Slashdot Mirror
Data-Wiping Malware Shamoon Destroys Files At Italian Oil and Gas Company; Other Energy Companies Operating in the Middle East Warned of Cyber Attacks (zdnet.com)
An anonymous reader writes: A new variant of the Shamoon malware was discovered on the network of an Italian and UAE oil and gas companies. While the damage at the UAE firm is currently unknown, the malware has been confirmed to have destroyed files on about ten percent of the Italian company's PC fleet.
Shamoon is one of the most dangerous strains of malware known to date. It was first deployed in two separate incidents that targeted the infrastructure of Saudi Aramco, Saudi Arabia's largest oil producer, in 2012 and 2016. During those incidents, the malware wiped files and replaced them with propaganda images (burning US flag, body of Alan Kurdi). The 2012 attack was devastating in particular, with Shamoon wiping data on over 30,000 computers, crippling the company's activity for weeks. Historically, the malware has been tied to the Iranian regime, but it's unclear if Iranian hackers were behind this latest attacks. This new Shamoon version was revealed to the world when an Italian engineer uploaded the malware on VirusTotal, triggering detections at all major cyber-security firms across the globe.
Shamoon is one of the most dangerous strains of malware known to date. It was first deployed in two separate incidents that targeted the infrastructure of Saudi Aramco, Saudi Arabia's largest oil producer, in 2012 and 2016. During those incidents, the malware wiped files and replaced them with propaganda images (burning US flag, body of Alan Kurdi). The 2012 attack was devastating in particular, with Shamoon wiping data on over 30,000 computers, crippling the company's activity for weeks. Historically, the malware has been tied to the Iranian regime, but it's unclear if Iranian hackers were behind this latest attacks. This new Shamoon version was revealed to the world when an Italian engineer uploaded the malware on VirusTotal, triggering detections at all major cyber-security firms across the globe.
https://www.cbsnews.com/news/iran-hacking-charming-kitten-targets-us-nuclear-officials-cybersecurity-certfa-2018-12-13/
When I see articles like this, I wish they could reveal details like what antivirus and firewalls were used.
...
Got to figure this sort of thing comes from nerds who think everyone should ride a bicycle or ride a EV bus or buy a EV car if you must. Yes of course you inject malware and erase important files and they will just go away.
The affected users didn't have backups, both on-site and remote... Typical.
Wipe the systems and restore backups.
Annoying, not dangerous.
was revealed to the world when an Italian engineer uploaded the malware on VirusTotal, triggering detections at all major cyber-security firms across the globe
So at that time, all of the sirens in the AV companies went off exactly at the same time.
There must have been some fun support phone calls there. Signatures are not a bad _first_ step, but really? That's the best we can mostly do??
I had one once trigger on a BAT file I had just written. We had a support contact with an unnamed company, but our McAfee support rep was a bit confused. "How can you be confused? I'm using your predefined scan settings. I wrote it from scratch, so unless there's virus stenography hidden in the top bit of each byte it's NOT a virus. What, are you keying off file length?"
But I always wanted to write a Virus.bat file that (a) you had to run manually, (b) prompted you to insert a new floppy to infect, and (c) give it to a friend and tell them to run the virus file. (Yep, it was that long ago.)
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
No, the corporate executives learned of a subpoena for business records and mysteriously malware founds its way onto the corporate network and destroyed files. ;-)
This version of Shamoon overwrites original files with garbage data. This garbage data might look like encrypted content to an untrained eye, but it's just random bits of information that can't be recovered with an encryption key.
LOL. I'd like to meet the "trained eye" that can discern "random bits of information" from "encrypted content".
Are there really that many computers at large multi-national corporations running the 32 bit NT kernel? Why? Answer in 100,000 words or less.
Computers banned throughout the universe by Italian courts. All programmers to be detained indefinitedly for questioning. Mentions of the word "computer" punishable by a minimum 6 months prison sentence. #scienceisacrimeinitaly