What ‘Chinese cyber attack’ on AIIMS means for India

The crypto ransomware attack on the servers of the All India Institute of Medical Sciences (AIIMS) is believed to be the handiwork of Chinese hackers, it was widely reported on December 14. But the question remains as to why the servers at a public service institution had been vulnerable enough for such an attack in the first place.Also Listen: WFH? Why you should use VPN for data safety, and 7 to choose from Mukesh Chaudhary, a chief cybercrime consultant with Rajasthan police, felt that India lacks awareness about cybersecurity, and does not follow the best practices needed to secure crucial data. “Organisations in India take cybersecurity for granted more often than not, resorting to the perfunctory yearly audits which barely have them covered. At least a quarterly or a monthly audit is required for certain institutes, depending on the nature of work and how sensitive their data is. They should also have an internal team working around the clock on cybersecurity as well as external or third-party audits,” he said. Safdarjung hospital had also reported a similar attack on its servers soon after the AIIMS incident. On November 30, hackers had even tried to breach the website of the Indian Council of Medical Research more than 6,000 times in a single day. Chaudhury, who has been assisting central and state law enforcement and intelligence agencies for over a decade now, explained that crypto ransomware attacks are essentially denial of data access attacks, where the data in a particular server or computer system is encrypted to another form, cutting off the user’s access. Hackers typically demand a ransom in cryptocurrencies to decrypt the data back. This is a trend that began with the infamous WannaCry attack in 2017 that targeted the Microsoft Windows operating system all over the world. In the last five to six years, crypto ransomware has become one of the most dangerous attacks for any country. “Almost all countries have been infected by this attack at some point of time. None of the crypto ransomware attack cases have been cracked in India so far,” Chaudhary stressed. He recalled the October 2020 Mumbai blackout, which was yet another successful attack by Chinese hackers, saying, “If we are not prepared, if we are waiting for such attacks to happen by taking cybersecurity for granted, obviously our enemy countries will target us.” Huge money is involved in such kind of attacks, which can also be used for terror funding. And it’s not that the hackers are always after your data. They can also use you as a proxy to commit a terror act. “Our computer systems can be used as proxy servers by criminals or terror organizations, and our IP address will be traced in return if someone is investigating the case, with the user having no clue about why he is being framed,” warned Chaudhary. Individuals, private organisations and government institutes are equally vulnerable to this threat because India still hasn’t woken up to the seriousness of crypto ransomware cases. Unless firms have their data backups in place, they may lose their entire data, and worse, their reputations as well, stressed Chaudhary. How can such attacks be prevented? How can such attacks be prevented? What checks and balances do such institutions need to put in place so that public data remains secure? We need to come out of the “cybersecurity means added costs” mindset and invest in it instead, insisted Chaudhary. Individuals as well as organisations need to stop using pirated software and replace firmware with every security audit prompt. The upskilling of teams responsible for security audits is equally important. Cybersecurity is an evolving field where learning new techniques is imperative. So, they need new certifications periodically to upgrade themselves over and above their educational qualifications. “That is the only way we can prevent hackers from targeting our computers,” he said. Audio production: Basant Singhal