Many Firms Hit By Global Cyber-Attacks - BBC News

[6Foot2]

Link: Many firms hit by global cyber-attacks - BBC News

 

Firms around the globe are reporting that they have been hit by a major cyber-attack.

 

British advertising agency WPP is among dozens of firms reporting problems.

 

Ukrainian firms, including the state power distributor and Kiev's main airport were among the first to report issues.

 

Some experts are suggesting that it could be a ransomware attack, similar to Wannacry which hit last month.

 

Others reporting problems include the Ukrainian central bank, the aircraft manufacturer Antonov, and two postal services.

 

Russian oil producer Rosneft and Danish shipping company Maersk also say they face disruption, including its offices in the UK and Ireland...

[elsiegee40]

It's a massive attack and the list of victims is growing

Spanish media reports that the offices of large multinationals such as food giant Mondelez and legal firm DLA Piper have suffered attacks.

And French construction materials company St Gobain has said that it is also fallen victim.

[jthompson]

On The Register:https://www.theregister.co.uk/2017/06/27/ransomware_outbreak_hits_ukraine/

[spacebar]

Looks to be much worse than last time, lots of tills and ATM's hit. Mostly abroad however. Edit: oh now they say on the register some in the city has it also.

 

There was a photo on Sky News of an aeroplane and all the seat back screens infected. I was curious how this was possible as I thought each screen was a form of tablet. They reported it had to land. Now has been removed so maybe it was fake!

Edited June 27, 2017 by spacebar

[free780]

You'd think the patch to counter the SMB1 vulnerability would have been widely deployed now.

[XiJ]

Looks to be much worse than last time, lots of tills and ATM's hit. Mostly abroad however. Edit: oh now they say on the register some in the city has it also.

 

There was a photo on Sky News of an aeroplane and all the seat back screens infected. I was curious how this was possible as I thought each screen was a form of tablet. They reported it had to land. Now has been removed so maybe it was fake!

 

There was a BA flight that declared an emergency. Wonder if it was that.

[6Foot2]

Link: What is the Petya ransomware spreading across Europe? WIRED explains | WIRED UK

 

...A new strain of malicious code dubbed Petya (and sometimes referred to as Petrwrap) was first spotted encrypting computers in Ukraine and then systems in Spain, Germany, Israel, the UK, Netherlands and the US...

[spacebar]

There was a BA flight that declared an emergency. Wonder if it was that.

 

Maybe, but I understand the entertainment system is physically separate from the flight stuff, besides I doubt those tabs run Windows. Very interested to see if it's real.

[Arthur]

"Kill switch" found.*

 

https://twitter.com/0xAmit/status/879789734469488642

 

Create a file called perfc with no extension in %windir%

 

https://twitter.com/PTsecurity_UK/status/879779707075665922

 

 

* Obviously the best "kill switch" is to install the latest Microsoft updates!

Edited June 27, 2017 by Arthur

[SteveM555]

"Kill switch" found.*

 

https://twitter.com/0xAmit/status/879789734469488642

 

 

 

 

 

* Obviously the best "kill switch" is to install the latest Microsoft updates!

Will be doing this first thing in the morning.. Just incase...

 

echo Disabled!>%windir%\perfc

 

Should be an easy way and fast way

[gh5000]

Just had this into my inbox

 

Kaspersky Lab’s analysts are investigating the new wave of ransomware attacks targeting organisations across the world. Our preliminary findings suggest that it is not a variant of Petya ransomware as publically reported, but a new ransomware that has not been seen before. While it has several strings similar to Petya, it possesses entirely different functionality. We have named it “ExPetr”.

 

The company’s telemetry data indicates around 2,000 attacked users so far. Organisations in Russia and the Ukraine are the most affected, and we have also registered hits in Poland, Italy, the UK, Germany, France, the US and several other countries.

 

This appears to be a complex attack, which involves several vectors of compromise. We can confirm that modified EternalBlue and EternalRomance exploits are used by the criminals for propagation within the corporate network.

 

• Kaspersky Lab detects the threat as UDSDangerousObject.Multi.Generic, Trojan-Ransom.Win32.ExPetr.a, HEUR:Trojan-Ransom.Win32.ExPetr.gen.

• Our behavior detection engine SystemWatcher detects the threat as PDM:Trojan.Win32.Generic, PDM:Exploit.Win32.Generic

 

In most cases to date, Kaspersky Lab proactively detected the initial infection vector through its behavioral engine, System Watcher. We are also working on behavioral anti-ransomware detection improvement to proactively detect any possible future versions.

Kaspersky Lab experts will continue to examine the issue to determine whether it is possible to decrypt data locked in the attack – with the intention of developing a decryption tool as soon as they can.

 

What should you do?

 

We advise all companies to update their Windows software: Windows XP and Windows 7 users can protect themselves by installing MS17-010 security patch.

 

We also advise all organisations to ensure they have backup. Proper and timely backup of your data may be used to restore original files after a data loss event.

1. Kaspersky customers should:

• Check that all protection mechanisms are activated as recommended; and that they have not disabled the KSN and System Watcher components, which are enabled by default.

• As an additional measure, using the HIPS component of Kaspersky Endpoint Security you can prevent the execution of the file with name perfc.dat, and block the utility PSExec from packet Sysinternals.

• Enable the Default Deny protection component of Kaspersky Endpoint Security which makes it possible to proactively defend against the attack.

 

2. Not a customer?

• Use the AppLocker feature to disable the execution of any files that carry the name “perfc.dat” as well as the PSExec utility from the Sysinternals Suite.

• You can also download the free Kaspersky Anti Ransomware Tool to protect your company from ransomware attacks.

 

3. Want to learn more about ransomware? Kaspersky Lab is a founding member of a not-for-profit project to provide decryption tools to affected machines. You can find out more about the initiative at Nomoreransom.org.

[Jamman960]

https://www.malwaretech.com/2017/06/petya-ransomware-attack-whats-known.html Has some interesting info, it seems as though one of the initial vectors may have been Ukrainian accounting software "MeDoc" via software updates. With this software being required by the government over there it's no wonder it propagated so quickly

 

I guess the equivalent for us would be sims/other MIS updates being infiltrated, think I'll start assessing everything that has its own updating mechanisms for potential weaknesses. Most these days seem to verify files prior to deployment but I suppose some of the smaller software packages may not be so sophisticated/security conscious

[Arthur]

Just had this into my inbox

Even more details on Kaspersky's blog...

 

https://securelist.com/schroedingers-petya/78870/

 

How does the ransomware spread?

To capture credentials for spreading, the ransomware uses custom tools, a la Mimikatz. These extract credentials from the lsass.exe process. After extraction, credentials are passed to PsExec tools or WMIC for distribution inside a network.

 

Other observed infection vectors include:

 

• A modified EternalBlue exploit, also used by WannaCry.
  
• The EternalRomance exploit – a remote code execution exploit targeting Windows XP to Windows 2008 systems over TCP port 445 (Note: patched with MS17-010).
  
• An attack against the update mechanism of a third-party Ukrainian software product called MeDoc.
  

IMPORTANT: A single infected system on the network possessing administrative credentials is capable of spreading this infection to all the other computers through WMI or PSEXEC.

 

What does the ransomware do?

The malware waits for 10-60 minutes after the infection to reboot the system. Reboot is scheduled using system facilities with “at” or “schtasks” and “shutdown.exe” tools.

 

Once it reboots, it starts to encrypt the MFT table in NTFS partitions, overwriting the MBR with a customized loader with a ransom note. More details on the ransom note below.

 

Network survey

The malware enumerates all network adapters, all known server names via NetBIOS and also retrieves the list of current DHCP leases, if available. Each and every IP on the local network and each server found is checked for open TCP ports 445 and 139. Those machines that have these ports open are then attacked with one of the methods described above.

 

Password extraction

Resources 1 and 2 of malware binary contain two versions of a standalone tool (32-bit and 64-bit) that tries to extract logins and passwords of logged on users. The tool is run by the main binary. All extracted data is transferred back to the main module via a named pipe with a random GUID-like name.

[Davit2005]

Would all this ransom-ware be such a big issue if their was no anonymous/trackless payment methods??

[vikpaw]

You'd think the patch to counter the SMB1 vulnerability would have been widely deployed now.

You would think that.

 

For anyone that is confused, a step by step on how to disable via group policy:

 

[deprecated]

 

Edit: See @Arthur's post below

Edited June 28, 2017 by vikpaw

[Arthur]

For anyone that is confused, a step by step on how to disable via group policy:

 

https://blogs.technet.microsoft.com/staysafe/2017/05/17/disable-smb-v1-in-managed-environments-with-ad-group-policy/

Microsoft have some proper GPOs for disabling SMB1 now...

 

www.edugeek.net/forums/security/185880-smb1-can-now-disabled-through-group-policy.html#post1591674

[ollyyllo]

Would all this ransom-ware be such a big issue if their was no anonymous/trackless payment methods??

 

Supposedly, hackers who use gift cards are harder to track down, and that's what they used before Bitcoin was a thing.

 

But obviously Bitcoin makes the whole operation alot faster, but it is possible to track payments. I think the convenience is the appeal. As we saw with the NHS attack, they drew too much attention and didn't withrdaw anything, possibly for fear of being tracked.

[Arthur]

Microsoft have confirmed the initial infection vector as being the MEDoc updater.

 

New ransomware, old techniques: Petya adds worm capabilities « Microsoft Windows Security Blog

 

The new ransomware has worm capabilities, which allows it to move laterally across infected networks. Based on our investigation, this new ransomware shares similar codes and is a new variant of Ransom:Win32/Petya. This new strain of ransomware, however, is more sophisticated.

 

To protect out customers, we released cloud-delivered protection updates and made updates to our signature definition packages shortly after. These updates were automatically delivered to all Microsoft free antimalware products, including Windows Defender Antivirus and Microsoft Security Essentials. You can download the latest version of these files manually at the Malware Protection Center.

 

Windows Defender Advanced Threat Protection (ATP) automatically detects behaviors used by this new ransomware variant without any updates.

Edited June 28, 2017 by Arthur

[gshaw]

Just pushed that perfc file down via GPP as a precaution

[jthompson]

I've updated our AV policies to prevent any processes from creating psexesvc.exe. If I understand it correctly, this ought to help prevent an infected system from launching the malware on other systems on the local network (as well as stopping any legitmate use of PSExec, but that shouldn't break anything for us). From McAfee - https://kc.mcafee.com/corporate/index?page=content&id=KB89540.

 

Even if you're all patched against the SMB exploits, one infected machine on the network can spread it around. Nasty.

Edited June 28, 2017 by jthompson

[smarties11]

For McAfee schools.....

 

In addition to the rules mentioned by @jthompson above - there is an EXTRA.DAT available which will protect against this new threat until McAfee incorporate protection into their daily DAT file. I would recommend that all McAfee schools check this EXTRA.DAT in to ePO and keep an eye on this page (https://kc.mcafee.com/corporate/index?page=content&id=KB89540) for any updates to the EXTRA.DAT.

 

With the WannaCry ransomware, McAfee were a good 3-4 days before protection was available in the daily DAT, so importing the EXTRA.DAT and monitoring for updates to it is critical!

[jthompson]

Hmm, the policy in McAfee ePO to prevent psexesvc.exe from running doesn't seem to actually work for me. I can still use PSExec from another machine and see psexesvc.exe running on my machine as a result.

[psydii]

You'd think the patch to counter the SMB1 vulnerability would have been widely deployed now.

 

It doesn't use that vulnerability. It just used expected SMB behaviours to spread. Once it is on a box it steals credentials (e.g shared local admin ones) and infects over the local subnet using those details.

 

Mitigations: Windows Firewall rules, segregating your LAN into subnets, LAPS https://www.microsoft.com/en-us/download/details.aspx?id=46899

[smarties11]

Hmm, the policy in McAfee ePO to prevent psexesvc.exe from running doesn't seem to actually work for me. I can still use PSExec from another machine and see psexesvc.exe running on my machine as a result.

 

Have the PCs you are using definitely updated their policies? The default policy refresh interval I think is 60 minutes. You could try an agent wake-up call and ticking the 'force completely policy and task update' check box.

[jthompson]

Thanks. After trying that and confirming that the updated policy settings are on the client (VirusScan Console -> Access Protection -> Properties) PSExec commands now just fail with "Access is denied".

 

However, after reverting the policy (and again confirming that change on the client) PSExec commands still fail with "Access is denied", which is not what I'd expect. I therefore don't know if it's McAfee doing something, or whether I just broke PSExec usage in some other way. Nothing has appeared in any Access Protection Logs today, so I'm inclined to think that McAfee doesn't have anything to do with the PSExec errors.