#notpetya

[amongrascals]

type of stuff the non-canon group does while all the other viruses are suffering

[virus-alert-blog]

Memories... Loading...

A little bit of NOTPETYA backstory for you<3 you're welcome for the sibling angst>:3

[machinesbleedtoo]

Cyberattacks attributed to Russia from as far back as *2015* mirror their kinetic war in Ukraine

Yes, even regarding their occupation of a nuclear plant.

Here are relevant excerpts from the full article I wrote on the topic of malware & industrial control systems some time ago, which you can read in full here. I copy pasted it so if links are weird check the original I am too tired to perfect it for a tumblr upload.

This is an art blog but I have been trying to make people read about these things for eons and it is, unfortunately, more relevant than ever right now.

Cyberattacks say a lot about intentions of the offender. They are not trapped in the cyber world. I think of them as a promise, not a test.

It was December 23rd 2015, and 200,000 Ukrainians were left without electricity for up to six hours. The attack shut off 30 distribution substations located in the Kyiv and western Ivano-Frankivsk region [1][21]. The malware forced manual power restoration since the SCADA equipment was inoperable, elongating the delay. The attack was not especially sophisticated, which makes it especially alarming — breakers were being tripped manually through remote control software. A variation of the BlackEnergy malware was identified as what facilitated the power outage. It too was introduced to the company network through spear-phishing emails.

Then on December 17th 2016, another power outage occurred in Ukraine as the consequence of a cyberattack, six days short of a year after the first. Approximately 225,000 customers were affected [1] though power was restored much faster this time around — within three hours. Only one transmission substation was impacted, located in Kyiv [21].

The most disturbing difference is the 2016 attack demonstrated an escalation in technique — it is believed to have been facilitated by direct SCADA manipulation malware. The malware became known as CRASHOVERRIDE, the first of its kind: crafted to disrupt electrical grids [1].

CRASHOVERRIDE was the fourth piece of malware directed specifically at ICSs. Preceded only by Stuxnet, BlackEnergy-2 and Havex. Havex and BlackEnergy are suspected to be the work of a group known as GRIZZLEY STEPPES, or occasionally Dragonfly/energetic bear. Evidence suggests they are a threat actor group with ties to Russian intelligence and military agencies [1]. Both attacks on Ukrainian power grids have been attributed to Russia [21].

A year later, In the early hours of June 27th 2017, malware not unlike Slammer spread around the world with unprecedented speed. Its crosshair was locked on Ukraine, and it nearly entirely crippled them.

It began with the CEO of Dragos — an ICS cybersecurity firm — tweeting a report indicating that an electric power supplier to Kyiv had been hacked. Maersk announces its IT systems are down not long after, with countless other companies subsequently being incapacitated. Their screens displayed nothing but a ransom note demanding payment to unencrypt the now inaccessible files. Around five hours pass and Kaspersky tweets a statement detailing that the ransomware is not that of any previously identified.

At the time of the Kaspersky report it had infected approximately 2,000 organizations [16]. The ransomware was credited with being the fastest propagating piece of software to date. It took 45 seconds to bring down the network of a large Ukrainian bank. In a major Ukrainian transit hub, it took 16 seconds. The attack cost more than $10 billion in damage [12]. The malware had the appearance of the ransomware Petya, but files were not unencrypted once the ransom was paid — that appearance was a distraction. The malware was a worm designed to cause immeasurable disruption. The malware was named NotPetya.

The list of victims is long and varied; It hit four hospitals in Kyiv, six power companies, two airports and more than twenty two Ukrainian banks. It managed to escape Ukranian networks, hamstringing hospitals in Pennsylvania and a chocolate factory in Tasmania, Australia. It incapacitated multinational companies including a pharmaceutical giant, a European subsidiary of FedEx and the Danish shipping company AP Moller-Maersk. Maersk was responsible for 76 ports all over the world and nearly 800 seafaring vessels. This attack rendered them inoperable — close to a fifth of the entire world’s shipping capacity had been immobilized [12].

Even Chernobyl nuclear power plant operations were impacted; they were forced to switch to manual radiation monitoring since its windows-based sensors had been shut down. ATMs and point-of-sale terminals were infected rendering citizens unable to pay for essential goods or transport if they did not have cash on hand. Even if they did, many vendors were equally as paralysed [12][13].

Some evidence suggests that the source of the infection was a Ukrainian software company pushing an update for their accounting software Me Doc. It was suspected to be the accidental conduit from which the worm propagated, though they deny this claim [17]. The attack has been attributed to Russia by the Five Eyes and Canada [15]. Possibly due to the fact that it also compromised Ukrenego, the energy company rendered inoperable by the 2016 power grid attack [12]. According to a spokesperson, the NotPetya attack did not affect the power supply [13]. The way in which NotPetya impacted the Chernobyl nuclear plant illustrates that such an attack may be equally as dangerous as a direct attack on ICS safety controls.

Then in the summer of 2017, not even a year later, an attack of that exact nature was discovered. It used the first known piece of malware that specifically targeted industrial safety systems designed to protect human lives [1] [9] [10].

In a worst-case scenario, the code could have resulted in an explosion or a release of toxic hydrogen sulphide gas. The 1984 Bhopal gas tragedy, amongst the world’s worst industrial disasters, involved a leak of poisonous gases and it killed thousands [10]. The malware was first discovered at an anonymous Saudi Arabian petrochemical plant. It earned the name TRITON, after the Triconex safety controller model it targeted.

TRITON’s most alarming characteristic was its focus on manipulating industrial safety systems and it was built to communicate using the proprietary TriStation protocol, of which there is no public documentation. It targeted the safety instrumental system with precision, with no manipulation of the DCS beyond using it to gain access [9]. The threat actor knew precisely what they were there to target and no time was wasted in doing so.

Evidence suggests the hackers had been inside the company’s corporate IT networks since 2014. It is suspected that they worked their way into an EWS through the network, potentially through a vulnerability or via employee login credentials. This allowed them to identify the make and models and firmware versions of the hardware controllers [10].

The attacker persisted even after failed attempts due to one of their script’s conditional checks [9]. In June 2017 a flaw in the code triggered a response from a safety system which brought the plant to a halt, first attributed to a mechanical glitch. In August, several more systems were tripped which caused a shutdown. This instigated an investigation to be called upon [10].

TRITON was suspected to be the work of Iran, but a FireEye report details evidence that suggests the attack may have been the work of The Central Scientific Research Institute of Chemistry and Mechanics, Moscow- a Russian government-owned organization. There is evidence of recent activity by this same threat actor [11] [36].

[o-b-d-w]

[minimoonstar]

[triplebaka-remade]

should i change my url to a computer virus name

[albertvonweinblog-blog]

Digi 1.3 Digitalous Kauppalehdessä - Digitaloutta piinaa kiristysohjelma

Digitaalisuus on suuri mahdollisuus yrityksille, mutta sen mukana tulee myös täysin uusia uhkia, joihin yritykset eivät välttämättä ole osanneet varautua juuri lainkaan. Tästä hyvänä esimerkkinä uusin kiristysohjelma NotPetya- ja GoldenEye -nimillä kutsuttu haitake.

Uusimman kiristysohjelman, joka tunnetaan maailmalla nimillä NotPetya ja GoldenEye, uhreiksi ovat jo joutuneet tanskalainen kuljetusfirma Maersk sekä venäläinen öljy-yhtiö Rosneft. Näiden lisäksi ohjelma on haitannut ainakin Tsernobylin ydinvoimalan, Ukrainan keskuspankin ja Boryspilin lentoaseman toimintaa ja järjestelmiä. Näin uutisoi Kauppalehti 28.6.2017.

Haittaohjelma hyödyntää samaa EternalBlue -nimellä kutsuttua hyökkäyskoodia kuin WannaCry. Microsoft paikkasi tietoturva-aukon maaliskuussa, mutta maailmalta löytyy edelleen päivittämättömiä järjestelmiä. Yhtiö kehoittaa varomaan erityisesti sähköpostin välityksellä leviäviä tiedostoja. Haittaohjelma salaa tietokeneen tiedot ja vaatii lunnaiksi 300 dollarin summaa bitcoineina.

“Näinkin laaja kyberhyökkäyksen onnistuminen kertoo siitä, kuinka surullisen heikoissa kantimissa monien yritysten päivitystenhallinta on. Niissä ei ole vieläkään saatu päivitettyä ongelmia, joita hyväksikäytettiin näkyvästi jo kuukausia aiemmin edellisissä hyökkäyksissä” - Teknologiajohtaja Juho Ranta

Miten sitten pitäisi toimia, jos on joutunut kyseisen kyberhyökkäyksen kohteeksi? Verkkopalveluiden tietoturva-aukkoja tutkivan Second Nature Securityn teknologiajohtaja Juho Ranta ohjeistaa seuraavaa:

Minkäänlaisia kiristysmaksuja ei pidä maksaa, koska ei ole mitään takeita siitä, että tiedostoja saisi takaisin

Kaikki käyttöoikeudet verkkolevyissä ja muissa vastaavissa laitteissa tulee vaihtaa, jos verkko on saastunut

Verkkolevyjen tapahtumalogeja tulee seurata saastuneiden laitteiden havaitsemiseksi

Pyri eristämään saastuneet laitteet työaseman verkosta

Muista aina päivittää ohjelmistot säännöllisesti

Lähde: Kauppalehti 28.6.2017.

[o-b-d-w]