Slashdot Mirror
Petya Ransomware Uses DOS-Level Lock Screen, Prevents OS Boot Up (softpedia.com)
An anonymous reader writes: A new type of ransomware was discovered that crashes your PC into a BSOD, restarts your computer, and then prevents your OS from starting by altering the hard drive's master boot record (MBR). This keeps the user locked in a DOS screen that doubles as the ransomware's ransom note. The ransomware's name is Petya, and was currently seen only targeting HR departments in Germany.
I thought Windows[7,8,10,9999] was supposed to fix this? Was the user "warned" about opening a file for the 10th time that day?
What happens when I open it with WINE?
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
According to the update in TFA, so just repairing the MBR will not solve the problem.
I eat only the real part of complex carbohydrates.
Sounds more like a problem where the author of the article doesn't know the difference between DOS and "not GUI".
This changes the Master Boot Record and encrypts files while it displays the skull logo and warning message. From what I can tell, you can simply unplug your computer to stop the process of encrypting your files... the earlier you stop, the fewer files are affected.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
Some jokes never get old.
Other ones...
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
What happens when I open it with WINE?
The virus needs to modify the boot sequence so the next reboot starts its "fake" CHKDSK (to encrypt the disk and display a lock screen).
Under most Unix, root-level privilege are necessary to write to a raw block device (as required to change the MBR) and as Wine is usually ran under an end-users account, it simply lacks the necessary rights to perform this action.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"HR employees are sent an email with a link to a file stored on Dropbox, where an applicant's CV can be downloaded. This file is an EXE file named portfolio-packed.exe, which if executed, immediately crashes the system into a standard Windows blue screen of death."
How does this scenario even occur? Why didn't HR just tell them to attach an appropriate file instead of going out of their way to download the "CV" and unpacking it? This is insanity.
Unless you are going to tamper with the firmware or its settings, "good luck" changing my boot sequence.
Oh, by the way, a comment at this Trend Micro write-up suggests that the initial program that infects the system won't work unless the user has administrative privileges.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This won't impact a Mac, nor will it impact Linux (it's an .exe file). The TFA referred to Windows, so should the summary.
Just like as usual - most rampant exploits and malware are Windows-only.
Make sure everyone's vote counts: Verified Voting
I don't *always* boot from non-writable media.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If we all volunteer to kick in a little to the ransom gang, is it possible we could spread it to all HR people worldwide? A world full of hamstrung HR people would allow us to all get direct-hire jobs.
Actually it was 320 by 200, and "DOS Screens" were actually in text-mode that was measured in characters and not pixels.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
There is no reason anybody should be able to run unknown exes on a work computer without notifying IT first.
It's the only way to combat this kind of lack of basic IT knowledge that afflicts most office workers.
I work with people who have used PCs for over a decade who still lack basic IT knowledge and would still fall for this trick in a heartbeat. You cannot drill it into your staff to not open stuff like this, you have to actively prevent it happening.
I've seen some pretty intelligent people fall prey to email viruses, mostly in the older days when email viruses were effective. More recently, I know a very sharp woman who used the New York Times website without adequate defenses.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Your PC is now Stoned!
I thought that was DOS too, how is it called then? Isn't that MS DOS running the boot code?
Some jokes never get old.
Other ones... get integrated into the next version of systemd.
So just boot from a CD or USB drive and then fix the MBR.
Just cruising through this digital world at 33 1/3 rpm...
I looked at the timestamps of the files of a cryptolocker attack victim once - it's worth remembering that computers are very fast these days and it did quite a few GB per minute.
You're talking about BIOS graphics mode 13, MCGA 320x200 x256 colors onscreen pallet with an available color selection for those 256 palette entries of 24bits per R,G, or B.
Minor nitpick: the colour-palette only had a depth of 18 bits, ie. 6 bits per channel, not 24 bits.
720x400 is 80x25 textmode with the 9x16 system typeface. Doom was 320x200 CGA graphics mode (specifically IBM mode 13h, 256 colours). Both use the same amount of video memory (IIRC 16kB).
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
I thought QDOS, and thus the BSOD, went away with Windows Vista. At least, that's what the ads told me.
Are you implying that Microsoft might have lied to me? :cry emoji:
No, it's mostly VMS. Take a look at the extensive lawsuits when David Cutler was hired from DEC, and took a lot of his old VMS developer team with him to create the kernel for Windows NT.
Hey, slashdot, the technical site how about telling us the name of the Operating System and the Hardware Platform this ransomware runs on? hint Windows and Intel ..
Actually, DOOM was 320x240. 320x200 was Duke Nukem 3D. The reason to use 320x240 is because the pixels were square. However, the screen was split into banks of four because 320x240 pixels is too large to fit in a 64 KiB segment (ie pixels 0,4,8,⦠are in bank 0, pixels 1, 5,9,⦠are in bank 1, etc.) which makes accessing the framebuffer more complicated and slower. 320x200 has slightly rectangular pixels, but the framebuffer is linear and fits in 64KiB, which is the largest segment size that can be accesses in real mode DOS.
Or boot using UEFI, which probably breaks this. Toss in Secure Boot, and even if they wrote a UEFI bootloader they wouldn't be able to intercept the boot process.
Cue idiots who make inaccurate comments about UEFI and betray their technical ignorance.
Would you like to revise your information? DOOM engine renders at 320x200 (16:10 aspect ratio). You'll also find that the memory space for 320x240 is the SAME (it's a VGA mode which uses a more efficient algorithm) as the CGA 320x200 mode (which in 1993 was STILL the most common graphics mode available to MOST PC users hence the denominator for developers). Also, the only reason to split the screen was during multiplayer mode on console (eg Saturn, N64). It makes absolutely no sense to bank the screen quadrants when you're using the same amount of memory to render and MORE memory (and processor clocks) to stitch the quadrants.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
I honestly entered this story hoping to read lots of merciless ridicule of these phrases.
Where is it? Or have all the geeks finally left Slashdot?
STOP . AMERICA . NOW
I was hoping for exactly the same, there's a brief mention of it followed by someone(user 4,496,745, yikes) seriously asking
That, a day or so after some prick from the gadget show made it to the front page pontificating on things we all know he has absolutely no grasp of, this just isn't my slashdot any more and it's sad.
Did you not RTFA? It only claims to encrypt the data, but does not actually do it.
Mielipiteet omiani - Opinions personal, facts suspect.
320x240x8bit is 76800 bytes, more than 64KB. It required bank switching, but it was easier than the GP wrote. VRAM was still linear, but you needed a VESA BIOS call to change the 64KB VRAM bank accessible in the 64KB video memory segment. Of 320x240, 204.8 lines fit in the first bank, the remaining ones in the second bank. As a display line split in two banks is very unhandy, you could increase the virtual resolution to 512x240 an had 128 full lines in bank 0 and the other 112 lines in bank 1.
(Score:4, Insightful)
No, please.
The reason to use 320x240 is because the pixels were square.
I would agree with you, except DOOM actually did use 320x200, and indeed the pixels were rectangular. It's a common problem that forks (known in DOOM circles as "source ports") face when they try to change up the rendering engine. Many of the graphics in the game were even designed with the knowledge that the screen would be stretched due to the non-square pixels, meaning that unstretching would degrade them.
320x200 has slightly rectangular pixels, but the framebuffer is linear and fits in 64KiB, which is the largest segment size that can be accesses in real mode DOS.
Yeah, except doom uses DPMI, so this doesn't even matter.
Yes I did. But the article took a quote from its source and summarized it a bit differently. Here is the original quote from the source:
As of this writing we assume that only the file access is blocked but the files themselves are not encrypted. Experts at the G DATA SecurityLabs are still analyzing this new type of ransomware.
That is a bit less confident than TFA states.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
QDOS AKA MSDOS went away with the NT Kernel, the last Microsoft OS running on MSDOS was Windows ME. Windows Vista (NT 6.0) added to the BSOD with a more critical R(ed)SOD but the B(lue)SOD was still there. I don't know if the RSOD survived into Windows 7 NT6.1.
Star Trek, there maybe hope.
That's as much a misconception than "text mode = DOS".
This is neither. This is malware that installs code to the MBR that loads before any OS. In fact, it's sort of it's own OS, running on bare metal.
FC Closer
In Russian, Petya - is variation of name Peter. A childish way to say that name. That makes me wonder...
This is actually true for Windows as well - need local admin to write to the mbr.
The difference is that wine will simply refuse and fail.
Whereas, on windows, this will open an UAC prompt which user have taken the habit (...have been pavlovian-trained...) to click okay to get anything done due to countless badly designed pieces of software.
Also if the machine is using uefi/"Secure Boot" wouldn't be affected either.
That's a bit more complicated.
If the disk is partitioned in Legacy mode, this will fry the partition table.
The UEFI firmware won't be able to locate the special FAT32 boot partition ("EFI system partition") with the bootloader .EFI executable used by the OS.
The system is left in an unbootable state, and the few next available boot options will be taken in turns, eventually reaching legacy boot, which will load the booter code of the malware.
If the disk is partitioned in GPT mode, things will get a little bit more complex.
Some UEFI firmware implementation DO require an appropriate "Guarding DOS partition" to boot in UEFI mode (some are even picky about whether the ms-dos "BOOT" flag should be set on that guarding partition). Of course, none of which is standardised.
Because of this, and because the partition table is hosed, some UEFI firmware won't detect the availability of the EFI system partition and won't boot in UEFI mode, again degrading to next available modes, eventually reaching the point they attemps a legacy MBR boot.
Some other UEFI implementation completely ignore the MBR and go straight for the GPT.
Then it depends on the malware. I can't find reliable sources whether the malware does encrypt files on the disk or not.
If it doesn't, then MBR-ignoring UEFI firmware will boot as usual. No problem noticed beyond the initial bluescreen crash.
If the malware does encrypt files, the boot process will fail at some point (depending on the encrypted fils).
The only difference that "Secure booting" brings, is that it refuses to run .efi executables (like bootloader) which weren't signed by Microsoft's key or any key that an admin has loaded into the system (for Linux users that do use it, but don't use the shim and load their own keys instead).
The system will refuse to boot all the same as above (except for the single exception), and simply won't fall back to displaying the skull. But the system is hosed all the same.
I can't find relliable information about what exactly is encrypted, so it's impossible to know if simply rebuilding the partition table using a USB boot stick (like System Rescue CD) is enough, or whether a decryption tool will be eventually needed to rescue important files from the drive.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Brings back memories. I remember when i got my first IBM PS2 MODEL 30....1024 kilobytes of memory. 12 screaming MEGAhertz of CPU power. MS-DOS 3.3. That cost me about $2000.00, way back in 1987.
I mean intelligent and thoughtful people who are competent in the real world and do have common sense. I'm not impressed by the sort of "book-smart" people you describe. Been there, done that, learned better.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I think that's kinda the point. You only do that if you're in the biz of ransoming data. Literally no applicants ever turn their word doc resume/CV into a .exe just 'cos
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.