Petya malware
Petya is a family of encrypting ransomwarethat was first discovered in 2016. The malware targets Microsoft Windows-based systems, infecting the master boot record to execute a payload that encrypts a hard drive'sfile system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system.
Variants of Petya were first seen in March 2016, which propagated via infected e-mail attachments. In June 2017, a new variant of Petya was used for a global cyberattack, primarily targeting Ukraine. The new variant propagates via the EternalBlue exploit, which is generally believed to have been developed by the U.S. National Security Agency (NSA), and was used earlier in the year by theWannaCry ransomware. Kaspersky Labreferred to this new version as NotPetya to disambiguate it from the 2016 variants, due to these differences in operation. In addition, although it purports to be ransomware, this variant was modified so that it is unable to actually revert its own changes.
History
Petya was discovered in March 2016;[2] Check Point noted that while it had achieved fewer infections than other ransomware active in early 2016, such as CryptoWall, it contained notable differences in operation that caused it to be "immediately flagged as the next step in ransomware evolution".[1] Another variant of Petya discovered in May 2016 contained a secondary payload used if the malware cannot achieve administrator-level access.[2]
The name "Petya" is a reference to the 1995James Bond film GoldenEye, wherein Petya is one of the two Soviet weapon satellites which carry a "Goldeneye" – an atomic bomb detonated in low Earth orbit to produce anelectromagnetic pulse. A Twitter account thatHeise suggested may have belonged to the author of the malware, named "Janus Cybercrime Solutions" after Alec Trevelyan's crime group in GoldenEye, had an avatar with an image of GoldenEye character Boris Grishenko, a Russian hacker and antagonist in the film played by Scottish actor Alan Cumming.[3]
2017 Cyberattack
Petya's ransom note displayed on a compromised system
On 27 June 2017, a major global cyberattackbegan (Ukrainian companies were among the first to state they were being attacked[4]), utilizing a new variant of Petya. On that day,Kaspersky Lab reported infections in France, Germany, Italy, Poland, the United Kingdom, and the United States, but that the majority of infections targeted Russia and Ukraine, where more than 80 companies were initially attacked, including the National Bank of Ukraine.[4][5] ESET estimated on 28 June 2017 that 80% of all infections were in Ukraine, with Germany second hardest hit with about 9%.[6]Russian president Vladimir Putin's press secretary, Dmitry Peskov, stated that the attack had caused no serious damage in Russia.[6] Experts believed this was a politically-motivated attack against Ukraine, since it occurred on the eve of the Ukrainian holiday Constitution Day.[7][8]
Kaspersky dubbed this variant "NotPetya", as it has major differences in its operations in comparison to earlier variants.[4] McAfeeengineer Christiaan Beek stated that this variant was designed to spread quickly, and that it had been targeting "complete energy companies, the power grid, bus stations, gas stations, the airport, and banks".[4][9]
It was believed that the software update mechanism of M.E.Doc — a Ukrainian tax preparation program that, according to F-Secure analyst Mikko Hyppönen, "appears to be de facto" among companies doing business in the country—had been compromised to spread the malware.[6][10][11]Analysis by ESET found that a backdoor had been present in the update system for at least six weeks prior to the attack, describing it as a "thoroughly well-planned and well-executed operation".[12] The developers of M.E.Doc denied that they were entirely responsible for the cyberattack, stating that they too were victims.[10][13][14][15]
On July 4, 2017, Ukraine's cybercrime unit seized the company's servers after detecting "new activity" that it believed would result in "uncontrolled proliferation" of malware. Ukraine police advised M.E.Doc users to stop using the software, as it presumed that the backdoor was still present.[12][16] Analysis of the seized servers showed that software updates had not been applied since 2013, there was evidence of Russian presence, and an employee's account on the servers had been compromised; the head of the units warned that M.E.Doc could be found criminally responsible for enabling the attack because of its negligence in maintaining the security of their servers.[17][15][12]
Operation
Petya utilizes a payload that infects the computer's master boot record (MBR), overwriting the Windows bootloader, and then triggering a restart. On the next startup, the payload is executed, which encrypts theMaster File Table of the NTFS file system, and then displays the ransom message demanding a payment made inBitcoin.[18][2][19] During this process, text purportedly output by chkdsk, Windows' file system scanner, is displayed on-screen, suggesting that the hard drive's sectors are being repaired.[1] The original payload required the user to grant it administrative privileges; one variant of Petya was bundled with an alternate payload known as Mischa, which is used if Petya fails to install. Mischa is a more conventional ransomware payload that encrypts user documents, as well as executable files, and does not require administrative privileges to execute.[2] The earlier versions of Petya disguised its payload as a PDF file, attached to an e-mail.[2] United States Computer Emergency Response Team (US-CERT) and National Cybersecurity and Communications Integration Center (NCCIC) released Malware Initial Findings Report (MIFR) about Petya on 30th June 2017.[20]
The "NotPetya" variant utilized in the 2017 attack uses EternalBlue, an exploit which takes advantage of a vulnerability in Windows'Server Message Block (SMB) protocol. EternalBlue is generally believed to have been developed by the U.S. National Security Agency (NSA);[19] it was leaked in April 2017 and was also used by WannaCry.[21][19] The malware uses multiple techniques to spreadto other computers on the same network, including harvesting passwords, and using those passwords in conjunction with PSExec to run code on other local computers.[22][23][24]Additionally, although it still purports to be ransomware, the encryption routine was modified so that the malware could not technically revert its changes.[25] This characteristic, along with other unusual signs in comparison to WannaCry (including the relatively low unlock fee of US$300, and using a single, fixed Bitcoin wallet to collect ransom payments rather than generating a unique ID for each specific infection for tracking purposes),[26] prompted researchers to speculate that this attack was not intended to be a profit-generating venture, but to damage devices quickly, and ride off the media attention WannaCry received by claiming to be ransomware.[27][28]
Mitigation
It was found that it may be possible to stop the encryption process if an infected computer is immediately shut down when the fictitious chkdsk screen appears,[29] and a security analyst proposed that creating read-only files named
perf.c and/or perfc.dat in the Windows installation directory could prevent the payload of the current strain from executing.[30][31][32][33] The email address listed on the ransom screen was suspended by its provider, Posteo, for being a violation of its terms of use. As a result, infected users could not actually send the required payment confirmation to the perpetrator.[26][34]
Microsoft had already released patches for supported versions of Windows in March 2017 to address the EternalBlue vulnerability. This was followed by patches for unsupported versions of Windows (such as Windows XP) in May 2017, in the direct wake of WannaCry.[35][36] Wired believed that "based on the extent of damage Petya has caused so far, though, it appears that many companies have put off patching, despite the clear and potentially devastating threat of a similar ransomware spread."[37] Some enterprises may consider it too disruptive to install updates on certain systems, either due to possible downtime or compatibility concerns, which can be problematic in some environments.[35]
Impact
During the attack initiated on 27 June 2017, the radiation monitoring system at Ukraine'sChernobyl Nuclear Power Plant went offline.[38] Several Ukrainian ministries, banks and metro systems were also affected.[39] It is said to be the most destructive cyberattack ever.[40]
Among those affected elsewhere included British advertising company WPP,[39] MaerskLine,[41] American pharmaceutical companyMerck & Co., Russian oil company Rosneft (its oil production was unaffected[42]), multinational law firm DLA Piper,[39] French construction company Saint-Gobain and its retail and subsidiary outlets in Estonia,[43]British consumer goods company Reckitt Benckiser,[44] German personal care companyBeiersdorf, German logistics company DHL,[45]United States food company Mondelez, and American hospital operator Heritage Valley Health System.[4][46] The Cadbury's Chocolate Factory in Hobart, Tasmania, is the first company in Australia to be affected by Petya.[47] On 28 June 2017, JNPT, India's largest container port, had reportedly been affected, with all operations coming to a standstill.[48] Princeton Community Hospital in rural West Virginia will scrap and replace its entire computer network on its path to recovery.[49]
The business interruption to the Maersk, the world's largest container ship and supply vessel operator, was estimated between $200 and $300m in lost revenues.[50]
Jens Stoltenberg, NATO Secretary-General, pressed the alliance to strengthen its cyber defenses, saying that a cyberattack could trigger the Article 5 principle of collective defense.[51][52]
Comments
Post a Comment