Slashdot Mirror
The Petya Ransomware Is Starting To Look Like a Cyberattack in Disguise (theverge.com)
Further research and investigation into Petya ransomware -- which has affected computers in over 60 countries -- suggest three interesting things: 1. Ukraine was the epicentre of the attack. According to Kaspersky, 60 percent of all machines infected were located within Ukraine. 2. The attackers behind the attack have made little money -- around $10,000. Which leads to speculation that perhaps money wasn't a motive at all. 3. Petya was either "incredibly buggy, or irreversibly destructive on purpose." An anonymous reader shares a report: Because the virus has proven unusually destructive in Ukraine, a number of researchers have come to suspect more sinister motives at work. Peeling apart the program's decryption failure in a post today, Comae's Matthieu Suiche concluded a nation state attack was the only plausible explanation. "Pretending to be a ransomware while being in fact a nation state attack," Suiche wrote, "is in our opinion a very subtle way from the attacker to control the narrative of the attack." Another prominent infosec figure put it more bluntly: "There's no fucking way this was criminals." There's already mounting evidence that Petya's focus on Ukraine was deliberate. The Petya virus is very good at moving within networks, but initial attacks were limited to just a few specific infections, all of which seem to have been targeted at Ukraine. The highest-profile one was a Ukrainian accounting program called MeDoc, which sent out a suspicious software update Tuesday morning that many researchers blame for the initial Petya infections. Attackers also planted malware on the homepage of a prominent Ukraine-based news outlet, according to one researcher at Kaspersky. Ars Technica has more.
So the Russians did it?
How did the NSA go from "No Such Agency" to one that can't keep control over tools like this? What in the hell happened?
I suspect that Russia's growing use of "cyber war" tactics against its enemies will eventually backfire in the political arena. They really can't expect that governments, both friend and foe, will not start to lean on them in a more forceful way. I think and all-out âoecyber warâ between a growing number of countries would be very very very bad for everyone.
If you want news from today, you have to come back tomorrow.
Now everything is "nation-sponsored", so-called expert now throw this at everything without handing a single proof of it's claims, and sometimes not even making sense.
It doesn't always "have to be Putin" but there is a reason why it frequently is Russia.
1) They have the resources. No country has a better human resource for hacking than Russia. They have a large highly trained tech-savvy population. They've put more effort into teaching people to be computer literate than almost anywhere else. They also have a wild-west type law enforcement that overlooks a lot of hacking and allows people to hone their skills that way.
2) They have a motive. Russia is semi-openly hostile to most countries that lay to it's West. They have a policy of constantly testing our defenses. They frequently fly planes into other countries airspace to see how quickly they will react, the cyber warfare is more of the same testing. They're seeing how we will react.
3) They have a leader who doesn't give a damn what other countries think of them. Putin wants what is best for Russia and doesn't care if that makes people in other countries not like him. He doesn't want to be known as clean or honourable- he just wants to restore the empire. Furthermore, his background is in espionage. Being sneaky is in his blood.
"That's the way to do it" - Punch
1. Considering (as far as I know) one of the main propagation method for Petya was through a compromise accounting software mostly used in Ukraine, it's not surprising that Ukraine was the most affected.
2. The fact that very few people paid the ransom is completely irrelevant.
3. I'm pretty sure most of these ransomware are made by teenagers and amateurs. Buggy malware is very common.
So the question is, who are those "researchers" and what evidence do they have? More importantly, are those "researchers" politically motivated?
This sounds more like a skiddie modifying the source without understanding it and screwing up than a targeted attack. The code only damages the MFT, which is annoying but most of the time reversible. A nation state level attacker would've been much more thorough.
According to BleepingComputer.com, you can vaccinate against NotPetya by creating and adding 3 write-protected files to your C:\Windows folder: perfc, perfc.dat, and perfc.dll.
Content doesn't matter but "Read-only" status does.
licet differant, aequabitur
Yeah, what part of him de facto annexing parts of half a dozen neighboring countries and de jure annexing part of Ukraine would give one the impression that he wants to restore the empire? What part of Putin lamenting the fall of the Soviet Union would give one that impression?
"99 dead duelists of Dios on the wall. 99 dead duelists of Dios! Take one's ring, pass it around..."
How was the attack poor? Sure, they didn't make any money, but they fucked up a lot of Ukraine businesses. Mission accomplished, I'd say.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Care to name half a dozen neighboring countries parts of which Putin annexed de facto or otherwise?
That's one way of looking at it; this is another:
From Krebs on Security
For the non-native English speakers here (and I know there are a lot of you), fecal theater is a euphemism for shit show.
You know no one particularly trusts America either right. It's a pretty low bar.
CIA and America have been influencing other countries elections since, almost forever.
But yep it's the Russians (and the Chinese, those damn "Commies")...
Cyberattack? Not really. People have already forgotten that the ISP responsible for receiving emails of people desiring to pay the ransom was BLOCKED by the ISP so nobody could pay. This accounts in large part for why the hackers (wherever and whoever they are) didn't collect much money. Anyway, what with all the cyber attacks and ransomware going around I'm still amazed that after all this time, those machines infected STILL HAVE NOT upgraded their OS. It sure pays to do so. But what do I know---I'm not a windows user.
highly trained tech-savvy population
I recall how it all started. Westerners had money, credit cards, and software, that was protected from being stolen.
Post-soviet kids didn't, so they had works to do. I was reading those cracker magazines, they have been very educational.
Servant of karma
They didn't get paid, the entire premise of the ransomware failed because they chose an e-mail provider that decided they wouldn't support them. The goal wasn't to fuck anything up, it was to ransom the data and hope a portion of their "victims" didn't have a good backup plan and paid up.
The businesses technically fucked themselves by a series of bad decisions, first of all, not having backups, not having a competent IT person, running (unpatched) Windows on public systems and/or blindly installing some software, perhaps they'll reconsider their choices in the future.
Custom electronics and digital signage for your business: www.evcircuits.com
Malware that flows around the internet and infects random nations?
... never got a chance to study the routers."" Nations don't comment much on the efforts of other nations, to experts or the media.
No security service or nation would allow their own side, nation, interests to be at any risk from random malware.
Malware thats in the wild doing stuff to a lot of nations is not a national cyber event.
Its just malware and a slow news day.
Read up on how nations really consider and use their cyber assets. Nations take care to ensure the system, user or server is the only thing thats accessed.
Lets do some reading
The Inside Story of How British Spies Hacked Belgium’s Largest Telco (December 13 2014)
https://theintercept.com/2014/...
Read down to the "The hack would remain undetected for two years, until the spring of 2013" part and consider the quality and effort a nation puts into its code.
To stay in a network, only that network and not get found. No AV or websites or social media talking about that effort in real time.
Notice the difference after discovery too? ""
Stuxnet https://en.wikipedia.org/wiki/...
Equation Group https://en.wikipedia.org/wiki/...
Again stay hidden, works really well for the task, great effort to stay with interesting people and efforts not spreading back to creators own nation. Skills to try and avoid random AV detection too. Less AV chatter in real time in the wild.
Nations can try automated cyber efforts but again they are automated to respond to very interesting people and try not to get talked about in real time by AV and experts. The staging servers are not found in real time. Malware do random things to many nations is not a cyber effort.
Its just malware and a news story.
Look at list of how nations do their cyber.
Names and definitions of leaked CIA hacking tools (Mar 9, 2017)
https://techcrunch.com/2017/03...
Neat products by server, brand, target. No finding the servers, no finding the nations control GUI. Exploits that work and and can work around most consumer AV and their experts most of the time. Not malware that flows over anything, everything and anyone thats been talked about and studied in real time.
Discovering a Hive, or SparrowHawk would not be an option for a nation's cyber contractors or gov/mil staff.
Domestic spying is now "Benign Information Gathering"
Maybe because he's said that himself many times, especially when campaigning for election.
Even Moldova would be wrong - that particular civil war happened when Putin was just an aide for a local politician.
"It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
3) They have a leader who doesn't give a damn what other countries think of them. Putin wants what is best for Russia and doesn't care if that makes people in other countries not like him. He doesn't want to be known as clean or honourable- he just wants to restore the empire.
Fun exercise: Replace Putin with Trump and Russia with USA.
-- Make America hate again!
It was Ukrainian cybercriminals who wanted to make money but failed to do that because their email was blocked: http://www.news.com.au/technol... The reason Ukraine was the epicenter of the attack was because the criminals was from Ukraine and therefore had better access to Ukrainian targets or knew them better
Chechnya was not a separate country from Russia even after the Soviet Union broke up. It was and is within the Russian borders.
3) They have a leader who doesn't give a damn what other countries think of them. Putin wants what is best for Russia and doesn't care if that makes people in other countries not like him. He doesn't want to be known as clean or honourable- he just wants to restore the empire.
Fun exercise:
Replace Putin with Trump and Russia with USA.
For point 3, I in no way disagree with you. There is a reason those two men admire each other.
"That's the way to do it" - Punch
Russia is semi-openly hostile
That's a very nice way of putting a relationship which has in recent history resulted in one country taking a section of the other country by force.
Yes, we already know that you hate Russia. You have been writing about that "for fucking years, absolutely years".
And yes, Putin was absolutely right that the breakup of the USSR was a disaster - it sent millions of people into poverty, lowered their average life expectation by a decade, revoked many of their rights and freedoms and directly killed tens of thousands in the ensuing ethnic conflicts.
A slower and more peaceful transformation would have been far more preferable for everyone and all of this is just as true for Yugoslavia.
"It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
http://www.bbc.com/news/techno...
The tax software's update mechanism got compromised.
Mikko Hypponen, a security expert at F-Secure, is saying - "If you do business in Ukraine, the software (MEDoc) appears to be de facto,"
Microsoft is saying : "Active infections of the ransomware initially started from the legitimate MEDoc update process,"
Bingo Dictionary - Pragmatist, n. A myopic idealist.
I thought there were lots of reports of infections in Russia? Seems like a dangerous move.
But in general I think Russia's flagrant hacking is really going to come back to bite them. I believe the US is much better at this than Russia. And even if you disagree with that, I don't think any reasonable person would disagree that the US plus its major allies (ie Canada, UK, Germany, etc) are vastly better at this.
I think the only argument you could make is, well they're already attacking Russia and now Russia is just very publicly fighting back. Maybe in an attempt to position themselves to have negotiations for a "truce" between all nations. I think Russia would benefit a lot more from an agreement than the US would, so maybe appearing to be the largest threat actor helps their negotiating position?
If this was an attack on the Ukraine, it was almost certainly launched by Russia, who would not want Kaspersky to reveal that it was an attack. Yet they have. So I'm guessing that the DoJ investigation isn't going to find that Kaspersky is working for Russia. Except for selling them software.
As I read on Krebs' site, the stupid malware, unlike other malware that generates a unique email to arrange payment, used one, and only one email address. On finding this, the German ISP that the email was on blocked the email.
The result was that if you *wanted* to pay, you couldn't contact the scum to do so.
No, it was some wannabee idiot(s) who put it out there. And I'm still expecting them in court really soon... or "killed resisting arrest", since it sure seemed like Rosneft (that's the Russian mostly state-owned oil giant - think Exxon) was hit, too.
When was it? in 18th century?
I thought you were talking about post-soviet Russia
Let me educate you :) The USSR consisted of 15 republic states. According to the constitution of the USSR each republic state had a right to secede from the USSR. These republic states were: Armenia, Azerbaijan, Belarus, Estonia, Georgia, Kazakhstan, Kirghistan, Latvia, Lithuania, Moldova, Russia, Tajikistan, Turkmenistan, Ukraine, Uzbekistan.
https://en.wikipedia.org/wiki/...
As you can see there were no Chechnya among them. Chechnya was a part of the Russian republic state. In the end of 1991, all 15 republic states seceded from the USSR and became 15 independent states. The USSR ceased to exist. And because Chechnya was part of the Russian republic state within the USSR, it became a part of the current Russian Federation.
Putin wants what is best for Putin
FTFY.
'He who has to break a thing to find out what it is, has left the path of wisdom.' -- Gandalf to Saruman
This guy has to be a hired psyop. Everyone knows the US spent billions to fuck up Ukraine.
US spent $5 billion to destabilize Ukraine The United States spent $5 billion on Ukraine anti-government riots Neocons and the Ukraine Coup U.S. Admits It Spent 5 Billion to Overthrow Ukraine Victoria Nuland's Admits Washington Has Spent $5 Billion to "Subvert Ukraine" Nuland: Fuck the EU
The US spent billions to overthrow an elected president in Ukraine, created riots. Now Joe Biden's runs Ukraine's oil companies.
Did you even read your own links?
"That’s a distorted understanding of remarks given by a State Department official. She was referring to money spent on democracy-building programs in Ukraine since it broke off from the Soviet Union in 1991.
We rate the claim Pants on Fire."
And Taiwan is not a separate country from the People's Republic, but that doesn't make either of them exactly so.
You are talking what you know nothing about. I saw how the situation in Chechnya was developing very closely to me. To compare it to Taiwan? There wasn't anything close to Taiwan in resemblance in Chechnya. There were only 2-3 years of anarchy there when Russian government have no control over that Russian province. And that's it