Petya malware

link1896

link1896

Mr Greenfield
Maybe it's the North Koreans, who knows. The methodology was born out of a windows vulnerability the USA home land security discovered. It's mainly delivered by email as an attachment.

It encrypts your hard drive and demands money via bitcoin. It's run wild today. Don't open an email program on a windows PC , best to check your email by webmail and delete anything suspicious. Don't trust attachments from anyone.

Update your antivirus definitions and let windows do a full update.
 
johnny

johnny

I'll tells ya!
Staff member
Russia released it into the wild, now it's eating them, just like wannacry did.
 
stirk

stirk

Burner
I disabled SMBv1 after wannacry even though my system is up to date with patches. I don't need to print much from my home laptop but I could always enable SMBv1 again if I did ;)

Given it would be difficult to near impossible for the hackers to effectively decrypt all the systems they have captured and the fact the revenue returned for the attack is nil I think these attacks are either learning experiences for young hackers or simply destructive acts. These attacks could take down serious infrastructure systems with fatal implications, these hackers are total fuckwits and should be treated as attempted murderers if caught.
 
link1896

link1896

Mr Greenfield
stirk said:
I disabled SMBv1 after wannacry even though my system is up to date with patches. I don't need to print much from my home laptop but I could always enable SMBv1 again if I did ;)

Given it would be difficult to near impossible for the hackers to effectively decrypt all the systems they have captured and the fact the revenue returned for the attack is nil I think these attacks are either learning experiences for young hackers or simply destructive acts. These attacks could take down serious infrastructure systems with fatal implications, these hackers are total fuckwits and should be treated as attempted murderers if caught.
Click to expand...
Security Now podcast is going to be interesting, haven't listened to it yet.

Surely the Petya code is dynamic and can roll new email addresses? The German ISP the email account was with kicked the user.

Doubt it's young kids, I'm thinking it's state sponsored.

I've heard horror stories, system backups were on a CIFS share with no authentication, Petya has encrypted user files on a desktop and found the CIFS share and encrypted the backups too.
 
Mr Crudley

Mr Crudley

Glock in your sock
link1896 said:
Surely the Petya code is dynamic and can roll new email addresses? The German ISP the email account was with kicked the user.

Doubt it's young kids, I'm thinking it's state sponsored.
Click to expand...
Slashdot mentions an update server for some accounting software was comprised and sent out petya. It might have harvested addresses from there onwards.

I'll bet state sponsored too.

For good or bad these things are damn interesting and having nastier payloads all of the time. Pity computers we built on mutual trust and goodwill once upon a time.

Sent from my F5121 using Tapatalk
 
stirk

stirk

Burner
I don't think this is sponsored by any govt or state dictatorship, the impacts to their own systems are too unpredictable. It took out systems at the Chernobyl reactor and could well have caused issues to operational reactors and other govt infrastructure.

Given that some 'leaders' are complete crackpots perhaps it's plausible...
 
johnny

johnny

I'll tells ya!
Staff member
These global ransomware attacks are a result of the recent CIA hack the Russians released to divert attention from the probe into electoral interference. These tools are all out in the wild now, could be anyone using them.
 
droenn

droenn

Fat Man's XC President
I dunno if this has anything to do with US - seems either Russia trying to further destablise Ukraine or perhaps an internal rogue? Just from quick reading, mind you.
 
You must log in or register to reply here.
Top