Honda Rebounds From Cyber Attack; So, What Happened?

Struck by a cyber attack on its global computer network that temporarily knocked out a few factories and most of its customer service centers, Honda is reporting that things are gradually returning to normal.

“Work is being undertaken to minimize the impact and to restore full functionality of production, sales and development activities,” the company said in a statement earlier this week.

Impacted facilities are supposedly already in decent shape, and the business hopes to move past this in short order. But what actually happened?

According to the informed nerds at Tech Crunch, Honda was made subject to “Snake ransomware.” The file-encrypting malware basically jumbles all the data on a network (or access to it) so it cannot be used by its owner and can be rescinded after the criminals are paid off — usually with digital currencies. Honda said that it doesn’t believe any files were pulled but its network had been held for ransom by unsavory actors. It also admitted that it didn’t have all the answers just yet.

Factories, including the plant in Marysville, Ohio, are said to be resuming operations today or tomorrow. Customer service is still reporting issues, however. There are also lingering concerns from experts that the corporation could be vulnerable to subsequent attacks until a rigorous investigation has been completed.

From Tech Crunch:

Brett Callow, a threat analyst at security firm Emsisoft, said a sample of the file-encrypting malware was uploaded to VirusTotal, a malware analysis service, referencing an internal Honda subdomain, mds.honda.com.

“The ransomware will only encrypt files on systems capable of resolving this domain but, as the domain does not exist on the clear net, most systems would not be able to resolve it. mds.honda.com may well exist on the internal nameserver used by Honda’s intranet, so this is a fairly solid indicator that Honda was indeed hit by Snake,” said Callow.

Honda finds itself in similar company to IT giant Cognizant, cyber insurer Chubb, and defense contractor CPI, all of which were hit by ransomware this year.

Honda was hit with ransomware before, in 2017 — along with Renault, Nissan, Dacia and a bunch of other companies we don’t care about because they don’t build cars. It’s no stranger to digital shenanigans. But the aforementioned WannaCry attacks haven’t made it invulnerable to similar intrusions. Likewise, a lot of the more recent cyber attacks are presumed to have state backing due to their increasing levels of complexity. We don’t envy corporations having to contend with these attacks, least of all now that they seem to be coded by professionals.

Honda hasn’t mentioned what was lost in the attack, or even if it caved to the demands. For what it’s worth, it did say that there was “no current evidence of loss of personally identifiable information” and that most facilities are already operational. Let’s hope it stays that way.

[Image: Anastasiia Moiseieva/Shutterstock]