‘Petya’ ransomware attack: what is it and how can it be stopped?

/in ,

Many organizations in Europe and the US have been crippled by a ransomware attack known as “Petya”. The malicious software has spread through large firms including the advertiser WPP, food company Mondelez, legal firm DLA Piper and Danish shipping and transport firm Maersk, leading to PCs and data being locked up and held for ransom.

It’s the second major global ransomware attack in the past two months. In early May, Britain’s National Health Service (NHS) was among the organizations infected by WannaCry, which used a vulnerability first revealed to the public as part of a leaked stash of NSA-related documents released online in April by a hacker group calling itself the Shadow Brokers.

The WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the NHS, Spanish phone company Telefónica and German state railways among those hardest hit.

Like WannaCry, “Petya” spreads rapidly through networks that use Microsoft Windows, but what is it, why is it happening and how can it be stopped?

What is ransomware?

Ransomware is a type of malware that blocks access to a computer or its data and demands money to release it.

How does it work?

When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files.

How does the “Petya” ransomware work?

The ransomware takes over computers and demands $300, paid in Bitcoin. The malicious software spreads rapidly across an organization once a computer is infected using the EternalBlue vulnerability in Microsoft Windows (Microsoft has released a patch, but not everyone will have installed it) or through two Windows administrative tools. The malware tries one option and if it doesn’t work, it tries the next one. “It has a better mechanism for spreading itself than WannaCry,” said Ryan Kalember, of cybersecurity company Proofpoint.

Is there any protection?

Most major antivirus companies now claim that their software has updated to actively detect and protect against “Petya” infections: Symantec products using definitions version 20170627.009 should, for instance, and Kaspersky also says its security software is now capable of spotting the malware. Additionally, keeping Windows up to date – at the very least through installing March’s critical patch defending against the EternalBlue vulnerability – stops one major avenue of infection, and will also protect against future attacks with different payloads.

For this particular malware outbreak, another line of defence has been discovered: “Petya” checks for a read-only file, C:\Windows\perfc.dat, and if it finds it, it won’t run the encryption side of the software. But this “vaccine”doesn’t actually prevent infection, and the malware will still use its foothold on your PC to try to spread to others on the same network.

Why is it called “Petya”?

Strictly speaking, it is not. The malware appears to share a significant amount of code with an older piece of ransomware that really was called Petya, but in the hours after the outbreak started, security researchers noticed that “the superficial resemblance is only skin deep”. Researchers at Russia’s Kaspersky Lab redubbed the malware NotPetya, and increasingly tongue-in-cheek variants of that name – Petna, Pneytna, and so on – began to spread as a result. On top of that, other researchers who independently spotted the malware gave it other names: Romanian’s Bitdefender called it Goldeneye, for instance.

Where did it start?

The attack appears to have been seeded through a software update mechanism built into an accounting program that companies working with the Ukrainian government need to use, according to the Ukrainian cyber police. This explains why so many Ukrainian organizations were affected, including government, banks, state power utilities and Kiev’s airport and metro system. The radiation monitoring system at Chernobyl was also taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone. A second wave of infections was spawned by a phishing campaign featuring malware-laden attachments.

How far has it spread?

The “Petya” ransomware has caused serious disruption at large firms in Europe and the US, including the advertising firm WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft. The food company Mondelez, legal firm DLA Piper, Danish shipping and transport firm AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware.

Crucially, unlike WannaCry, this version of ‘Petya’ tries to spread internally within networks, but not seed itself externally. That may have limited the ultimate spread of the malware, which seems to have seen a decrease in the rate of new infections overnight.

So is this just another opportunistic cybercriminal?

It initially looked like the outbreak was just another cybercriminal taking advantage of cyberweapons leaked online. However, security experts say that the payment mechanism of the attack seems too amateurish to have been carried out by serious criminals. Firstly, the ransom note includes the same Bitcoin payment address for every victim – most ransomware creates a custom address for every victim. Secondly, the malware asks victims to communicate with the attackers via a single email address which has been suspended by the email provider after they discovered what it was being used for. This means that even if someone pays the ransom, they have no way to communicate with the attacker to request the decryption key to unlock their files.

Who is behind the attack?

It is not clear, but it seems likely it is someone who wants the malware to masquerade as ransomware, while actually just being destructive, particularly to the Ukrainian government. Security researcher Nicholas Weaver told cybersecurity blog Krebs on Security that ‘Petya’ was a “deliberate, malicious, destructive attack or perhaps a test disguised as ransomware”. Pseudonymous security researcher Grugq noted that the real Petya “was a criminal enterprise for making money,” but that the new version “is definitely not designed to make money.

“This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,’” he added, pointing out that, among other tells, the payment mechanism in the malware was inept to the point of uselessness: a single hardcoded payment address, meaning the money can be traced; the requirement to email proof of payment to a webmail provider, meaning that the email address can be – and was – disabled; and the requirement to send an infected machine’s 60-character, case sensitive “personal identification key” from a computer which can’t even copy-and-paste, all combine to mean that “this payment pipeline was possibly the worst of all options (sort of ‘send a personal cheque to: Petya Payments, PO Box … ’)”.

Ukraine has blamed Russia for previous cyber-attacks, including one on its power grid at the end of 2015 that left part of western Ukraine temporarily without electricity. Russia has denied carrying out cyber-attacks on Ukraine.

What should you do if you are affected by the ransomware?

The ransomware infects computers and then waits for about an hour before rebooting the machine. While the machine is rebooting, you can switch the computer off to prevent the files from being encrypted and try and rescue the files from the machine, as flagged by @HackerFantastic on Twitter.

If the system reboots with the ransom note, don’t pay the ransom – the “customer service” email address has been shut down so there’s no way to get the decryption key to unlock your files anyway. Disconnect your PC from the internet, reformat the hard drive and reinstall your files from a backup. Back up your files regularly and keep your anti-virus software up to date.

The Guardian logo

Microsoft hit with anti-trust complaint from Russian cybersecurity firm over Windows Defender

/in

Russian cybersecurity company Kaspersky Lab said it has filed complaints with regulators in Germany as well as the European Union as a whole against Microsoft, alleging the Redmond, Wash. technology giant unfairly favors its security software over other solutions.

In a blog post with a very Yoda-like title — Antitrust: Pursue It in Europe We Must — Eugene Kaspersky writes that the company is moving forward with complaints to the European Commission and the German Federal Cartel Office because it wants users to have more choices in security software. Kaspersky also filed a complaint with Russia’s Federal Antimonopoly Service late last year on the same issue.

“We see clearly — and are ready to prove — that Microsoft uses its dominant position in the computer operating system (OS) market to fiercely promote its own — inferior — security software (Windows Defender) at the expense of users’ previously self-chosen security solution,” Kaspersky writes. “Such promotion is conducted using questionable methods, and we want to bring these methods to the attention of the anti-competition authorities.”

Microsoft issued the following statement in response to Kaspersky’s claim:

Microsoft’s primary objective is to keep customers protected and we are confident that the security features of Windows 10 comply with competition laws. We’re always interested in feedback from other companies and we engage deeply with antimalware vendors and have taken a number of steps to address their feedback. We reached out directly to Kaspersky a number of months ago offering to meet directly at an executive level to better understand their concerns, but that meeting has not yet taken place.

A European Commission representative confirmed that the complaint has been received.

Windows Defender is built into Windows 10, which Microsoft said last month is on more than 500 million devices, and Kaspersky claims it is impossible to completely disable or uninstall. The cybersecurity company further claims that Microsoft actively encourages people to get rid of independent security systems, and that the upgrade to Windows 10 in some cases invalidated security programs already on a device by uninstalling drivers.

Kaspersky concludes the blog post with the outcome it would like to see from its complaints.

We want Microsoft to stop misleading and misinforming our — and not only our — users. We want to see all security solutions being able to work on the Windows platform on a level playing field. And we want to see users being able to decide for themselves what they want and consider important to them.

Besides, we want fair and healthy competition, which has always given excellent results everywhere – no matter in which industry or market. And btw, we invite all our competitors/colleagues to join us: as we’ve already shown, turning to antitrust bodies does bring positive change.

And remember: the only folks who gain unequivocally if there is a monopoly in the security products market are cybercriminals. They’d love nothing more than to be able to concentrate on trying to out-smart the single security solution of a monopolist.

GeekWire

Hackers use NSA’s leaked EternalBlue exploit to power more malicious payloads

/in ,

Hackers are expanding the use of EternalBlue, the leaked NSA hacking exploit that was thrust into the spotlight in May with its initial use in the WannaCry ransomware and Adylkuzz cryptocurrencyminer.

Security researchers have now found threat actors exploiting the vulnerability in Microsoft Server Message Block (SMB) protocol to distribute other malicious payloads including Backdoor.Nitol and Trojan Gh0st RAT.

Backdoor.Nitol is a Trojan horse that opens a backdoor on the infected computer. Gh0st RAT is a remote access trojan that has been making the rounds for years to target Windows machines and is capable of giving attackers full access and control of an infected machine. It has also been used in extensive cyber espionage and data stealing campaigns.

According to security firm FireEye, both the well-known payloads have been previously used in cyberattacks targeting the aerospace and defence industry with Gh0st RAT targeting government agencies and activists as well.

“We observed lab machines vulnerable to the SMB exploit were attacked by a threat actor using the EternalBlue exploit to gain shell access to the machine,” FireEye researchers said in blogpost. “The initial exploit technique used at the SMB level is similar to what we have been seen in WannaCry campaigns.

“However, once a machine is successfully infected, this particular attack opens a shell to write instructions into a VBScript file and then executes it to fetch the payload on another server.”

Researchers said the combination of EternalBlue and VBScript has been used to distribute Gh0st RAT in Singapore and Backdoor.Nitol in the South Asia region.

EternalBlue came as part of the cache of alleged NSA hacking tools released by notorious hacking group Shadow Brokers in April.

Security researchers warned that with EternalBlue exploit now released and available for any threat actors to target, it is likely that it will be used in new sophisticated and more frequent cyberattacks.

“The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities,” FireEye said. “In the coming weeks and months, we expect to see more attackers leveraging these vulnerabilities and to spread such infections with different payloads.

“It is critical that Microsoft Windows users patch their machines and update to the latest software versions as soon as possible.”

IBTimes

20% of Risky Emails Bypass Email Security

/in

Far too many risky emails are infiltrating email security solutions, according to a report released Tuesday by Mimecast.

The email and data security company released its second quarterly report on the effectiveness of email security systems, the Mimecast Email Security Risk Assessment (ESRA), based on a study of more than 44,000 users. The results are bleak, depicting how risky and potentially malicious emails continue to infiltrate security solutions.

As much as 9 out of 40 million emails analyzed by Mimecast, all of which passed through an email security vendor or cloud email service, were determined to have the potential for risk. The majority of these emails were spam, but a smaller amount of more dangerous emails also bypassed security, and it only takes one to cause irreversible harm.

More than 8,300 emails examined by Mimecast contained dangerous file attachments, while 1,669 contained known malware and 8,605 were impersonation attacks.

Impersonation attacks, or social engineering scams, are when a cybercriminal attempts to impersonate a trusted individual, like a company CEO, to obtain confidential information from duped employees. These types of scams have risen 400% since the release of Mimecast’s February ESRA report.

Phishing is now the primary entry method for cybercriminals seeking to access organizations according to a recent report from Symantec.

It’s also a preferred method of the Russian military according to a leaked NSA document published Monday by The Intercept. The report describes how the Russian military used email phishing to target United States agencies and services in the lead-up to the 2016 Presidential election.

Hackers attempted to spear-phish a private company in the United States to access information on voting-related technology, as well as targeting government agencies to impede requests for absentee ballots.

MEDIA POST

3 Things Developers Need to Know about Cross-Marketing

/in ,

With a limited budget, small businesses should consider partnership with other companies or independent developers who offer related products and try cross-marketing. It consists in combining efforts of two or more companies for achieving the common goal.

Nowadays hundreds of apps a day are being created making the intensely competitive IT industry one of the biggest spenders when it comes to marketing. However, there are many companies that do not have massive budgets for product promotion and, therefore, need to use affordable methods to attract potential customers.

With a limited budget, such small businesses should consider partnership with other companies or independent developers who offer related products and try cross-marketing. It consists in combining efforts of two or more companies for achieving the common goal – improving the sales performance by merging customer bases. Basically, your products get promoted and promote other software.

What are the advantages of cross-marketing?

Cross-marketing is a cost-effective method for breaking through the white noise of advertising and motivating customers to purchase products that they initially have not been after. Moreover, it provides you with a possibility to:

  • Establish your business credibility. By placing your product’s name next to the better-known brand, you develop a positive association in customers’ minds, and gain more trust from them, so they do not treat you like another dark horse. Obviously, it works only if you collaborate with a reputable company.
  • Increase the coverage of the target audience. With a customer base of your partner, you are able to reach more people who are potentially interested in your product. Your product will be shown to
  • Broad your company’s visibility. People tend to opt for products they have already heard about; therefore, you need to get exposure, and cross-marketing lets you do this without spending much.

Rules for choosing the right partner for cross-marketing

To make your cooperation with another company or developer effective and mutually beneficial, you have to consider several things.

The first one is about learning whether a potential partner(s) is your indirect competitor. Your products have to complement each other, but not to offer the same features, even if there are a few of them. Customers may need exactly what you have in common, and the comparison may not be in your favor.

You have probably identified your and your potential partner’s target audiences already. Do they coincide? If no, you will probably fire blanks trying to get exposure among customers who are not interested in your product. For example, if you sell an app for Mac optimization like this one, you should try to reach developers oriented on users who pay much attention to their computers’ maintenance, but want to do it quickly and easy, and whose work is connected with processing of large amounts of information. It could be professional photographers, for example, who use photo editors. It is unlikely for you to benefit from partnering with companies that create apps for kids or low-code development platforms.

One more thing to take into account is how much your partner’s target audience is used to spend on software – you have to be in the same price segment.

You also have to make sure your potential partner would not harm your reputation. Small companies often try to get their name in as many places as possible in the pursuit of money; however, it is not a viable option for businesses that aim to sell quality products. For instance, a free software segment is known for advertising and forced downloads of harmful and unnecessary apps said to be designed for “improving user experience”. In fact, loyal customers are often scared off by such “bonuses” and may stop using your product. Therefore, you should guard against accepting potentially harmful offers and reconsider a monetization model if needed. Devote enough time for studying the company’s history and its products’ reviews before initiating a cooperation.

How to make cross-promotion effective

Before you start working with your partner(s), you should determine:

  • Who will be the main contact from each business?
  • How the billing will be handled?
  • How long your promotion campaigns will last?
  • How the profits will be shared?
  • Who will be in charge of implementing new approaches while cross-promoting products?

This way you can avoid disagreements with your partner(s), which usually significantly reduce the efficacy of collaboration.

It is also worth remembering that barter projects need to be constantly monitored to make sure that both parties are satisfied. Collect statistics of traffic and sales and conduct analysis on a regular basis. It is probable that you will need to change your tactics in order to get better results.

Obviously, there are other ways to promote your product without investing much and you should not rely on cross-marketing only. However, this method like no other can help you to make a big step forward in a very short time.

Password manager OneLogin hacked, exposing sensitive customer data

/in

Password manager and single sign-on provider OneLogin has been hacked.

In a brief blog post, the company’s chief security officer Alvaro Hoyos said that it was aware of “unauthorized access to OneLogin data in our US data region,” and that it had reached out to customers.

Hoyos said that the company had blocked the unauthorized access after the breach and is working with law enforcement.

The blog post initially lacked detailed information about the incident, although the post had omitted that hackers had stolen sensitive customer data — a point that the company had instead only mentioned in an email sent to customers, seen by ZDNet.

“OneLogin believes that all customers served by our US data center are affected and customer data was potentially compromised,” the email read.

Later in the day, the company said in an update: “Our review has shown that a threat actor obtained access to a set of [Amazon Web Services, or AWS] keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US.”

The company confirmed that the attack appears to have started at 2am (PT), but staff were alerted of unusual database activity some seven hours later, who “within minutes, shut down the affected instance as well as the AWS keys that were used to create it”.

“The threat actor was able to access database tables that contain information about users, apps, and various types of keys,” the company said.

The company added that although it encrypts “certain sensitive data at rest,” it could not rule out the possibility that the hacker “also obtained the ability to decrypt data”.

But a spokesperson did not say what kind of data is and isn’t encrypted. We have asked for clarity, and will update when we hear back.

Some had questioned earlier in the day how the hackers had access to customer data that could ultimately be decrypted.

“Am I the only 1 to find it disturbing OneLogin had a decryption method for customer data accessible enough to be grabbed via breach?” said one user on Twitter.

The company has advised customers to change their passwords, generate new API keys for their services, and create new OAuth tokens — used for logging into accounts — as well as to create new security certificates. The company said that information stored in its Secure Notes feature, used by IT administrators to store sensitive network passwords, can be decrypted.

The company also hasn’t said how many customers were affected.

According to its website, dozens of major multinationals, including ARM, Dun & Bradstreet, The Carlyle Group, Conde Nast, and Dropbox (which a spokesperson disputed in an email), are customers.

OneLogin allows corporate users to access multiple web applications, sites, and services with just one password. It’s thought that the company has millions of users serving more than 2,000 companies in dozens of countries, according to CrunchBase.

The single sign-on provider integrates hundreds of different third-party apps and services, such as Amazon Web Services, Microsoft’s Office 365, LinkedIn, Slack, Twitter, and Google services.

It’s the second such breach in as many years. Last August, the company warned users that its Secure Notes service had been accessed by an “unauthorized user,” but it denied that any customer data had been compromised.

ZDNet