By on June 11, 2020

Struck by a cyber attack on its global computer network that temporarily knocked out a few factories and most of its customer service centers, Honda is reporting that things are gradually returning to normal.

“Work is being undertaken to minimize the impact and to restore full functionality of production, sales and development activities,” the company said in a statement earlier this week.

Impacted facilities are supposedly already in decent shape, and the business hopes to move past this in short order. But what actually happened? 

According to the informed nerds at Tech Crunch, Honda was made subject to “Snake ransomware.” The file-encrypting malware basically jumbles all the data on a network (or access to it) so it cannot be used by its owner and can be rescinded after the criminals are paid off — usually with digital currencies. Honda said that it doesn’t believe any files were pulled but its network had been held for ransom by unsavory actors. It also admitted that it didn’t have all the answers just yet.

Factories, including the plant in Marysville, Ohio, are said to be resuming operations today or tomorrow. Customer service is still reporting issues, however. There are also lingering concerns from experts that the corporation could be vulnerable to subsequent attacks until a rigorous investigation has been completed.

From Tech Crunch:

Brett Callow, a threat analyst at security firm Emsisoft, said a sample of the file-encrypting malware was uploaded to VirusTotal, a malware analysis service, referencing an internal Honda subdomain, mds.honda.com.

“The ransomware will only encrypt files on systems capable of resolving this domain but, as the domain does not exist on the clear net, most systems would not be able to resolve it. mds.honda.com may well exist on the internal nameserver used by Honda’s intranet, so this is a fairly solid indicator that Honda was indeed hit by Snake,” said Callow.

Honda finds itself in similar company to IT giant Cognizant, cyber insurer Chubb, and defense contractor CPI, all of which were hit by ransomware this year.

Honda was hit with ransomware before, in 2017 — along with Renault, Nissan, Dacia and a bunch of other companies we don’t care about because they don’t build cars. It’s no stranger to digital shenanigans. But the aforementioned WannaCry attacks haven’t made it invulnerable to similar intrusions. Likewise, a lot of the more recent cyber attacks are presumed to have state backing due to their increasing levels of complexity. We don’t envy corporations having to contend with these attacks, least of all now that they seem to be coded by professionals.

Honda hasn’t mentioned what was lost in the attack, or even if it caved to the demands. For what it’s worth, it did say that there was “no current evidence of loss of personally identifiable information” and that most facilities are already operational. Let’s hope it stays that way.

 

[Image: Anastasiia Moiseieva/Shutterstock]

Get the latest TTAC e-Newsletter!

Recommended

13 Comments on “Honda Rebounds From Cyber Attack; So, What Happened?...”


  • avatar
    sgeffe

    Good to know they’re getting back to normal. (Well, whatever “normal” is in the COVID-19 era!)

    Even as a Systems Analyst, I’d need help if I fell for one of these!

    More to the point here, I couldn’t correct the problem of my own Accord! ;-)

  • avatar
    brn

    I find it interesting that we don’t work harder to locate and punish those responsible for stuff like this. Their crimes are large, destructive, and intentional.

    • 0 avatar
      sgeffe

      The issue is probably that these characters are as slippery as the numbskulls bombarding people with robocalls! By the time anybody could get a handle on them, they’re gone!

      Since I’ve been working from home since March, I cannot believe how many calls I’ve gotten for warranty offers on the 2013 Accord currently in my avatar — even though I literally traded that car in a year ago already!

      (Speaking of avatars, how on God’s green Earth can I change that avatar to the Gravatar I created? Supposedly that’s compatible with this site, but the old one’s still there, even though several other sites use it seamlessly!)

      • 0 avatar
        Lorenzo

        That’s just normal commerce – asking about your avatar. They scan the net for any kind of hook to get you to buy something.

        I just searched for the history of John Bell Hood, the Confederate general Fort Hood was named after, and I got a pop-up offering more info about him, from a publishing company!

        That’s not a sinister cyber-attack, it’s just online business, with an assist from Google, suctioning any data from users they can sell.

    • 0 avatar
      karonetwentyc

      Something to keep in mind: in a lot of cases, attribution can be established regarding the actors involved in the attack. However, if those same actors are part of a nation-state organisation or are located in a territory that will deny (read: ignore and roundfile) warrants, extradition requests, etc., then there’s no point in pursuing it past that point.

      Attacks of this type and on this scale are typically organised, planned, and executed by groups with structure and access to financial and material resources. It’s almost never little Billy down the street getting bored again and ending up with the FBI raiding his house the next morning.

      • 0 avatar
        brn

        I agree with Karon. These aren’t just some thugs. Their well organized and often foreign. Sometimes even foreign governments. If we can’t “get” them, maybe we can expose them? Then again, that might expose us. :)

        • 0 avatar
          karonetwentyc

          Oh, exposure has already happened both ways. Take a look at the following:

          https://www.fireeye.com/current-threats/apt-groups.html (check the links under ‘Suspected Attribution’)

          https://en.wikipedia.org/wiki/Stuxnet

          Electronic warfare: cheap to wage 24/7/365, and with potentially significant gains. It’s why all the cool kids are doing it!

    • 0 avatar
      stuki

      It’s more efficient to make yourself a harder target.

      Finding “who” is behind a virus, when the whole world in networked by now, is harder than finding a needle in a haystack. And even if you think you have a fairly good ideas, you can’t really be sure. Which, at least for now, limits what most are willing to do in “revenge.”

      If things get out of hand, expect organizations to simplify the systems in use by most employees. Sort of a Re-Greenscreening (just perhaps not quite as severe.) An awful lot of the attack surface organizations present, exist on account of end user systems way more complex than what is strictly needed for the functions most of their employees need to perform.

Read all comments

Back to TopLeave a Reply

You must be logged in to post a comment.

Recent Comments

  • DC Bruce: What seems to be going on is a conflagration of high-minded politicians and supposed experts who have come...
  • paxman356: I got to drive one of these, a turbo, in the late 80s. It could scoot, but the torque steer was terrible....
  • ajla: “So put a $100,000 tax on ICE powered cars” Within the US, and considering SCOTUS cases in last 25...
  • MRF 95 T-Bird: I used to see a turquoise MX-3 with the 1.8 V6 in my neighborhood up until a decade ago. It’s been...
  • spookiness: I was in school in northern Europe in the very early 90’s and there were quite a few of the prior...

New Car Research

Get a Free Dealer Quote

Who We Are

  • Matthew Guy
  • Timothy Cain
  • Adam Tonge
  • Bozi Tatarevic
  • Chris Tonn
  • Corey Lewis
  • Mark Baruth
  • Ronnie Schreiber