransomware received and analyzed by US-CERT is a loader that contains an AES-encrypted DLL. During runtime, the loader writes a file to disk named “t.wry”. The malware then uses an embedded 128-bit key to decrypt this file. This DLL, which is then loaded into the parent process, is the actual Wanna Cry Ransomware responsible for encrypting the user’s files. Using this cryptographic loading method, the WannaCry DLL is never directly exposed on disk and not vulnerable to antivirus software scans.
The newly loaded DLL immediately begins encrypting files on the victim’s system and encrypts the user’s files with 128-bit AES. A random key is generated for the encryption of each file.
The malware also attempts to access the IPC$ shares and SMB resources the victim system has access to. This access permits the malware to spread itself laterally on a compromised network. However, the malware never attempts to attain a password from the victim’s account in order to access the IPC$ share.
This malware is designed  to spread laterally on a network by gaining unauthorized access to the IPC$ share on network resources on the network on which it is operating.

Impact

Ransomware not only targets home users; businesses can also become infected with ransomware, leading to negative consequences, including

• temporary or permanent loss of sensitive or proprietary information,
• disruption to regular operations,
• financial losses incurred to restore systems and files, and
• potential harm to an organization’s reputation.

Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victim’s money, and in some cases, their banking information. In addition, decrypting files does not mean the malware infection itself has been removed.

Solution

Recommended Steps for Prevention

• Apply the Microsoft patch for the MS17-010 SMB vulnerability dated March 14, 2017.
• Enable strong spam filters to prevent phishing e-mails from reaching the end users and authenticate in-bound e-mail using technologies like Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) to prevent e-mail spoofing. 
• Scan all incoming and outgoing e-mails to detect threats and filter executable files from reaching the end users.
• Ensure anti-virus and anti-malware solutions are set to automatically conduct regular scans.
• Manage the use of privileged accounts. Implement the principle of least privilege. No users should be assigned administrative access unless absolutely needed. Those with a need for administrator accounts should only use them when necessary. 
• Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares. 
• Disable macro scripts from Microsoft Office files transmitted via e-mail. Consider using Office Viewer software to open Microsoft Office files transmitted via e-mail instead of full Office suite applications.
• Develop, institute and practice employee education programs for identifying scams, malicious links, and attempted social engineering.

• Have regular penetration tests run against the network. No less than once a year. Ideally, as often as possible/practical.
• Test your backups to ensure they work correctly upon use.

Recommended Steps for Remediation

• Contact law enforcement. We strongly encourage you to contact a local FBI field office upon discovery to report an intrusion and request assistance. Maintain and provide relevant logs.
• Implement your security incident response and business continuity plan. Ideally, organizations should ensure they have appropriate backups so their response is simply to restore the data from a known clean backup. 

Defending Against Ransomware Generally
Precautionary measures to mitigate ransomware threats include:

• Ensure anti-virus software is up-to-date.
• Implement a data back-up and recovery plan to maintain copies of sensitive or proprietary data in a separate and secure location. Backup copies of sensitive data should not be readily accessible from local networks.
• Scrutinize links contained in e-mails, and do not open attachments included in unsolicited e-mails.
• Only download software – especially free software – from sites you know and trust.
• Enable automated patches for your operating system and Web browser.

Report Notice
DHS and FBI encourages recipients who identify the use of tool(s) or techniques discussed in this document to report information to DHS or law enforcement immediately. We encourage you to contact DHS’s National Cybersecurity and Communications Integration Center (NCCIC) (NCCICcustomerservice@hq.dhs.gov or 888-282-0870), or the FBI through a local field office or the FBI’s Cyber Division (CyWatch@ic.fbi.gov or 855-292-3937) to report an intrusion and to request incident response resources or technical assistance.

References

• Malwarebytes LABS: "WanaCrypt0r ransomware hits it big just before the weekend
• Malwarebytes LABS: "The worm that spreads WanaCrypt0r"
• Microsoft: "Microsoft Security Bulletin MS17-010"
• Forbes: "An NSA Cyber Weapon Might Be Behind A Massive Global Ransomware Outbreak"
• Reuters: "Factbox: Don't click - What is the 'ransomware' WannaCry worm?"
• GitHubGist: "WannaCry|WannaDecrypt0r NSA-Cybereweapon-Powered Ransomware Worm"
• Microsoft: “Microsoft Update Catalog: Patches for Windows XP, Windows 8, and Windows Server 2003”, (KB4012598)

Revision History

• May 12, 2017: Initial post
• May 14, 2017: Corrected Syntax in the second Yara Rule
• May 14, 2017: Added Microsoft link to patches for Windows XP, Windows 8, and Windows Server 2003
• May 14, 2017: Corrected Syntax in the first Yara Rule

Notations On Our World (Weekly Edition): On The Possibilities

We begin this week with a "snapshot" of a "Vision of the Possible" from our recent archives courtesy of +Peter H. Diamandis and his team which will be a "weekly feature" of our "Vision Property".     We will be working on a mor "focused" approach to make sure we bring a true "Vision of the possible".

Onward!!

DJI's First-Person Goggles Look to the Future of Drone Flight

What it is: DJI recently developed first-person goggles that provide the wearer with a VR-like experience in the real world. The goggles have several screens that enable the user to see where the drone's camera is pointing, displaying a 1920x1080 image in front of each eye. The effect is incredible: "Wearing the goggles is like looking at a 216-inch home theater screen set about three meters away," as the company described. The DJI Goggles will retail for $449 and will start shipping this month.

Why it's important: The cost of MEMs, accelerometers and gyroscopes have dropped 10 to 100-fold at the same time that cheap and powerful microcontrollers enable low-cost and powerful navigational control systems. As a result, we now have drones that everyone can use, and companies like DJI are enabling both a consumer and entrepreneurial drone renaissance. Soon, further advances in exponential technologies, batteries and material sciences will create another tipping point in drone technology, making them smart, cheap, reliable, scalable (both small and large), and ultimately ubiquitous. Join the Discussion

Spotted by Aryadeep S. Acharya / Written by Sydney Fulkerson

Lyrebird Claims It Can Recreate Any Voice Using Just One Minute of Sample Audio

What it is: Lyrebird, a Canadian startup, has unveiled a set of AI algorithms capable of recreating a person's voice after just a single minute of sample audio. This is an order of magnitude improvement over other synthesized voice projects like Google's Wavenet and Adobe's VoCo, which are closer to the 20-minute mark. Lyrebird has incorporated emotional flexibility into its algorithms, allowing customers to create voices that are angry, stressed or sympathetic. Creating an initial voice-print requires considerable computing power, but voice creation is trivial -- 6,000 sentences in less than half a second.

Why it's important: We're approaching a time when we can edit and recreate voice just as we now do with images, enabling an explosion in our ability to develop conversational interfaces, lifelike AI's in virtual reality, and more emotionally present robotics. As more signals are digitized, we'll be able to apply machine learning principles to just about anything to generate new insights. Join the Discussion

Spotted by Dan Swift / Written by Jason Goodwin

Cable-Driven Robot Monitors Buildings As It Prints Them

What it is: The Spanish company Tecnalia and the Institute for Advanced Architecture of Catalonia (IAAC) have created a cable-driven 3D printer that can print a house and monitor its work as it moves. Using thermal sensors, the printer tracks how well the material is setting, which allows it to avoid laying down a new layer if the foundation has not yet dried. Currently, the printer only works in clay; Tecnalia's next project is to add cement-based printing. When mature, the technology will have use cases within aerospace, shipbuilding, nuclear power plants and general construction work.

Why it's important: We're seeing an explosion in 3D printing technologies at all sizes, from blood vessels to homes and bridges, and with a variety of media, from bacteria to glass, concrete and steel. Incorporating real-time monitoring adds yet another level of automation and quality control. What happens when construction companies can drop 3D printers like this one in several locations at once and remotely monitor multiple concurrent building projects? Join the Discussion

Spotted by Aryadeep S. Acharya / Written by Jason Goodwin

USA, China and Europe Announce New Space Bases and Interplanetary Missions

What it is: We've just seen two major commitments to space travel. Citing the need for international collaboration, China and the ESA are hoping to create a lunar city that could serve as a launching pad to Mars. By the end of the year, China plans to launch a mission to the Moon to bring back mineral samples, which the ESA and China would like for mission analysis. Separately, NASA announced more detailed plans to put humans on Mars by the year 2033. Proceeding in four phases, NASA will first develop a new set of SLS rockets from 2018 to 2025, which will deliver cargo to a new space station near the Moon called the Deep Space Gateway (DSG). A Deep Space Transport Tube will follow in 2028 or 2029. After astronauts have lived in the DST for 400 days, a separate Mars crew will arrive to restock the DST and launch for Mars in 2033.

Why it's important: These announcements highlight the need for international collaboration and accelerate the momentum of interplanetary exploration and travel. They also signal that the press created by companies like SpaceX, Planetary Resources, Blue Origin and Virgin Galactic have succeeded in galvanizing a broader movement. Join the Discussion

Spotted by Gaetan Soltesz / Written by Jason Goodwin

Robots Are Coming for Your Wardrobe

What it is: Founded by husband and wife Ashwini Asokan and Chandrasekaran, Mad Street Den is a startup developing AI-assisted tools for online retailers comprised of computer vision algorithms to suggest items of clothing for shoppers. The tool analyzes items the shopper is browsing -- starting with minor details like colors, patterns, necklines and sleeve length -- and then provides "dynamic personalization" during their online shopping experience. In an internal study, the couple found that online shoppers spent 72 minutes on websites where Mad Street Den's software was deployed, compared to 25 minutes on sites without it. The company recently raised an undisclosed Series A round of funding from Sequoia Capital India in addition to existing investments from Exfinity Ventures and growX Ventures.

Why it's important: AI will be woven into the very fabric of our lives, physically and virtually. AI's will push forward the ideas of transparency, and of seamless interaction with devices and information, making everything personalized -- even our wardrobes. AI's have the potential to transform the future of online shopping into a more efficient, personalized, and hassle-free experience. Join the Discussion

Spotted by Kim Butler / Written by Sydney Fulkerson

India Unveils Ambitious Plan to Have Only Electric Cars By 2030

What it is: At the Confederation of Indian Industry (CII) Annual Session in New Delhi, power minister Piyush Goyal announced India's ambitious plan to have only electric cars by 2030. The plan to eliminate any sale of a single petrol or diesel car aligns with Prime Minister Narendra Modi's "New India" vision. Goyal stated that the government would help support the electric car industry during the first two to three years; thereafter, he sees the industry running independently. India will begin its infrastructure changes by focusing on the country's most highly polluted areas.

Why it's important: Electric vehicles (EVs) are taking the transportation industry by storm. Within the next two decades, EVs will undoubtedly be the cheapest and most widely used vehicles on the market. By roughly 2030 -- the very year India plans to cease any further sales of petrol or diesel cars -- EVs with a 200+ mile range will be cheaper than the cheapest car sold in the U.S. in 2015. India's plan demonetizes the cost of transportation and drastically reduces air pollution. Join the Discussion

Notations On Our World (W-End Special Edition): On #WannaCry Ransomware & Being Safe Virtually

We here at #Outsiders had to deal with malware over the last number of weeks--we were able to escape a more serious problem as we went ahead and reset all network and had backup available to be able to have access to our on-going data.     We are seeing reports, though, that over 200,000 people have been affected in some 70 countries.    It appears that Monday will cause more havoc around the World.   What US-CERT sent out was critical that we wanted to report on here.

Please be safe out there!!!

National Cyber Awareness System:

TA17-132A: Indicators Associated With WannaCry Ransomware

05/12/2017 09:36 PM EDT

Original release date: May 12, 2017 | Last revised: May 13, 2017

Systems Affected

Microsoft Windows operating systems

Overview

According to numerous open-source reports, a widespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages.
The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicates a requested ransom of .1781 bitcoins, roughly $300 U.S.

This Alert is the result of efforts between the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) and the Federal Bureau of Investigation (FBI) to highlight known cyber threats. DHS and the FBI continue to pursue related information of threats to federal, state, and local government systems and as such, further releases of technical information may be forthcoming.

Description

Initial reports indicate the hacker or hacking group behind the WannaCry campaign is gaining access to enterprise servers either through Remote Desktop Protocol (RDP) compromise or through the exploitation of a critical Windows SMB vulnerability. Microsoft released a security update for the MS17-010 vulnerability on March 14, 2017. According to open sources, one possible infection vector is via phishing emails.

Technical Details

Indicators of Compromise (IOC)

IOCs are provided within the accompanying .xls file of this report.

Yara Signatures

rule Wanna_Cry_Ransomware_Generic {        meta:               description = "Detects WannaCry Ransomware on disk and in virtual page"               author = "US-CERT Code Analysis Team"               reference = "not set"                                                       date = "2017/05/12"        hash0 = "4DA1F312A214C07143ABEEAFB695D904"               strings:               $s0 = {410044004D0049004E0024}               $s1 = "WannaDecryptor"               $s2 = "WANNACRY"               $s3 = "Microsoft Enhanced RSA and AES Cryptographic"               $s4 = "PKS"               $s5 = "StartTask"               $s6 = "wcry@123"               $s7 = {2F6600002F72}               $s8 = "unzip 0.15 Copyrigh"        condition:               $s0 and $s1 and $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 } /*The following Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. rule MS17_010_WanaCry_worm {        meta:               description = "Worm exploiting MS17-010 and dropping WannaCry Ransomware"               author = "Felipe Molina (@felmoltor)"                      reference = "https://www.exploit-db.com/exploits/41987/"                            date = "2017/05/12"        strings:               $ms17010_str1="PC NETWORK PROGRAM 1.0"               $ms17010_str2="LANMAN1.0"               $ms17010_str3="Windows for Workgroups 3.1a"               $ms17010_str4="__TREEID__PLACEHOLDER__"               $ms17010_str5="__USERID__PLACEHOLDER__"               $wannacry_payload_substr1 = "h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j"               $wannacry_payload_substr2 = "h54WfF9cGigWFEx92bzmOd0UOaZlM"               $wannacry_payload_substr3 = "tpGFEoLOU6+5I78Toh/nHs/RAP"        condition:               all of them }

Initial Analysis

The WannaCry ransomware received and analyzed by US-CERT is a loader that contains an AES-encrypted DLL. During runtime, the loader writes a file to disk named “t.wry”. The malware then uses an embedded 128-bit key to decrypt this file. This DLL, which is then loaded into the parent process, is the actual Wanna Cry Ransomware responsible for encrypting the user’s files. Using this cryptographic loading method, the WannaCry DLL is never directly exposed on disk and not vulnerable to antivirus software scans.
The newly loaded DLL immediately begins encrypting files on the victim’s system and encrypts the user’s files with 128-bit AES. A random key is generated for the encryption of each file.
The malware also attempts to access the IPC$ shares and SMB resources the victim system has access to. This access permits the malware to spread itself laterally on a compromised network. However, the malware never attempts to attain a password from the victim’s account in order to access the IPC$ share.
This malware is designed  to spread laterally on a network by gaining unauthorized access to the IPC$ share on network resources on the network on which it is operating.

Impact

Ransomware not only targets home users; businesses can also become infected with ransomware, leading to negative consequences, including

• temporary or permanent loss of sensitive or proprietary information,
• disruption to regular operations,
• financial losses incurred to restore systems and files, and
• potential harm to an organization’s reputation.

Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victim’s money, and in some cases, their banking information. In addition, decrypting files does not mean the malware infection itself has been removed.

Solution

Recommended Steps for Prevention

• Apply the Microsoft patch for the MS17-010 SMB vulnerability dated March 14, 2017.
• Enable strong spam filters to prevent phishing e-mails from reaching the end users and authenticate in-bound e-mail using technologies like Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) to prevent e-mail spoofing. 
• Scan all incoming and outgoing e-mails to detect threats and filter executable files from reaching the end users.
• Ensure anti-virus and anti-malware solutions are set to automatically conduct regular scans.
• Manage the use of privileged accounts. Implement the principle of least privilege. No users should be assigned administrative access unless absolutely needed. Those with a need for administrator accounts should only use them when necessary. 
• Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares. 
• Disable macro scripts from Microsoft Office files transmitted via e-mail. Consider using Office Viewer software to open Microsoft Office files transmitted via e-mail instead of full Office suite applications.
• Develop, institute and practice employee education programs for identifying scams, malicious links, and attempted social engineering.

• Have regular penetration tests run against the network. No less than once a year. Ideally, as often as possible/practical.
• Test your backups to ensure they work correctly upon use.

Recommended Steps for Remediation

• Contact law enforcement. We strongly encourage you to contact a local FBI field office upon discovery to report an intrusion and request assistance. Maintain and provide relevant logs.
• Implement your security incident response and business continuity plan. Ideally, organizations should ensure they have appropriate backups so their response is simply to restore the data from a known clean backup. 

Defending Against Ransomware Generally
Precautionary measures to mitigate ransomware threats include:

• Ensure anti-virus software is up-to-date.
• Implement a data back-up and recovery plan to maintain copies of sensitive or proprietary data in a separate and secure location. Backup copies of sensitive data should not be readily accessible from local networks.
• Scrutinize links contained in e-mails, and do not open attachments included in unsolicited e-mails.
• Only download software – especially free software – from sites you know and trust.
• Enable automated patches for your operating system and Web browser.

Report Notice
DHS and FBI encourages recipients who identify the use of tool(s) or techniques discussed in this document to report information to DHS or law enforcement immediately. We encourage you to contact DHS’s National Cybersecurity and Communications Integration Center (NCCIC) (NCCICcustomerservice@hq.dhs.gov or 888-282-0870), or the FBI through a local field office or the FBI’s Cyber Division (CyWatch@ic.fbi.gov or 855-292-3937) to report an intrusion and to request incident response resources or technical assistance.

References

• Malwarebytes LABS: "WanaCrypt0r ransomware hits it big just before the weekend
• Malwarebytes LABS: "The worm that spreads WanaCrypt0r"
• Microsoft: "Microsoft Security Bulletin MS17-010"
• Forbes: "An NSA Cyber Weapon Might Be Behind A Massive Global Ransomware Outbreak"
• Reuters: "Factbox: Don't click - What is the 'ransomware' WannaCry worm?"
• GitHubGist: "WannaCry|WannaDecrypt0r NSA-Cybereweapon-Powered Ransomware Worm"

Revision History

• May 12, 2017: Initial post

On This #MothersDay2017.....

In Honor of Mothers' Day, we wanted to share a series of uplifting thoughts of Hope and optimism here at #Outsiders courtesy of +Jonathan Huie & his team and others as we wish all the most joyous of Mothers' Day Weekends...

The soul would have no rainbow,
Had the eyes no tears.
- John Vance Cheney

The rainbow will remind me of the covenant between God and all living creatures.
- Genesis 9:16

Give thanks for the rain in your life
which waters the flowers of your soul.
- Jonathan Lockwood Huie

And when it rains on your parade, look up rather than down.
Without the rain, there would be no rainbow.
- Gilbert K. Chesterton 

“Close your eyes and imagine
the best version of you possible.
That’s who you really are,
let go of any part of you
that doesn’t believe it.”
~ C. Assaad

Do You Want Your Coffee in Your Phone?

Now it is "kind of possible"?

Enjoy!!

View of the Week: On The Possibilities of Space

As a new week dawns, our team chose this courtesy of the team at @CBINSIGHTS on Space as there is a talk of going to the Moon again, establishing a base on Mars and exploring the Asteroids.     We could not help but wonder who will be first!! 

As A New Week Dawns: A Special Musical Interlude w/ Helwa ya Baladi Arabic Lyrics with English Translation

As a new week dawns, our team chose this for our "Visions" property--the tribute is to Egypt however the beauty of having a Vision about our World and the desire for a better World is at the heart of it all as we wish all a fabulous Week.

The Outsider Virtual Musical Interlude: Sting Performs Brand New Day

On the eve of the WeekEnd, please enjoy this selection from our artist of the week, Sting:

An #Outsider Newsflash (Special Edition): On @Google Docs Phishing Campaign

FYI as our team here was one of the 1 Million Users affected...FYI as we feature this on all our properties:

National Cyber Awareness System:

Google Docs Phishing Campaign

05/04/2017 03:08 PM EDT

Original release date: May 04, 2017US-CERT is aware of a phishing campaign that affected Google Docs users. The campaign used spoofed email addresses to target users with emails purporting to share a document for collaboration. Once the targeted users accepted invitations, they were encouraged to allow the phishing program access to their email accounts. Google has taken action to protect users, including removing the fake Google Docs pages and disabling the offending accounts.
US-CERT reminds users that they play a critical role in protecting their organizations and themselves from cyber threats. Users should:

• Be careful when clicking directly on links in emails, even if the sender appears to be known; attempt to verify web addresses independently (e.g., contact your organization's helpdesk or search the Internet for the main website of the organization or topic mentioned in the email).
• Exercise caution when opening email attachments. Be particularly wary of compressed or ZIP file attachments.
• Immediately report any suspicious emails to your information technology (IT) helpdesk, security office, or email provider.

Users of Google Docs are encouraged to review Google's statement and US-CERT's Tip on Avoiding Social Engineering and Phishing Attacks for more information. You can report any suspected phishing emails to the anti-phishing group APWG.