Slashdot Mirror
The Petya Ransomware Is Starting To Look Like a Cyberattack in Disguise (theverge.com)
Further research and investigation into Petya ransomware -- which has affected computers in over 60 countries -- suggest three interesting things: 1. Ukraine was the epicentre of the attack. According to Kaspersky, 60 percent of all machines infected were located within Ukraine. 2. The attackers behind the attack have made little money -- around $10,000. Which leads to speculation that perhaps money wasn't a motive at all. 3. Petya was either "incredibly buggy, or irreversibly destructive on purpose." An anonymous reader shares a report: Because the virus has proven unusually destructive in Ukraine, a number of researchers have come to suspect more sinister motives at work. Peeling apart the program's decryption failure in a post today, Comae's Matthieu Suiche concluded a nation state attack was the only plausible explanation. "Pretending to be a ransomware while being in fact a nation state attack," Suiche wrote, "is in our opinion a very subtle way from the attacker to control the narrative of the attack." Another prominent infosec figure put it more bluntly: "There's no fucking way this was criminals." There's already mounting evidence that Petya's focus on Ukraine was deliberate. The Petya virus is very good at moving within networks, but initial attacks were limited to just a few specific infections, all of which seem to have been targeted at Ukraine. The highest-profile one was a Ukrainian accounting program called MeDoc, which sent out a suspicious software update Tuesday morning that many researchers blame for the initial Petya infections. Attackers also planted malware on the homepage of a prominent Ukraine-based news outlet, according to one researcher at Kaspersky. Ars Technica has more.
So the Russians did it?
Let the blaming of Russia commence. If some "security expert" concludes "a nation state attack was the only plausible explanation" then it's gotta be Putin, right?
How did the NSA go from "No Such Agency" to one that can't keep control over tools like this? What in the hell happened?
Putin get off the netcom netcruiser account, we only have 40 hrs a month!
PUTIN!
Suck on the lollipop!
TRUMP powa!
I suspect that Russia's growing use of "cyber war" tactics against its enemies will eventually backfire in the political arena. They really can't expect that governments, both friend and foe, will not start to lean on them in a more forceful way. I think and all-out âoecyber warâ between a growing number of countries would be very very very bad for everyone.
If you want news from today, you have to come back tomorrow.
The attackers behind the attack have made little money -- around $10,000. Which leads to speculation that perhaps money wasn't a motive at all.
Slashdot yesterday
The ransom note demands victims send bitcoin to a predefined address and contact the hacker via email to allegedly have their files decrypted. But the email company the hacker happened to use, Posteo, says it has decided to block the attacker's account, leaving victims with no obvious way to unlock their files.
So that would take care of both point 2 and point 3
Or are you guys just interested in perpetuating propaganda now? (Yeah I know.. silly rhetorical question...)
Now everything is "nation-sponsored", so-called expert now throw this at everything without handing a single proof of it's claims, and sometimes not even making sense.
1. Considering (as far as I know) one of the main propagation method for Petya was through a compromise accounting software mostly used in Ukraine, it's not surprising that Ukraine was the most affected.
2. The fact that very few people paid the ransom is completely irrelevant.
3. I'm pretty sure most of these ransomware are made by teenagers and amateurs. Buggy malware is very common.
So the question is, who are those "researchers" and what evidence do they have? More importantly, are those "researchers" politically motivated?
This sounds more like a skiddie modifying the source without understanding it and screwing up than a targeted attack. The code only damages the MFT, which is annoying but most of the time reversible. A nation state level attacker would've been much more thorough.
According to BleepingComputer.com, you can vaccinate against NotPetya by creating and adding 3 write-protected files to your C:\Windows folder: perfc, perfc.dat, and perfc.dll.
Content doesn't matter but "Read-only" status does.
licet differant, aequabitur
While everybody is busy watching this attack,what else is slipping under the radar.
It reminds me of when every man and his dog was watching for a big,known asteroid to pass close to us,so nobody noticed the one coming in from another direction that then went bang over a Russian city..
I expect a few business's to have to declare in a few months time that they were compromised by something totally different and far more damaging today..
The reason the individuals behind the attack didn't make money and all those customers are hosed is because the email address was blocked by the email provider. That was confirmed yesterday. The rest is speculation and hyperbole by idiots without a clue.
Basically this is what happened: some idiot got their hands on some code, thought he was going to get rich and got immediately blocked by taking out his communication. The "attack" was poor because the criminals are idiots.
Custom electronics and digital signage for your business: www.evcircuits.com
You know no one particularly trusts America either right. It's a pretty low bar.
CIA and America have been influencing other countries elections since, almost forever.
But yep it's the Russians (and the Chinese, those damn "Commies")...
This guy has to be a hired psyop.
Everyone knows the US spent billions to fuck up Ukraine.
US spent $5 billion to destabilize Ukraine
The United States spent $5 billion on Ukraine anti-government riots
Neocons and the Ukraine Coup
U.S. Admits It Spent 5 Billion to Overthrow Ukraine
Victoria Nuland's Admits Washington Has Spent $5 Billion to "Subvert Ukraine"
Nuland: Fuck the EU
The US spent billions to overthrow an elected president in Ukraine, created riots.
Now Joe Biden's runs Ukraine's oil companies.
It was poor because it could have been much worse.
I'm glad these modern malware authors are so greedy. They make the infection apparent so quickly it's no wonder they fail. This attack could have stayed silent for a few months and it would have been much worse and made a lot more money.
People see a big skull with a flashing background they will sure as hell talk about it.
Cyberattack? Not really. People have already forgotten that the ISP responsible for receiving emails of people desiring to pay the ransom was BLOCKED by the ISP so nobody could pay. This accounts in large part for why the hackers (wherever and whoever they are) didn't collect much money. Anyway, what with all the cyber attacks and ransomware going around I'm still amazed that after all this time, those machines infected STILL HAVE NOT upgraded their OS. It sure pays to do so. But what do I know---I'm not a windows user.
Malware that flows around the internet and infects random nations?
... never got a chance to study the routers."" Nations don't comment much on the efforts of other nations, to experts or the media.
No security service or nation would allow their own side, nation, interests to be at any risk from random malware.
Malware thats in the wild doing stuff to a lot of nations is not a national cyber event.
Its just malware and a slow news day.
Read up on how nations really consider and use their cyber assets. Nations take care to ensure the system, user or server is the only thing thats accessed.
Lets do some reading
The Inside Story of How British Spies Hacked Belgium’s Largest Telco (December 13 2014)
https://theintercept.com/2014/...
Read down to the "The hack would remain undetected for two years, until the spring of 2013" part and consider the quality and effort a nation puts into its code.
To stay in a network, only that network and not get found. No AV or websites or social media talking about that effort in real time.
Notice the difference after discovery too? ""
Stuxnet https://en.wikipedia.org/wiki/...
Equation Group https://en.wikipedia.org/wiki/...
Again stay hidden, works really well for the task, great effort to stay with interesting people and efforts not spreading back to creators own nation. Skills to try and avoid random AV detection too. Less AV chatter in real time in the wild.
Nations can try automated cyber efforts but again they are automated to respond to very interesting people and try not to get talked about in real time by AV and experts. The staging servers are not found in real time. Malware do random things to many nations is not a cyber effort.
Its just malware and a news story.
Look at list of how nations do their cyber.
Names and definitions of leaked CIA hacking tools (Mar 9, 2017)
https://techcrunch.com/2017/03...
Neat products by server, brand, target. No finding the servers, no finding the nations control GUI. Exploits that work and and can work around most consumer AV and their experts most of the time. Not malware that flows over anything, everything and anyone thats been talked about and studied in real time.
Discovering a Hive, or SparrowHawk would not be an option for a nation's cyber contractors or gov/mil staff.
Domestic spying is now "Benign Information Gathering"
LOL, Putin spent only a fraction of that to overthrow the Democrats. Ruthless efficiency.
Lots of otherwise credible news sites are claiming that this attack permanently damages hard drives because it wipes the master boot record. I'm sorry but if you don't know how to repair a borked MBR you should probably stick to using an iPad.
its just a bunch of computers crashing, there has to be more windows botched updates every day in this planet that break computers than this little tiny thing
imagine a blaster that deletes hard drives, now that would be FUN
It was Ukrainian cybercriminals who wanted to make money but failed to do that because their email was blocked: http://www.news.com.au/technol... The reason Ukraine was the epicenter of the attack was because the criminals was from Ukraine and therefore had better access to Ukrainian targets or knew them better
So, absolutely no evidence for this being anything than crappy ransomware...
- Very little money earned. That's to be expected when the only way to pay the perpetrator is an email account, which was closed shortly after the ransomware was released.
- One of the attack vectors was an update for an accounting program only used in Ukraine. Other sources puts this accounting program as the initial vector, and the simple explanation would be that the attacker had access (legitimately or otherwise) to their update servers. A smart attacker would use a pwned server with no reference to himself, a dumb attacker would use his place of work. Both have been seen many times before.
- The ransomware has a destructive bug. So did the Morris internet worm.
In short, the only people who sees anything other than a ransomware attack here are those who want to see Russians everywhere. McCarthy is back with a vengeance.
so is this posting with nothing but speculation and author fanatasy.. They didn't get much money, probablt because the germans blocked their messaging acount used to make money. And so on and on, Much more likely this story is again yet another cia/nsa/usa manipulated story about something they did in the first place.
It's all they do nowadays, fuck up everything and blame someone else for it. Just so they can hope to get their warmachine going full speed again.
Tell me again these aren't JEW Muppets and puppets.
http://www.bbc.com/news/techno...
The tax software's update mechanism got compromised.
Mikko Hypponen, a security expert at F-Secure, is saying - "If you do business in Ukraine, the software (MEDoc) appears to be de facto,"
Microsoft is saying : "Active infections of the ransomware initially started from the legitimate MEDoc update process,"
Bingo Dictionary - Pragmatist, n. A myopic idealist.
I thought there were lots of reports of infections in Russia? Seems like a dangerous move.
But in general I think Russia's flagrant hacking is really going to come back to bite them. I believe the US is much better at this than Russia. And even if you disagree with that, I don't think any reasonable person would disagree that the US plus its major allies (ie Canada, UK, Germany, etc) are vastly better at this.
I think the only argument you could make is, well they're already attacking Russia and now Russia is just very publicly fighting back. Maybe in an attempt to position themselves to have negotiations for a "truce" between all nations. I think Russia would benefit a lot more from an agreement than the US would, so maybe appearing to be the largest threat actor helps their negotiating position?
US gains from Russia being blamed if it was or wasn't Russia. There IS reason to frame Russia. American government gets their justification to force Europeans to sanction Russia, which they have been reluctant to do, as of late.
If this was an attack on the Ukraine, it was almost certainly launched by Russia, who would not want Kaspersky to reveal that it was an attack. Yet they have. So I'm guessing that the DoJ investigation isn't going to find that Kaspersky is working for Russia. Except for selling them software.
As I read on Krebs' site, the stupid malware, unlike other malware that generates a unique email to arrange payment, used one, and only one email address. On finding this, the German ISP that the email was on blocked the email.
The result was that if you *wanted* to pay, you couldn't contact the scum to do so.
No, it was some wannabee idiot(s) who put it out there. And I'm still expecting them in court really soon... or "killed resisting arrest", since it sure seemed like Rosneft (that's the Russian mostly state-owned oil giant - think Exxon) was hit, too.