Wiper

Description

It arrives by the usual routes — phishing, a compromised account, an exploited vulnerability — and sometimes pretends to be ransomware, to buy time and do more damage. Once running it is fast and thorough. It often spreads across the network first, then strikes in several places at once.

Without a sound backup in a separate location, a wiper ends the business. The 3-2-1 backup rule is the difference here between recovery and total loss. With a wiper there is nothing to negotiate and no key to buy. The only thing that saves you is what you set aside earlier, for the day you hoped would not come.

Examples

• In coordinated state-run cyber operations, wipers are aimed at industrial plants, finance, healthcare, power and water supply. Without a backup, rebuilding the network starts from nothing.
• NotPetya, a wiper disguised as an update to accounting software, is estimated to have caused more than 10 billion dollars of damage in the spring of 2017.
• In power distribution a wiper can disable the control stations and stop the supply of electricity — a basic necessity — for millions of people at once.

Notes

• A backup sitting on the same network as production is not a reliable copy — a wiper erases it along with every other server.
• When the aim is not money but putting the other side out of action, there is nothing to negotiate and nothing to pay. You are as good as the thinking you did in advance.