Tag Archives: Ukraine

Ukraine finally battens down its leaky cyber hatches after attacks

FILE PHOTO: A message demanding money is seen on a monitor of a payment terminal at a branch of Ukraine's state-owned bank Oschadbank after Ukrainian institutions were hit by a wave of cyber attacks earlier in the day, in Kiev, Ukraine, June 27, 2017. REUTERS/Valentyn Ogirenko/File Photo

By Matthias Williams

KIEV (Reuters) – When the chief of Microsoft Ukraine switched jobs to work for President Petro Poroshenko, he found that everyone in the office used the same login password. It wasn’t the only symptom of lax IT security in a country suffering crippling cyber attacks.

Sometimes pressing the spacebar was enough to open a PC, according to Dmytro Shymkiv, who became Deputy Head of the Presidential Administration with a reform brief in 2014.

Today discipline is far tighter in the president’s office. But Ukraine – regarded by some, despite Kremlin denials, as a guinea pig for Russian state-sponsored hacks – is fighting an uphill battle in turning pockets of protection into a national strategy to keep state institutions and systemic companies safe.

As in many aspects of Ukrainian life, corruption is a problem. Most computers run on pirated software, and even when licensed programs are used, they can be years out of date and lack security patches to help keep the hackers at bay.

Three years into the job, Shymkiv is leading the fight back. He has put together a team, led by a former Microsoft colleague, doing drills, sending out email bulletins to educate staff on new viruses and doing practice hacks offsite.

In the early days, staff complacency and resistance to change were as much a problem as insecure equipment.

“I remember the first weeks when we forced people to do a password change,” Shymkiv told Reuters. “My team heard all kind of screams and disrespectful messages … Over three years, it’s a different organization.”

The team’s small office has a screen with dials, charts and a green spider web showing activity on the network. If there is an attack, a voice shouts “major alarm!” in English, a recording the team downloaded from YouTube.

Eliminating bad practices and introducing good ones is the reason, Shymkiv believes, why the presidential administration was immune to a June 27 virus that spread from Ukraine to cause disruption in companies as far away as India and Australia.

But the country still has a long way to go. Since 2014 repeated cyber attacks have knocked out power supplies, frozen supermarket tills, affected radiation monitoring at the stricken Chernobyl nuclear power plant, and forced the authorities to prop up the hryvnia currency after banks’ IT systems crashed.

Even Poroshenko’s election that year was compromised by a hack on the Central Election Commission’s network, trying to proclaim victory for a far-right candidate — a foretaste of alleged meddling in the 2016 U.S. presidential election.

Ukraine believes the attacks are part of Russia’s “hybrid war” waged since protests in 2014 moved Ukraine away from Moscow’s orbit and closer to the West. Moscow has denied running hacks on Ukraine.

Shymkiv said the task is to “invest in my team, and upgrade them, and teach them, and connect them with other organizations who are doing the right things”.

“If you do nothing like this, you probably will be wiped out,” he added.

The head of Shymkiv’s IT team, Roman Borodin, said the administration is hit by denial-of-service (DDoS) attacks around once every two weeks, and by viruses specifically designed to target it. The hackers seem mainly interested in stealing information from the defense and foreign relations departments, Borodin told Reuters in his first ever media interview.

HONOR AT STAKE

Bruised by past experiences, Ukraine is protecting itself better.

Finance Minister Oleksandr Danylyuk told Reuters his ministry overhauled security after a hack in November crashed 90 percent of its network at the height of budget preparations.

Officials couldn’t log into the system that manages budget transactions for 48 hours, something that played on Danylyuk’s mind as he addressed the Verkhovna Rada or parliament.

“Imagine that, knowing this, I went to the Verkhovna Rada to present the budget – the main financial document on which 45 million people live – and at the same time I was thinking about how to save not only the document itself, but also the honor of the ministry,” he said.

“I understood that if I showed even the slightest hint of our nervousness, the organizers of the attack would achieve their goal.”

Consultants uncovered familiar weaknesses: the budget system operated on a platform dating from 2000, and the version of the database management system should have been upgraded in 2006.

The ministry is introducing new systems to detect anomalies and to improve data protection. “We’re completely revising and restructuring the ministry’s IT landscape,” Danylyuk said.

The ministry emerged unscathed from the June 27 attack. Others weren’t so lucky: Deputy Prime Minister Pavlo Rozenko tweeted a picture of a crashed computer in the cabinet office that same day.

Ukraine is also benefiting from help from abroad.

A cyber police force was set up in 2015 with British funding and training in a project coordinated by the Organization for Security and Co-operation in Europe (OSCE).

While Ukraine is not a NATO member, the Western alliance supplied equipment to help piece together who was behind the June attack and is helping the army set up a cyber defense unit.

Ukraine shares intelligence with neighboring Moldova, another ex-Soviet state that has antagonized Moscow by moving closer to the West and complains of persistent Russian cyber attacks on its institutions.

“At the beginning of this year we had attacks on state-owned enterprises. If it were not for cooperation with the guys from Moldova, we would not have identified these criminals,” Serhiy Demedyuk, the head of the Ukrainian cyber police, told Reuters.

Demedyuk said the attack had been staged by a Russian citizen using a server in Moldova, but declined to give further details.

LAYING DOWN THE LAW

While there has been progress in some areas, Ukraine is still fighting entrenched problems. No less than 82 percent of software is unlicensed, compared with 17 percent in the United States, according to a 2016 survey by the Business Software Alliance, a Washington-based industry group.

Experts say pirated software was not the only factor in the June attack, which also hit up-to-date computers, but the use of unlicensed programs means security patches which could limit the rapid spread of such infections cannot be applied.

Ukraine ranked 60 out of 63 economies in a 2017 survey on digital competitiveness by the International Institute for Management Development. The low ranking is tied to factors such as a weak regulatory framework.

Another problem is that Ukraine has no single agency in charge of ensuring that state bodies and companies of national importance, such as banks, are protected.

This surfaced on June 27, when the NotPetya virus penetrated the company that produces M.E.Doc, an accounting software used by around 80 percent of Ukrainian businesses.

“Locally, the weak spot is accounting, but more generally it is the lack of cyber defenses at a government level. There aren’t agencies analyzing risks at a government level,” said Aleksey Kleschevnikov, the owner of internet provider Wnet, which hosted M.E.Doc’s servers.

Valentyn Petrov, head of the information security department at the National Security and Defence Council, said the state cannot interfere with companies’ security.

“It’s a total disaster from our perspective,” he told Reuters. “All state companies, including state banks, have suffered from attacks, and we really have no influence on them – neither on issuing regulations or checking how they fulfill these regulations.”

Poroshenko signed a decree in February to improve protection of critical institutions. This proposed legislation to spell out which body was in charge of coordinating cyber security and a unified methodology for assessing threats.

The law failed to gather enough votes the day before parliament’s summer recess in July, and MPs voted against extending the session. Shymkiv called that a “big disgrace”.

He added that in many ministries and firms, “we’ve seen very little attention to the IT infrastructures, and it’s something that’s been lagging behind for years”.

Attitudes can be slow to change. Borodin said a policy at the administration to lock computer screens after 15 minutes of inactivity was greeted with indignation. One staffer pointed out that their room was protected by an armed guard.

The staffer said “‘I have a guy with a weapon in my room. Who can steal information from this computer?'” Borodin recounted.

(Additional reporting by Pavel Polityuk, Jack Stubbs, Natalia Zinets and Margaryta Chornokondratenko in Kiev, Eric Auchard in Frankfurt and David Mardiste in Tallinn; editing by David Stamp)

U.S. general says allies worry Russian war game may be ‘Trojan horse’

U.S Army Europe Commanding General Ben Hodges speaks during the inauguration ceremony of bilateral military training between U.S. and Polish troops in Zagan, Poland, January 30, 2017. REUTERS/Kacper Pempel

By Andrea Shalal

BERLIN (Reuters) – U.S. allies in eastern Europe and Ukraine are worried that Russia’s planned war games in September could be a “Trojan horse” aimed at leaving behind military equipment brought into Belarus, the U.S. Army’s top general in Europe said on Thursday.

Russia has sought to reassure NATO that the military exercises will respect international limits on size, but NATO and U.S. official remain wary about their scale and scope.

U.S. Army Lieutenant General Ben Hodges, who heads U.S. Army forces in Europe, told Reuters in an interview that allied officials would keep a close eye on military equipment brought in to Belarus for the Zapad 2017 exercise, and whether it was removed later.

“People are worried, this is a Trojan horse. They say, ‘We’re just doing an exercise,’ and then all of a sudden they’ve moved all these people and capabilities somewhere,” he said.

Hodges said he had no indications that Russia had any such plans, but said greater openness by Moscow about the extent of its war games would help reassure countries in eastern Europe.

A senior Russian diplomat strongly rejected allegations that Moscow could leave military equipment in Belarus.

“This artificial buffoonery over the routine Zapad-2017 exercises is aimed at justifying the sharp intensification of the NATO bloc (activities) along the perimeter of Russian territory,” Russian Deputy Foreign Minister Grigory Karasin told the Interfax news agency on Friday.

NATO allies are nervous because previous large-scale Russian exercises employed special forces training, longer-range missiles and unmanned aerial vehicles.

Such tactics were later used in Russia’s annexation of Crimea in 2014, its support for separatists in eastern Ukraine and in its intervention in Syria, NATO diplomats say.

Hodges said the United States and its allies had been very open about a number of military exercises taking place across eastern Europe this summer involving up to 40,000 troops, but it remained unclear if Moscow would adhere to a Cold War-era treaty known as the Vienna document, which requires observers for large-scale exercises involving more than 13,000 troops.

Some NATO allies believe the Russian exercise could number more than 100,000 troops and involve nuclear weapons training, the biggest such exercise since 2013.

Russia has said it would invite observers if the exercise exceeded 13,000 forces.

Hodges said NATO would maintain normal rotations during the Russian war game, while carrying out previously scheduled exercises in Sweden, Poland and Ukraine.

The only additional action planned during that period was a six-week deployment of three companies of 120 paratroopers each to Estonia, Latvia and Lithuania for “low-level” exercises, Hodges said.

“We want to avoid anything that looks like a provocation. This is not going to be the ‘Sharks’ and the ‘Jets’ out on the streets,” Hodges said in a reference to the gang fights shown in the 1961 film “West Side Story” set in New York City.

(Reporting by Andrea Shalal; Additional reporting by Dmitry Solovyov in Moscow; Editing by Hugh Lawson)

Ukraine software firm says computers compromised after cyber attack

FILE PHOTO - A projection of cyber code on a hooded man is pictured in this illustration picture taken on May 13, 2017. REUTERS/Kacper Pempel/Illustration

KIEV (Reuters) – The Ukrainian software firm at the center of a cyber attack that spread around the world last week said on Wednesday that computers which use its accounting software are compromised by a so-called “backdoor” installed by hackers during the attack.

The backdoor has been installed in every computer that wasn’t offline during the cyber attack, said Olesya Bilousova, the chief executive of Intellect Service, which developed M.E.Doc, Ukraine’s most popular accounting software.

Last week’s cyber attack spread from Ukraine and knocked out thousands of computers, disrupting shipping and shut down a chocolate factory in Australia as it reached dozens of countries around the world.

Ukrainian politicians were quick to blame Russia for a state-sponsored hack, which Moscow denied, while Ukranian cyber police and some experts say the attack was likely a smokescreen for the hackers to install new malware.

The Ukrainian police have seized M.E.Doc’s servers and taken them offline. On Wednesday morning they advised every computer using M.E.Doc software to be switched off. M.E.Doc is installed in around 1 million computers in Ukraine, Bilousova said.

“… the fact is that this backdoor needs to be closed. There was a hacking of servers,” Bilousova told reporters.

“As of today, every computer which is on the same local network as our product is a threat. We need to pay the most attention to those computers which weren’t affected (by the attack). The virus is on them waiting for a signal. There are fingerprints on computers which didn’t even use our product.”

(Reporting by Jack Stubbs; writing by Matthias Williams; Editing by Toby Chopra)

Police seize servers of Ukrainian software firm after cyber attack

A view shows a laptop display (R) showing part of a code, which is the component of Petya malware computer virus according to representatives of Ukrainian cyber security firm ISSP, with an employee working nearby at the firm's office in Kiev, Ukraine July 4, 2017. REUTERS/Valentyn Ogirenko

By Jack Stubbs and Pavel Polityuk

KIEV (Reuters) – Ukrainian police on Tuesday seized the servers of an accounting software firm suspected of spreading a malware virus which crippled computer systems at major companies around the world last week, a senior police official said.

The head of Ukraine’s Cyber Police, Serhiy Demedyuk, told Reuters the servers of M.E.Doc – Ukraine’s most popular accounting software – had been seized as part of an investigation into the attack.

Though they are still trying to establish who was behind last week’s attack, Ukrainian intelligence officials and security firms have said some of the initial infections were spread via a malicious update issued by M.E.Doc, charges the company’s owners deny.

The owners were not immediately available for comment on Tuesday.

Premium Service, which says it is an official dealer of M.E.Doc’s software, wrote a post on M.E.Doc’s Facebook page saying masked men were searching M.E.Doc’s offices and that the software firm’s servers and services were down.

Premium Service could not be reached for further comment.

Cyber Police spokeswoman Yulia Kvitko said investigative actions were continuing at M.E.Doc’s offices, adding that further comment would be made on Wednesday.

The police move came after cyber security investigators unearthed further evidence on Tuesday that the attack had been planned months in advance by highly-skilled hackers, who they said had inserted a vulnerability into the M.E.Doc progamme.

Ukraine also took steps on Tuesday to extend its state tax deadline by one month to help businesses hit by the malware assault.

Researchers at Slovakian security software firm ESET said they had found a “backdoor” written into some of M.E.Doc’s software updates, likely with access to the company’s source code, which allowed hackers to enter companies’ systems undetected.

“VERY STEALTHY AND CUNNING”

“We identified a very stealthy and cunning backdoor that was injected by attackers into one of M.E.Doc’s legitimate modules,” ESET senior malware researcher Anton Cherepanov said in a technical note. “It seems very unlikely that attackers could do this without access to M.E.Doc’s source code.”

“This was a thoroughly well-planned and well-executed operation,” he said.

ESET said at least three M.E.Doc updates had been issued with the “backdoor vulnerability”, and the first one was sent to clients on April 14, more than two months before the attack.

ESET said the hackers likely had access to M.E.Doc’s source code since the beginning of the year, and the detailed preparation before the attack was testament to the advanced nature of their operation.

Oleg Derevianko, board chairman at Ukrainian cyber security firm ISSP, said an update issued by M.E.Doc in April delivered a virus to the company’s clients which instructed computers to download 350 megabytes of data from an unknown source on the internet.

The virus then exported 35 megabytes of company data to the hackers, he told Reuters in an interview at his office in Kiev.

“With this 35 megabytes you can exfiltrate anything – emails from all of the banks, user accounts, passwords, anything.”

Little known outside Ukrainian accounting circles, M.E.Doc is used by around 80 percent of companies in Ukraine. The software allows its 400,000 clients to send and collaborate on financial documents between internal departments, as well as file them with the Ukrainian state tax service.

Ukraine’s government said on Tuesday it would submit a draft law to parliament for the country’s tax deadline to be extended to July 15, and waive fines for companies who missed the previous June 13 cutoff because of the attack.

“We had program failures in connection to the cyber attack, which meant that businesses were unable to submit account reports on time,” Prime Minister Volodymyr Groysman told a cabinet meeting.

Separately, Ukraine’s security service, the SBU, said it had discussed cyber defense with NATO officials and had received equipment from the alliance to better combat future cyber attacks. Ukraine is not in NATO but is seeking closer ties.

On Saturday Ukrainian intelligence officials accused Russian security services of being behind the attack, and cyber security researchers linked it to a suspected Russian group who attacked the Ukrainian power grid in December 2016.

A Kremlin spokesman dismissed charges of Russian involvement as “unfounded blanket accusations”.

Derevianko said the hacker’s activity in April and reported access to M.E.Doc’s source code showed Ukraine’s computer networks had already been compromised and that the intruders were still operating inside them.

“It definitely tells us about the advanced capabilities of the adversaries,” he said. “I don’t think any additional evidence is needed to attribute this to a nation-state attack.”

(Additional reporting by Natalia Zinets; Writing by Jack Stubbs; Editing by Gareth Jones and Matthias Williams)

Family firm in Ukraine says it was not responsible for cyber attack

Sergei Linnik, general director of Ukrainian software development firm Intellect Service, and his daughter Olesya pose for a picture at the company’s offices in Kiev, Ukraine July 3, 2017. REUTERS/Pavel Polityuk

By Jack Stubbs and Pavel Polityuk

KIEV (Reuters) – Ukrainian company Intellect Service was not responsible for last week’s international cyber attack that brought down the computer systems of several major companies, the father and daughter team told Reuters on Monday.

Cyber security investigators are still trying to establish who was behind the attack.

But Ukrainian officials and security firms including Microsoft <MSFT.O>, Cisco’s <CSCO.O> Talos and Symantec <SYMC.O> say they have confirmed that some of the initial infections occurred when malware was transmitted to users of a Ukrainian tax software program called M.E.Doc.

They say the virus, dubbed NotPetya by some experts, was primarily spread via an update issued by M.E.Doc, the accounting software developed by Olesya Linnik and her father Sergei at his company, Intellect Service.

In their first interview with foreign media since the attack, the Linniks said there was no evidence M.E.Doc, which is Ukraine’s most-popular accounting software, was used to spread the virus and they did not understand the charges against them.

“What has been established in these days, when no one slept and only worked? We studied and analysed our product for signs of hacking – it is not infected with a virus and everything is fine, it is safe,” said Olesya, managing partner at Intellect Service.

“The update package, which was sent out long before the virus was spread, we checked it 100 times and everything is fine.”

Little known outside Ukrainian accounting circles, M.E.Doc is an everyday part of life at around 80 percent of companies in Ukraine. The software allows its 400,000 clients to send and discuss financial documents between internal departments, as well as file them with the Ukrainian state tax service.

POLICE INVESTIGATING

Investigators have said M.E.Doc’s expansive reach is what made it a prime target for the unknown hackers, who were looking for a way to infect as many victims as possible.

“These malware families were spread using Ukrainian accounting software called M.E.Doc,” researchers at Slovakian security software firm ESET said in a blog post on Friday.

“M.E.Doc has an internal messaging and document exchange system so attackers could send spearphishing messages to victims.”

Ukrainian police said on Monday the Linniks could now face criminal charges if it is confirmed they knew about the infection but took no action.

“We have issues with the company’s leadership, because they knew there was a virus in their software but didn’t do anything … if this is confirmed, we will bring charges,” Serhiy Demedyuk, the head of Ukraine’s cyber police, told Reuters in a text message.

Speaking before Demedyuk’s comments at the company’s modest offices on an industrial estate in Kiev, Sergei, Intellect Service’s general director, raised his voice in frustration.

“We built this business over 20 years. What is the point of us killing our own business?”

Olesya said the company was cooperating with investigators and the police were yet to reach any conclusions.

“The cyber police are currently bogged down in the investigation, we gave them the logs of all our servers and there are no traces that our servers spread this virus,” she said.

“M.E.Doc is a transportation product, it delivers documents. But is an email program guilty in the distribution of a virus? Hardly.”

(Writing by Jack Stubbs; Editing by Anna Willard)

Ukraine points finger at Russian security services in recent cyber attack

FILE PHOTO: A message demanding money is seen on a monitor of a payment terminal at a branch of Ukraine's state-owned bank Oschadbank after Ukrainian institutions were hit by a wave of cyber attacks, in Kiev, Ukraine, June 27, 2017. REUTERS/Valentyn Ogirenko

By Pavel Polityuk

KIEV (Reuters) – Ukraine said on Saturday that Russian security services were involved in a recent cyber attack on the country, with the aim of destroying important data and spreading panic.

The SBU, Ukraine’s state security service, said the attack, which started in Ukraine and spread around the world on Tuesday, was by the same hackers who attacked the Ukrainian power grid in December 2016. Ukrainian politicians were quick to blame Russia for Tuesday’s attack, but a Kremlin spokesman dismissed “unfounded blanket accusations”.

Cyber security firms are trying to piece together who was behind the computer worm, dubbed NotPetya by some experts, which conked out computers, hit banks, disrupted shipping and shut down a chocolate factory in Australia.

The attack also hit major Russian firms, leading some cyber security researchers to suggest that Moscow was not behind it.

The malicious code in the virus encrypted data on computers, and demanded victims pay a $300 ransom, similar to the extortion tactic used in a global WannaCry ransomware attack in May. But Ukrainian officials and some security experts say the ransomware feature was likely a smokescreen.

Relations between Ukraine and Russia went into freefall after Moscow’s annexation of Crimea in 2014 and the subsequent outbreak of a Kremlin-backed separatist insurgency in eastern Ukraine that has killed more than 10,000 people.

Hacking Ukrainian state institutions is part of what Ukraine says is a “hybrid war” by Russia on Kiev. Russia denies sending troops or military equipment to eastern Ukraine.

“The available data, including those obtained in cooperation with international antivirus companies, give us reason to believe that the same hacking groups are involved in the attacks, which in December 2016 attacked the financial system, transport and energy facilities of Ukraine using TeleBots and BlackEnergy,” the SBU said.

“This testifies to the involvement of the special services of Russian Federation in this attack.”

The SBU in an earlier statement on Friday said it had seized equipment it said belonged to Russian agents in May and June to launch cyber attacks against Ukraine and other countries.

Referencing the $300 ransomware demand, the SBU said “the virus is cover for a large-scale attack on Ukraine. This is evidenced by a lack of a real mechanism for taking possession of the funds … enrichment was not the aim of the attack.”

“The main purpose of the virus was the destruction of important data, disrupting the work of public and private institutions in Ukraine and spreading panic among the people.”

A cyber attack in December on a Ukrainian state energy computer caused a power cut in the northern part of the capital Kiev.

The Russian foreign ministry and Federal Security Service did not immediately respond to requests for comment on the latest allegations.

Russian oil major Rosneft <ROSN.MM> was one of the first companies to reveal it had been compromised by the virus and sources told Reuters on Thursday computers at state gas giant Gazprom <GAZP.MM> had also been infected.

The SBU’s accusations chime with some of the findings of the cyber security firm ESET in Slovakia, which said in research published online on Friday that the Telebots group — which has links to BlackEnergy — was behind the attack.

“Collecting ransom money was never the top priority for the TeleBots group,” it said, suggesting Ukraine was the target but the virus spread globally as “affected companies in other countries had VPN connections to their branches, or to business partners, in Ukraine.”

“The TeleBots group continues to evolve in order to conduct disruptive attacks against Ukraine,” it said.

“Prior to the outbreak, the Telebots group targeted mainly the financial sector. The latest outbreak was directed against businesses in Ukraine, but they apparently underestimated the malware’ spreading capabilities. That’s why the malware went out of control.”

(Additional reporting by Alexander Winning in Moscow and Jim Finkle in Toronto; writing by Matthias Williams; Editing by Jeremy Gaunt)

Venezuela’s shield-bearing protesters inspired by Ukraine

A demonstrator holding a rudimentary shield poses for a picture before a rally against Venezuelan President Nicolas Maduro's government in Caracas, Venezuela, May 27, 2017. He said: "I protest, because I want a better future for me and my family, because it hurts to get up every day and have my mother crying because there is nothing to eat at home. Because I know that if I've got to die here, I would die fighting for my country and not because I was shot by someone who wanted to steal my cell phone." REUTERS/Carlos Garcia Rawlins

By Victoria Ramirez and Andreina Aponte

CARACAS (Reuters) – Drawing inspiration from Ukraine’s 2013-14 revolt, Venezuela’s young protesters are donning Viking-like shields in battles with security forces and eagerly watching a film on the Kiev uprising.

Foes of Venezuelan socialist President Nicolas Maduro are holding public showings of Netflix’s “Winter on Fire” documentary about the three-month standoff in Ukraine that led to 100 deaths and the exit of then-president Viktor Yanukovich.

In Venezuela’s anti-government unrest, where 80 people have died since April, youths bear colorfully decorated homemade shields akin to those used in Kiev’s Maidan Square.

The young Venezuelans make their shields from satellite TV dishes, drain covers, barrels or any other scraps of wood and metal they can find. Some supporters also make and donate shields.

The protesters use the shields to form walls, or even beat on them in unison, as Roman soldiers and Norsemen used to do going into battle. Fellow demonstrators cheer as the self-styled “Resistance” members link arms to walk to the front lines and face off with National Guard troops and police.

“The shields don’t stop bullets, but they do protect us from tear gas, rubber bullets and stones,” said 20-year-old law student Brian Suarez, wearing a gas mask and carrying a shield depicting Maduro in the sights of a rifle target.

Other shields carry quotes and images of Venezuela’s constitution, paintings and religious symbols, depictions of the faces of slain protesters, or slogans saying “SOS!”, “No More Dictatorship!” or “Murderer, Maduro!”

While the protesters say they are fighting against tyranny in the South American oil producer, Maduro accuses them of seeking a violent coup with U.S. support.

Manuel Melo said he was on the front line of protests, hurling stones and protecting other marchers with his blue plastic shield, until one day he was caught by a water cannon. The 20-year-old graphic design student lost his kidney from the impact.

Nevertheless, he wants to go back.

“It’s an important role being a shield-bearer because you know that everything they throw goes straight at you,” he said while recovering from his home in Caracas. “I’m not out there because I like it, but for the common good.”

“AM I IN UKRAINE?”

“Winter on Fire,” by Russian director Evgeny Afineevsky, shows tens of thousands of Ukrainian protesters braving snow and baton attacks from riot police to barricade themselves in Maidan Square.

It has been discreetly shown around Venezuela, including at bookshops, a university, a public square and an arts cinema.

Forums and discussions are held afterward.

“Hearing a Ukrainian and seeing the tears in their eyes, you ask yourself: ‘Hold on, am I in Ukraine or in Cafetal?'” said university professor Carlos Delgado, referring to an upper-class part of Caracas that has vigorously supported the protests.

Delgado, 48, recently participated in a screening and forum about “Winter on Fire” at Venezuela’s Catholic University, where opposition to Maduro is also strong.

Many have also spread the word on social media.

“This documentary is unmissable,” Venezuelan actress and author Ana Maria Simon exhorted on her Instagram account. “All Venezuelans should see it, especially those who are tired, especially those close to losing faith.”

In both countries, protesters have opposed presidents they consider repressive, and the clashes turned increasingly violent. But differences abound, too.

While Ukraine’s protesters endured freezing conditions day and night, Venezuela’s thin out quickly when rain starts, and they go home in the evening and enjoy balmy Caribbean weather.

The Venezuelans point out that criminal gangs make the streets dangerous at night. And with their economy in meltdown, they are often short of medicine, food and other needs, whereas the Ukrainians had a good supply line.

Hans Wuerich, who became famous for stripping in front of an armored car with a Bible in Caracas, said “Winter on Fire” made him think Venezuela’s Resistance needed to escalate tactics.

“It’s time to take the protests to another level,” the 27-year-old reporter said in Caracas’ Altamira Square, a focus of the demonstrations. “But we need to be organized if we’re going to take the streets day and night, if it’s really about a point of no return.”

(Click on http://reut.rs/2sdUXmI to see a related photo essay)

(Additional reporting by Andrew Cawthorne in Caracas, Matthias Williams and Alessandra Prentice in Kiev; Editing by Andrew Cawthorne and Lisa Von Ahn)

New computer virus spreads from Ukraine to disrupt world business

A user takes a selfie in front of a laptop at WPP, a British multinational advertising and public relations company in Hong Kong, China June 28, 2017 in this picture obtained from social media. INSTAGRAM/KENNYMIMO via REUTERS

By Eric Auchard and Dustin Volz

FRANKFURT/WASHINGTON (Reuters) – A computer virus wreaked havoc on firms around the globe on Wednesday as it spread to more than 60 countries, disrupting ports from Mumbai to Los Angeles and halting work at a chocolate factory in Australia.

Risk-modeling firm Cyence said economic losses from this week’s attack and one last month from a virus dubbed WannaCry would likely total $8 billion. That estimate highlights the steep tolls businesses around the globe face from growth in cyber attacks that knock critical computer networks offline.

“When systems are down and can’t generate revenue, that really gets the attention of executives and board members,” said George Kurtz, chief executive of security software maker CrowdStrike. “This has heightened awareness of the need for resiliency and better security in networks.”

The virus, which researchers are calling GoldenEye or Petya, began its spread on Tuesday in Ukraine. It infected machines of visitors to a local news site and computers downloading tainted updates of a popular tax accounting package, according to national police and cyber experts.

It shut down a cargo booking system at Danish shipping giant A.P. Moller-Maersk <MAERSKb.CO>, causing congestion at some of the 76 ports around the world run by its APM Terminals subsidiary..

Maersk said late on Wednesday that the system was back online: “Booking confirmation will take a little longer than usual but we are delighted to carry your cargo,” it said via Twitter.

U.S. delivery firm FedEx said its TNT Express division had been significantly affected by the virus, which also wormed its way into South America, affecting ports in Argentina operated by China’s Cofco.

The malicious code encrypted data on machines and demanded victims $300 ransoms for recovery, similar to the extortion tactic used in the global WannaCry ransomware attack in May.

Security experts said they believed that the goal was to disrupt computer systems across Ukraine, not extortion, saying the attack used powerful wiping software that made it impossible to recover lost data.

“It was a wiper disguised as ransomware. They had no intention of obtaining money from the attack,” said Tom Kellermann, chief executive of Strategic Cyber Ventures.

Brian Lord, a former official with Britain’s Government Communications Headquarters (GCHQ) who is now managing director at private security firm PGI Cyber, said he believed the campaign was an “experiment” in using ransomware to cause destruction.

“This starts to look like a state operating through a proxy,” he said.

ETERNAL BLUE

The malware appeared to leverage code known as “Eternal Blue” believed to have been developed by the U.S. National Security Agency.

Eternal Blue was part of a trove of hacking tools stolen from the NSA and leaked online in April by a group that calls itself Shadow Brokers, which security researchers believe is linked to the Russian government.

That attack was noted by NSA critics, who say the agency puts the public at risk by keeping information about software vulnerabilities secret so that it can use them in cyber operations.

U.S. Representative Ted Lieu, a Democrat, on Wednesday called for the NSA to immediately disclose any information it may have about Eternal Blue that would help stop attacks.

“If the NSA has a kill switch for this new malware attack, the NSA should deploy it now,” Lieu wrote in a letter to NSA Director Mike Rogers.

The NSA did not respond to a request for comment and has not publicly acknowledged that it developed the hacking tools leaked by Shadow Brokers.

The target of the campaign appeared to be Ukraine, an enemy of Russia that has suffered two cyber attacks on its power grid that it has blamed on Moscow.

ESET, a Slovakian cyber-security software firm, said 80 percent of the infections detected among its global customer base were in Ukraine, followed by Italy with about 10 percent.

Ukraine has repeatedly accused Moscow of orchestrating cyber attacks on its computer networks and infrastructure since Russia annexed Crimea in 2014.

The Kremlin, which has consistently rejected the accusations, said on Wednesday it had no information about the origin of the attack, which also struck Russian companies including oil giant Rosneft <ROSN.MM> and a steelmaker.

“Unfounded blanket accusations will not solve this problem,” said Kremlin spokesman Dmitry Peskov.

Austria’s government-backed Computer Emergency Response Team (CERT) said “a small number” of international firms appeared to be affected, with tens of thousands of computers taken down.

Microsoft, Cisco Systems Inc and Symantec Corp <SYMC.O> said they believed the first infections occurred in Ukraine when malware was transmitted to users of a tax software program.

Russian security firm Kaspersky said a news site for the Ukraine city of Bakhumut was also hacked and used to distribute the ransomware.

A number of the victims were international firms with have operations in Ukraine.

They include French construction materials company Saint Gobain <SGOB.PA>, BNP Paribas Real Estate <BNPP.PA>, and Mondelez International Inc <MDLZ.O>, which owns Cadbury chocolate.

Production at the Cadbury factory on the Australian island state of Tasmania ground to a halt late on Tuesday after computer systems went down.

(Additional reporting by Jack Stubbs in Moscow, Alessandra Prentice in Kiev, Helen Reid in London, Teis Jensen in Copenhagen, Maya Nikolaeva in Paris, Shadia Naralla in Vienna, Marcin Goettig in Warsaw, Byron Kaye in Sydney, John O’Donnell in Frankfurt, Ari Rabinovitch in Tel Aviv, Noor Zainab Hussain in Bangalore; Writing by Eric Auchard, David Clarke and Jim Finkle; Editing by David Clarke and Andrew Hay)

Global business reels from second major cyber attack in two months

Customers queue in 'Rost' supermarket in Kharkiv, Ukraine June 27, 2017 in this picture obtained from social media. MIKHAIL GOLUB via REUTERS

By Eric Auchard and Jack Stubbs

FRANKFURT/MOSCOW (Reuters) – A major cyber attack, believed to have first struck Ukraine, caused havoc around the world on Wednesday, crippling computers or halting operations at port operator Maersk, a Cadbury chocolate plant in Australia and the property arm of French bank BNP Paribas.

Russia’s biggest oil company, Ukrainian banks and multinational firms were among those hit on Tuesday by the cyber extortion campaign, which has underscored growing concerns that businesses have failed to secure their networks from increasingly aggressive hackers.

The rapidly spreading computer worm appeared to be a variant of an existing ransomware family known as Petya which also has borrowed key features from last month’s ransomware attack, named “WannaCry”.

ESET, an anti-virus vendor based in Bratislava, said 80 percent of all infections from the new attack detected among its global customer base were in Ukraine, with Italy second hardest hit at around 10 percent. Several of the international firms hit had operations in Ukraine.

Shipping giant A.P. Moller-Maersk <MAERSKb.CO>, which handles one in seven containers shipped worldwide and has a logistics unit in Ukraine, is not able to process new orders after being hit by the attack on Tuesday, it told Reuters.

“Right now, at this hour, we’re not able to take new orders,” Maersk Line Chief Commercial Officer Vincent Clerc said in a telephone interview on Wednesday.

BNP Paribas Real Estate <BNPP.PA>, which provides property and investment management services, confirmed it had been hit but declined to specify how widely it had affected its business. It employed nearly 3,500 staff in 16 countries as of last year.

“The international cyber attack hit our non-bank subsidiary, Real Estate. The necessary measures have been taken to rapidly contain the attack,” the bank told Reuters on Wednesday, after a person familiar with the matter had said that some staff computers were blocked on Tuesday due to the incident.

Production at the Cadbury <MDLZ.O> factory on the island state of Tasmania ground to a halt late on Tuesday after computer systems went down, said Australian Manufacturing and Workers Union state secretary John Short.

Russia’s Rosneft <ROSN.MM>, one of the world’s biggest crude producers by volume, said on Tuesday its systems had suffered “serious consequences” but said oil production had not been affected because it switched over to backup systems.

The virus crippled computers running Microsoft Corp’s <MSFT.O> Windows by encrypting hard drives and overwriting files, then demanded $300 in bitcoin payments to restore access.

Several security experts questioned whether the effort to extort victims with computers hit by the virus was the main goal, or whether the unknown hackers behind the attack could have other motives.

(Reporting by Eric Auchard; Editing by Adrian Croft)

Germany sees ‘very difficult’ situation in eastern Ukraine

German Foreign Minister Sigmar Gabriel speaks during a news conference in Ankara, Turkey, June 5, 2017.

BERLIN (Reuters) – German Foreign Minister Sigmar Gabriel said on Monday that both Ukraine and Russian-backed separatists were violating a ceasefire agreement in eastern Ukraine and it would likely be difficult to resolve the crisis in the short term.

“It’s very difficult to find a way out after so many years,” Gabriel told an event hosted by the European Council on Foreign Relations. “Of course we are trying, but it does not look like we will have a (short-term resolution) of the difficulties in the region.”

Gabriel said he backed continued efforts by the so-called “Normandy format” group – involving Germany, France, Ukraine and Russia – to resolve the crisis, but observers from the Organization for Security and Cooperation in Europe (OSCE) were not optimistic, given the situation in the region.

“I have no good messages on this issue,” he said.

(Reporting by Andrea Shalal; Editing by Joseph Nasr)