The massive WannaCry ransomware is not dead yet and another large scale ransomware attack is making chaos worldwide, infecting and shutting down Machines at scale. A new malware called “Petya Ransomware” or “Petwrap Ransomware” attacked many of the computers at banks, businesses, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding $300 in bitcoins.According to sources, the malware is spreading rapidly with the help of same Windows SMBv1 vulnerability that the WannaCry ransomware has misused earlier in May 2017 to infect 300,000 computers worldwide in just 72 hours.
What is Petya Ransomware?
Petya is a nasty piece of ransomware and works very differently from any other ransomware malware. Unlike other traditional ransomware, Petya does not encrypt files on a targeted system one by one.Instead, Petya reboots victims computers and encrypts the hard drive’s master file table and renders the master boot record inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.Petya ransomware replaces the computer’s MBR with its own malicious code that displays the ransom note and leaves computers unable to boot. According to Security Research firm Kaspersky, Petya could be a variant of Petya.A, Petya.D, or PetrWrap.
How is Petya Ransomware Affecting?
Petya ransomware is spreading over the Microsoft Windows SMB protocol. It uses the Eternalblue exploit tool, which exploits CVE-2017-0144. Just like Wannacry, it is taking advantage of unpatched Windows machines.Petya uses the NSA Eternalblue exploit but also spreads in internal networks with WMIC and PSEXEC. That’s why patched systems can get hit. Mikko Hypponen, Chief Research Officer at F-Secure, has tweeted.After the system is compromised, the victim is asked to send US $300 in Bitcoin to a specific Bitcoin address and then send an e-mail to them with the victim’s Bitcoin wallet ID to retrieve their individual decryption key.The victim’s computer is displayed with a message saying, “If you see this text, then your files are no longer accessible because they are encrypted. Perhaps you are busy looking for a way to recover your files, but don’t waste your time. Nobody can recover your files without our decryption service.”
Petya Ransomware Hits Banks, Businesses, and Telecom Companies
In past few hours, Petya ransomware has already infected Russian state-owned oil giant Rosneft, Ukrainian state electricity suppliers, “Kyivenergo” and “Ukrenergo.” There are also reports from several banks, including National Bank of Ukraine (NBU) and Oschadbank, confirming they have been hit by the Petya ransomware attacks.Maersk, an international logistics company, has also confirmed on Twitter that the latest Petya ransomware attacks have shut down its IT systems at multiple locations and business units. Three Ukrainian telecommunication operators, Kyivstar, LifeCell, Ukrtelecom, are also affected by the latest Petya attack.The most severe damages reported by Ukrainian businesses also include compromised systems at Ukraine’s local metro and Kiev’s Boryspil Airport.
How To Prevent Infection from Petya Ransomware?
Security researchers found that Petya ransomware encrypts systems after rebooting the computer. So if your system is infected with Petya ransomware and it tries to restart, just power it off immediately.If machine reboots and you see this message, power off immediately! This is the encryption process. If you do not power on, files are fine,”HackerFantastic tweeted.
Attacked by Petya Ransomware? Here’s What You Should do:
Infected users are advised not to pay the ransom because hackers behind Petya ransomware can’t get your emails anymore. So, even if you pay, you wouldn’t get your files back.Posteo, the German email provider, has suspended the email address (email@example.com) used by attackers to communicate with victims to receive the decryption keys.
A Critical Flaw Allows Hacking Your Linux Machines With Just A Malicious DNS Response
A critical flaw has been discovered in Systemd-resolved in Ubuntu, which is possible to trigger with a specially crafted TCP payload. Chris Coulson, Ubuntu developer at Canonical, has recently discovered this Linux vulnerability that can be exploited to remotely hack machines running the popular OS.The flaw, identified as CVE-2017-9445, actually resides in the ‘dns_packet_new’ function of Systemd, the init system and service manager for Linux operating systems. With this flaw, a remote attacker can potentially trigger the buffer overflow vulnerability to execute malicious code on the targeted machines via a DNS response.
According to an advisory published on June 27, a specially crafted malicious DNS response can crash ‘systemd-resolved’ program remotely every time the system tries to lookup for a hostname on an attacker-controlled DNS service. Eventually, large DNS response overflows the buffer, allowing an attacker to overwrite the memory which leads to remote code execution. This means the attackers can remotely run any malware on the targeted system or server via their evil DNS service.
“Certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that’s too small. A page-aligned number – sizeof(DnsPacket) + sizeof(iphdr) + sizeof(udphdr) will do this – so, on x86 this will be a page-aligned number – 80. Eg, calling dns_packet_new with a size of 4016 on x86 will result in an allocation of 4096 bytes, but 108 bytes of this are for the DnsPacket struct.” reads Canonical’s security advisory.“A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that’s too small, and subsequently write arbitrary data beyond the end of it,” explained Chris Coulson.According to Coulson, this vulnerability was present since Systemd version 223 introduced in June 2015 and affects all subsequent versions up to and including v23 launched in March this year.