​​Uh-oh. Hackers have published the coding they used to launch a gigantic attack against the Web site of an Internet security journalist. The malware (malicious software) uses the “Internet of Things” — Web-connected cameras, thermostats, and other devices, which are often poorly protected — to send overwhelming traffic to the targeted Web site, causing it to slow down or become entirely unavailable. The attack was so huge that the massive Akamai network stopped hosting the security site (which it had previously hosted as a public service), fearing future attacks would overwhelm even it. The security site was picked up by Google, which has the power to repel such massive attacks — for now.

Experts say the release of this coding may lead to many more attacks on Web sites. It also seems to have prompted manufacturers to start tightening security on “Internet of Things” (IoT) devices: The hacker who released the code said the number of devices it can control through one system has dropped by more than 20% recently.

The vulnerability of the Internet to hacking by malicious countries (Russia has been attacking all over the place lately, including targets related to the U.S. Presidential election), criminal enterprises, or even a single individual should set off alarm bells. We are reaching a critical juncture where the future of our connected world is looking increasingly fragile. Governments and private enterprise need to greatly step up the resources they put into online security, and that includes makers of stuff that connects to the Internet.

At our office, some of the items connected to the Internet are our electric power (including our solar panels), our computers of course, our system for listening to music and accessing radio (except our emergency hand-cranked radio). Beyond that, the utility power grid, the city's water and sewer system, and probably all communications systems are potentially vulnerable. You may be even more connected — does your refrigerator use the Internet to report energy usage or compile your shopping list?

Here in California, we all are advised to keep earthquake supplies on hand, including enough food and water to last at least several days. Former "Nightline" host Ted Koppell warns, in a book published almost a year ago, that we should all be prepared to do without the electric grid for months, not just days or weeks.

In the meantime, I recommend we all contact our elected officials and ask what they are doing about our increasing vulnerability to cyberattacks, without compromising our privacy. After all, if laws are passed requiring that security and encryption systems contain “back-door keys” the government can use in criminal investigations, for example, you can bet hackers will be stealing and using those keys, while terrorists and crime syndicates will just apply their own encryption that has no such keys. Such systems would decrease our security without affecting determined bad guys.

Two items in the news recently, taken together, underscore the threats being targeted at our computers and devices — and that Apple products, not just Windows, are now being targeted by sophisticated operatives.
 
First is a story from c|net, a top-notch source for technology news, reporting the first instance of fully functional “ransomware” that attacks Macintosh computers being found “in the wild.”
 
Since I like to say “we speak human,” let me unpack those computerese terms.
 
“Ransomware” is software that scrambles (encrypts) your files, and the criminals behind the software demand you pay a ransom to get your files unscrambled. The encryption is strong enough that it’s effectively impossible to unscramble the files without the key held by the criminals. The scrambled files are useless.
 
“In the wild” means that the ransomware has been discovered circulating on the Internet, not just among security experts. In other words, you could become a victim.
 
Until now, ransomware was designed to attack Windows computers. With Windows running nearly 90% of all computers, versus about 5% for Macintosh, criminals generally haven’t felt it was worth their while to write software that attacks Macs.
 
C|net’s Claire Reilly was a bit sensationalist in starting off her report with, “Sorry, Mac fans. Now you're no better off than regular old PC users.” One ransomware program is nothing compared to the thousands upon thousands of malicious programs unleashed upon Windows. Still, the amount of damage that could be done by the Mac ransomware program, nicknamed KeRanger, is substantial: There were signs that a new version under development would also scramble users’ Time Machine backup files, leaving them with only two options: Lose everything, or pay the $400 ransom.
 
If you have Mac computers, you are unlikely to be infected though, because it appears KeRanger was circulated via a corrupted version of a program called Transmission that was available for download only on March 4 and 5. The Transmission team removed the infected software from their site soon after it was placed there, and within days, Apple made changes that automatically prevented KeRanger from running on Macs. (This was a instance where Apple could block the malicious software without users needing to do anything; often, it’s necessary to update your system software to close security holes.)
 
Although KeRanger surfaced six months ago, it has popped up in technical news lately along with another recent report, this one about software that can see and record everything on an Apple iPhone. An Israeli firm, the NSO Group, sells that software. With a price tag of $650,000, NSO’s spyware has been bought by governments around the world. It came to light last month when attackers tried to install it on the iPhone of a human-rights activist in the United Arab Emirates and on the iPhone of a Mexican journalist who wrote about government corruption.

​The attack on the UAE activist came in the form of a text message urging him to visit a Web site for information about human-rights issues. Suspicious, he instead sent the text to security experts, who followed the link and found that the Web site would automatically download NSO’s software onto any iPhone that visited the site.
 
You may not be a human-rights activist in a country where you legitimately should fear your government, but that doesn’t mean you’re immune. A pricetag of $650,000 isn’t too high for a criminal enterprise that wants to steal credit-card information or bank log-ins.
 
Two computer-security operations, Citizen Lab and Lookout, figured out how NSO is able to infect iPhones and alerted Apple, which patched the vulnerabilities in its update to iOS 9.3.5. As Lookout* writes, “All individuals should update to the latest version of iOS immediately. If you’re unsure what version you’re running, you can check Settings > General > About > Version.” This is a case where you may need to take action to keep your device safe. (*I have used Lookout software for a few years now.)
 
The lessons here:

1. Never click links in text messages or e-mails unless you are expecting that information, even if the message looks like it comes from someone you know and trust. The “from” line of a message can be faked (“spoofed”). To visit a Web site you trust, type its address into your browser rather than clicking a link in a message; links in e-mail can be made to disguise their true destinations. 
   
   
2. Keep your software updated, especially system software (for example, Mac OS, Windows, or Linux on your computer; iOS, Android, or Blackberry OS on your phone).
   
   
3. If you suspect your device may be infected — it slows down dramatically or behaves in other unexpected ways — you might want to have an expert check it out. I am happy to do a security scan, as are most computer repair and service providers. However, don’t trust a Web site to do such a scan unless you confirm it’s legit (I can point you to trustworthy sites); some sites masquerade as security scans, but use the access you grant them to actually install malicious code.

 
Bottom line: When in doubt, check it out.