Meet the sequel to WannaCry, the wide-ranging ransomware attack that crippled businesses around the globe last month.
On Tuesday, another widespread ransomware attack began halting unprepared businesses in their tracks. The new attack uses the same method of propagation as WannaCry: A leaked hacking tool called Eternal Blue, which has been linked to the U.S. National Security Agency.
One of the major differences between the two attacks is that the most recent event does not yet appear to be susceptible to a hardcoded “kill switch.” That means it may prove harder to overcome.
Security experts have been warning organizations that failed to apply security patches to their Microsoft Windows-based computer systems that it was only a matter of time before another digital siege surfaced. It seems their predictions have borne true.
Get Data Sheet, Coins2Day’s technology newsletter.
Here’s a quick FAQ to get you up to speed.
What has happened?
A wave of ransomware attacks spread like wildfire on Tuesday. Many Microsoft Windows-based computers—specifically, ones not protected against a vulnerability in a Microsoft messaging protocol called SMB-1—began seizing up worldwide, locking employees out of their desktops, and displaying ransom notes.
Unable to access their files and folders, workers and managers were greeted by on-screen demands for payment of $300 in Bitcoin, a digital currency often used by cyber extortionists because it’s easy to send and hard to track.
Who has been affected?
The attack struck organizations in the U.S., Australia, Italy, Germany, Poland, Ukraine and Russia. Costin Raiu, director of global research at Russian security firm Kaspersky Labs, posted a bar graph on Twitter showing the geographic distribution of victims, according to what his firm could measure. (Kaspersky’s customer base skews towards Russian-speaking countries, which might explain the spread.)
Https://twitter.com/craiu/status/879727503157473281
Some of the affected companies include Maersk (AMKBY), the Danish shipping giant, Rosneft, the Russian oil company, WPP, the British advertising agency, and Merck (MRK), the U.S. Pharmaceutical giant. There are reports that the attack has also affected banks, hospitals, governments, airports, and other organizations.
What is Petya?
Initial analyses suggested that the latest wave of attacks involved malware based on Petya, a type of ransomware that first surfaced last year. Further investigations have disputed this analysis. In lieu of a better name, some cybersecurity firms, such as Kaspersky, have begun referring to the latest malware as “NotPetya.”
Jeremiah Grossman, chief security strategist at the cybersecurity firm SentinelOne, told Coins2Day there isn’t enough evidence yet to uncover the malware’s provenance. “This outbreak has similar characteristics as Petya, such as infecting the MBR [Master Boot Record, an important component of Microsoft computer hard drives] and encrypting the entire drive, however, it is not clear yet that this is a Petya variant,” he said.
How did this happen?
Companies that failed to patch their systems against the Microsoft vulnerability were open to this attack. It’s still not clear what the initial attack vector was. But once inside, the worm could spread across computer networks via the hole in Microsoft SMB-1.
It seems that many of the organizations affected by the malware operated industrial systems. These machines can be hard to patch because they run critical processes are difficult to take offline. “Organizations like these typically have a hard time patching all of their machines because so many systems simply cannot have down time,” said Chris Wysopal, cofounder and chief tech officer of Veracode, an application security firm purchased by CA Technologies earlier this year.
What can businesses do to protect themselves?
There are a few simple steps businesses can take, as the cybersecurity firm Palo Alto Networks (PANW) explains on its “threat brief” blog. First, apply Microsoft patch MS17-010. Second, block connections to Microsoft Windows’ port 445, the part of the operating system associated with the vulnerable protocol. And finally, maintain regular data backups, and use them to restore systems.
Should you pay the ransom?
This is a continual source of debate in the information security community. The general belief is, no, you should not pay the ransom. For one, there’s no guarantee extortionists will return your files. Second, funding cybercriminals will encourage them to develop similar attacks in the future.
Still, sometimes companies take a gamble and pay up in the hopes that the criminals will restore access to their files and information. In this case, it appears as though customers will not be able to reclaim their data even if they do pay up. Posteo, the email service chosen by the attackers, said it blocked the account they created, meaning the extortionists have lost their channel to communicate with victims and hand over decryption keys. Despite this, the attackers’ Bitcoin wallet had already received 28 transactions equaling 3 Bitcoins, or more than $7,000, as of 3 P.M. ET on Tuesday.
Do not pay the #Petya ransom. You will not get your files back. The email address used is blocked! @SwiftOnSecurity @thegrugq pic.twitter.com/NOzxLz0vul
— haveibeencompromised (@HIBC2017) June 27, 2017
