28 ms·

Another Ransomware Outbreak Is Going Global

504 points by smn1234 9y ago

mihaifm 9y ago
> with WannaCry it was alleged a nation state was likely responsible for spreading the malware: North Korea Is there any evidence for this? Looks like another fake rumor.
- deleted 9y ago
  [deleted]
- smn1234 9y ago
  there are claims that it came from the Lazarus group...
- hacker_9 9y ago
  Security researchers matched parts of the WannaCry code to previous viruses that were thought to originate from NK. Of course they also said anyone could of copied and pasted the code and just made it look like that, but the media ignored that part.
  - nyolfen 9y ago
    > The haystack needle Mehta presented Monday now connects Lazarus to WCry, although the tie connecting the two isn't precisely clear just yet. WCry's creators may have deliberately added code found in Cantopee in an attempt to trick researchers into mistakenly believing Lazarus Group is behind the ransomware. Researchers at antivirus provider Kaspersky Lab said such a "false flag" is plausible but improbable. The Cantopee code snippet, the researchers explained, was removed from later versions of WCry, making it hard to spot and hence ill-suited to act as a decoy. > [...] > Grooten went on to say, "BTW, 'North Korea' may well be a foreign hacker group paid by them." https://arstechnica.com/security/2017/05/virulent-wcry-ransomware-worm-may-have-north-koreas-fingerprints-on-it/ https://arstechnica.com/security/2017/05/virulent-wcry-ranso...
- zmmz 9y ago
  There's an article on it in NYT which provides a short list of the reaons: https://www.nytimes.com/2017/05/22/technology/north-korea-ransomware-attack.html https://www.nytimes.com/2017/05/22/technology/north-korea-ra... It basically comes to it looking like Lazarus Group The WannaCry attacks used the same command-and-control server used in the North Korean hack of Sony Pictures Entertainment in 2014, which wiped out nearly half of the company’s personal computers and servers. ... Other digital crumbs linking the North Korean group to WannaCry include a tool that deletes data that had been used in other Lazarus attacks. The hackers behind WannaCry also used a rare encryption method and an equally unusual technique to cover their tracks.
  - slim 9y ago
    Then WikiLeaks published CIA's Marble Framework https://wikileaks.org/ciav7p1/cms/page_14588467.html https://wikileaks.org/ciav7p1/cms/page_14588467.html
paulpauper 9y ago
store important stuff on external hard drives never download suspicious stuff specially from emails
- Analemma_ 9y ago
  That's not enough anymore: good ransomware will look for backup systems and wipe those out before proceeding. You need read-only, airgapped backups before you can consider yourself safe.
  - derekp7 9y ago
    That doesn't help for targeted attacks, which corrupt the backups as they are being written. Not sure how to protect against that though.
    - danarmak 9y ago
      Use a filesystem that lets you take regular snapshots, like zfs.
      - pmlnr 9y ago
        This is good for now, but snapshots are like RAID: they are not backups.
        tensor 9y ago
        They are if you send them offsite. Backups with version history are great if you can swing them.
        floatboth 9y ago
        Startup idea: zfssend.net, a place to send snapshots to As A Service :D
        9y ago
nlte 9y ago
This isn't yet the cyberattack "the world isn't ready for" (https://www.nytimes.com/2017/06/22/technology/ransomware-attack-nsa-cyberweapons.html https://www.nytimes.com/2017/06/22/technology/ransomware-att...), is it?
- devopsproject 9y ago
  no. you will know when the big one hits because you won't be able to ask this question online and get an immediate answer.
- deleted 9y ago
  [deleted]
- strictnein 9y ago
  No. This attack is using the EternalBlue vector (MS17-010[0]) and CVE-2017-0199[1]. Updated systems are unaffected. [0] https://technet.microsoft.com/en-us/library/security/ms17-010.aspx?f=255&MSPPError=-2147217396 https://technet.microsoft.com/en-us/library/security/ms17-01... [1] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
bkor 9y ago
The Netherlands and various other countries have created laws where either their version of the NSA and/or police can hoard 0days to be used for hacking. This massive outbreak is so widespread that at this stage it appears that it either was a very recent 0day or something which only recently was fixed by a patch. Instead of having loads of countries hoarding security problems I highly encourage a focus on security instead. Seems much better for the economy overall.
- rm_-rf_slash 9y ago
  In theory, yes. In practice, the reality may be more complicated. How many ongoing investigations and clandestine operations rely on 0days that could be patched tomorrow? Even if this weren't the case somehow, I could imagine intelligence chiefs and the like defending their 0days as necessary on public safety or national security grounds. Edit: just to clarify, I believe 0days should be reported and patched to make everybody safer.
  - tobltobs 9y ago
    Your strange theory, that the economical damage is unavoidable to improve security will break down hard if those 0days are used by terrorists for the first time.
    - rm_-rf_slash 9y ago
      I'm not condoning this action I'm just arguing that it's a likely path for politicians to take because of political and media pressures. Of course I think 0days should be reported and patched immediately.
    - criley2 9y ago
      "Your strange theory, that the economical damage is unavoidable to improve security will break down hard if those 0days are used by terrorists for the first time" It's not a "strange theory", it's the literal reason: NatSec is not a strange theory, it's the stated reason by multiple administrators and officials for why this behavior occurs. Plus, how much economic damage was mitigated by using zerodays against terrorists and foiling their plots? What if they used a zero day and prevented a 9/11 size 3000 person, multi-billion-dollar terrorist attack? To suggest that the needle is at 0 and any negative use makes the entire NatSec angle bad is very naive, because any successful NatSec use that has succeeded is classified and we're not privy. So we don't know the score, and we certainly can't claim that the score favors one side after any particular event... But, keep this in mind, Israeli hackers compromised an ISIS computer and were keeping tabs on plots including a plot to weaponize laptop batteries, up until DJT burned the source by outing the Israeli op to Russians. So the idea that zero days aren't in active use seeing results against terrorists is very naive, I believe.
jdc0589 9y ago
FYI, looks like this is still using EternalBlue.
mbaha 9y ago
A friend sent me the bitcoin address, they've already collected 2600$. [EDIT] Now 3230$ Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaA...
- mrb 9y ago
  What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.
  - cynicalreason 9y ago
    it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected. company I work for disabled all working from home VPN accounts for the time being until we do a security audit
  - SmallDeadGuy 9y ago
    There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.
    - mbaha 9y ago
      Exactly. This is a huge attack. The amounts paid don't mean a thing.
    - 49para 9y ago
      Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.
  - 9y ago
mighty_warrior 9y ago
Your own fault if you didnt patch out eternalblue. No sympathy for hacked orgs.
- strictnein 9y ago
  Also uses a client side exploit in Word/Wordpad, although that was patched earlier this month: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
  - cm2187 9y ago
    Moronic design of the microsoft page. It requires you to acknowledge some bullshit T&C on first visit, then redirects you to the website home page. Which means that someone clicking on the CVE to check if there is anything important will be redirected to a home page with no information. Most sane people will go back to the original link, but if there were only sane people in this world, this second wave of malware would be toothless. That's not exactly helping awareness of the vulnerability.
nuclx 9y ago
As someone affected by the ransomware - did anyone else notice empty console windows popping up from time to time the days before the ransomware triggered the encryption?
- simopaa 9y ago
  This is most likely due to the Office bug: https://www.digitaltrends.com/computing/here-is-a-fix-for-microsoft-office-command-prompt-issue/ https://www.digitaltrends.com/computing/here-is-a-fix-for-mi...
  - Flammy 9y ago
    Agreed. Previously following the steps here removed the problem for me on 3 different Windows 10 computers. (PC gamers were particularly impacted by this, as the command prompt flickering would minimize full screen games...)
  - devopsproject 9y ago
    this was really annoying
- misterdata 9y ago
  I did see those console windows here on Windows 10 but I am not (yet?) affected. So might also be related to something else (Windows Defender updates?).
- paulpauper 9y ago
  how do you think you got infected?
r721 9y ago
>We have confirmed U.S. cases of Petya ransomware outbreak https://twitter.com/Bing_Chris/status/879713682242117634 https://twitter.com/Bing_Chris/status/879713682242117634
voidmain0001 9y ago
Kaspersky wrote about Petya 16 months ago. https://blog.kaspersky.com/petya-ransomware/11715/ https://blog.kaspersky.com/petya-ransomware/11715/ Has the delivery changed causing it to resurface again?
- wila 9y ago
  Yes, it is a "petya variant" [0] [0] https://isc.sans.edu/diary/22560 https://isc.sans.edu/diary/22560
athenot 9y ago
Do these attacks affect anything else beyond Windows?
- neoeldex 9y ago
  Not that I'm aware of, just windows in this case.
- swiley 9y ago
  They can supposedly be manually run in wine on non-windows.
jannes 9y ago
This is even more proof how powerful a 0-day in the wrong hands can be. All of the affected companies' should be considered compromised by the NSA. Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised. Ransomware is much more visible than spyware. Think about all the spyware-infected PCs/networks that nobody knows about.
- rsync 9y ago
  "Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised." March 14 of what year ? I would say 2000 but I am open to discussion ...
  - spacemanmatt 9y ago
    I sent my first packet-of-death to an unprotected Windows machine in 1996, so...
    - samstave 9y ago
      1997 here :-) hat was that XP xploit app from back then... I cant recall what it was called...
      - colecut 9y ago
        back orifice? subseven?
        freeflight 9y ago
        Subseven was just a trojan, tho a really fancy one I had lots of fun with as a kid.
        samstave 9y ago
        Back orifice!
vldx 9y ago
Interestingly, WPP mandates all it's employees to shut down their computers – irrespective of the OS. > As a precaution, WPP is mandating that everyone immediately shut down all computers, both Macs and PCs. This applies to you whether you are in the office or elsewhere. Working on an office computer remotely is not an option. Please leave your computers turned off until you hear from us again. > Many thanks for your co-operation and patience. > Best regards,
- SpeakMouthWords 9y ago
  How do they plan on contacting the employees en masse if the computer is off?
  - hsod 9y ago
    Probably via their smart phones
    - rahkiin 9y ago
      So a smartphone is not a computer anymore? The world we live in..
      - ccozan 9y ago
        I think is a matter of semantics, not of functionality. A smartphone is a computer per design, but no one is calling it like that.
      - devopsproject 9y ago
        its a colloquialism computer = desktop\laptop
      - khedoros1 9y ago
        My calculator's a computer, but I don't call it that. My game systems are all computers, but I don't call them that either (and never have, unless I was discussing semantics).
      - 9y ago
jz10 9y ago
My friend's work laptop is a victim of this same attack... all the way here in the Philippines. There was a company wide email blast to disconnect all workstations from the internet at once. Fascinating development
- kozhevnikov 9y ago
  A literal case of 'in case of cyberattack break glass' https://i.imgur.com/fHhkdxX.jpg https://i.imgur.com/fHhkdxX.jpg
- dirtylowprofile 9y ago
  What company in the PH is this?
hackrack 9y ago
Idea: What if the purpose of these WannaCry style ransomware attacks isn't to get people to pay in Bitcoin, but to drive up the price of Bitcoin?
- fpgaminer 9y ago
  WannaCry caused the price to drop, rather sharply. If anything, the purpose would be to buy cheap Bitcoins and hope the price later corrects back upwards after the news has blown over. I suspect the price drop is due to some trading algorithms using sentiment analysis. They see all the negative press around these ransomware, see the included word Bitcoin, assume the negative article is about Bitcoin, and automatically sell. But that's just my theory, since I have a hard time imagining human traders seeing news like this and selling because of it.
  - 52-6F-62 9y ago
    It would certainly have a cascading effect, however, because the news soon follows about Bitcoin/all crypto dropping and both bots and watchful traders take their profits out and either get scared out of the market, or hope to capitalize on the dip.
  - smitherfield 9y ago
    >But that's just my theory, since I have a hard time imagining human traders seeing news like this and selling because of it. Sure they might; the more Bitcoin/cryptocurrency is associated with cybercrime, the more likely it is to be banned (sending the price to ~0 in the affected countries).
  - dx034 9y ago
    I doubt wannacry was the reason for the price drop. Rather extensive media coverage about bitcoin hitting $3k which probably woke up some people who realised that it might be the time to cash in.
    - fpgaminer 9y ago
      This was long before $3k. The price tanked immediately on May 12th and remained depressed until the 17th which was shortly after the initial outbreak was halted by the domain registration.
110011 9y ago
Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Does it always require human intervention for A. ? Thank you.
- dijit 9y ago
  Depends on The ransomware. Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet
  - jonknee 9y ago
    > Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet That's not at all what a 0-day means, it just means a previously unknown vulnerability. We've never seen a ransomware attack anywhere close to as sophisticated at Stuxnet. This latest attack is nothing new and is only affecting people who haven't kept their systems up to date.
    - dijit 9y ago
      I understand that this is not what it means. But generally speaking when an article says "0-day malware" it usually ends up meaning that no human involvement is needed. Please don't assume I don't know what 0-day actually means. I chose my words carefully as not not imply that I was saying the definition of the term.
  - astrodust 9y ago
    "0-day" does not mean without human intervention. That just means "previously undisclosed".
    - dijit 9y ago
      I understand that. Which is why I said "usually". Typically when we see news using the term 0-day it's because there was no human element needed in the infection of machines. Thinking back in recent memory (17~ years) I can't remember a time when 0-day was used when it didn't mean autonomous infection. Although. I fully understand that the term means that it's a previously unknown issue. Which is why I chose my words as carefully as I did.
secfirstmd 9y ago
(Sorry for the repost but I feel the pain of sysadmins so it might be useful to some people as everything melts down around them this evening)... Hey, FWIW we had to do some response for ransomware cases recently. There was a lack of decent stuff out there for how IT teams should deal with it. So we contributed to putting together this quick checklist: https://github.com/0xswap/guides/blob/master/ransomware-triage.txt https://github.com/0xswap/guides/blob/master/ransomware-tria... Would be great if more people wanted to add to it.
- voltagex_ 9y ago
  A minor nit: if you convert this over to markdown or ReStructuredText, it'll display more nicely on the page and be easier to move over to GitHub pages or the like.
  - secfirstmd 9y ago
    Good idea! Will do that.
gmisra 9y ago
Is anyone aware of an entity that attempts to objectively quantify the economic impact of an event like this (ransoms paid, data lost, labor hours lost, new security costs, etc)?
- d33 9y ago
  I wouldn't say new security is a cost - unless it's fake security, like antiviruses.
dz0ny 9y ago
Public analysis is tracked here https://otx.alienvault.com/pulse/59525e7a95270e240c055ead/ https://otx.alienvault.com/pulse/59525e7a95270e240c055ead/ Seems that payload servers are in Germany, France, and Malaysia. https://securelist.com/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks/77762/ https://securelist.com/petrwrap-the-new-petya-based-ransomwa...
butz 9y ago
One of my clients got some strange emails around 12:00 GMT with links to probably infected websites. Is this related to ransomware?
the_cat_kittles 9y ago
i said this before and it was met with mostly hostility, but im still wondering... bitcoin has enabled ransomware, so its a boon to crooks. what has it done for non-crooks? i dont mean conceptually (no fed! decentralized! etc. etc.), i mean since its come into being, what has it done for you personally? for me: i bought a vpn subscription, anonymously. probably not able to do that as easily without btc. but, i would personally trade that for not having ransomware attacks. thoughts?
- scottLobster 9y ago
  Depends on where you live. I doubt you'd have faced any repercussions for buying that VPN subscription with your credit card, but the governments of other countries might not be so understanding. Bitcoin should exist for the same reasons Tor exists. Just because Tor is used by child predators and of little practical use to the average Western citizen doesn't negate its positive value.
  - the_cat_kittles 9y ago
    "Just because Tor is used by child predators and of little practical use to the average Western citizen doesn't negate its positive value." you cant just say that and expect me to decide its worth it on balance, you need to make a case for it. maybe this isnt the place, but its a funny thing to just kind of assert. arguing that things should exist because there are potential upsides is missing the point, which is that the downsides may outweigh the upsides. its particularly bold to make that claim about tor- there must be a hell of an upside to justify the child predators...
    - KGIII 9y ago
      It enables secure, private, exchange of data. That is reason enough.
    - E6300 9y ago
      > its particularly bold to make that claim about tor- there must be a hell of an upside to justify the child predators Even if Tor didn't exist, there would be child pornography. Would there more, less, or just as much of it? That's difficult to say. It's also difficult to say how much easier it makes the lives of those fighting for freedom of speech. Thus, saying whether Tor is, overall, a "good" or "bad" technology would involve comparing two unknown quantities.
tudorconstantin 9y ago
Maybe this is the year of Linux on desktop.
- mikegerwitz 9y ago
  (You may or may not be joking; let's assume you're not for this response.) This is a dangerous argument. I'm a free software activist, and I firmly believe that security without free software is a facade, but that doesn't mean that free software is more always more secure; it's an open source argument that's been fairly easily refuted lately with high-profile bugs in software like OpenSSL. It's easier to hide secrets in proprietary software, but most security vulnerabilities are bugs, not explicit backdoors. So even bit-for-bit reproducibility won't defend you against that. I'm not saying you shouldn't use GNU/Linux---I think that every user deserves an operating system that is fully free, and hope that people will use it (or another free/libre OS). But my argument is on the basis of freedom, which still stands _regardless_ of security. It just so happens that I believe that strong confidence in the security of a system is not possible with proprietary software.
  - tudorconstantin 9y ago
    So far this year, Windows leads the scorecard regarding mass infections and business downtime due to them. So while indeed, open source is not a guarantee for better security, the results are in its favor. It might also be because it's not such an attractive target to hackers due to its low share in the desktop market. But still there millions of linux servers online 24h/24h and I assume they have a bigger potential for monetisation.
    - deleted 9y ago
      [deleted]
    - theossuary 9y ago
      Windows also leads the score card in installation base, which I think is the real causal relationship. If Linux was installed on 90% of desktops you better well believe there'd be a similar number of exploits for it. Something similar happened to Mac OSX not too long ago, as they grew in popularity more and more exploits were found for the operating system.
sniper007 9y ago
Test
strictnein 9y ago
On a related note, I don't understand the reason behind transactions like this: https://blockchain.info/tx/9778c698f3f2a2c9b9e9f0fdea3c96e8fe200b19cd4db382642178dd08405f4d https://blockchain.info/tx/9778c698f3f2a2c9b9e9f0fdea3c96e8f... Is there something special about using numerous senders like that?
- lordnacho 9y ago
  That just means someone's got a wallet containing the private keys corresponding to a lot of addresses. So when they want to move some coins, they just sign all the various transactions and send the money to new addresses.
- 3kajjak3 9y ago
  Some sort of attempt at laundering, perhaps?
- deleted 9y ago
  [deleted]
maddyboo 9y ago
Does anyone know if any tools exist on Linux which can be used for early detection of ransomeware? Something that monitors file access, disk activity, etc. for suspicious behavior and can trigger some action or alert? I think I remember some discussion about using a 'canary file' - some innocent looking file with known contents which should never be modified. If a modification is detected, you know something fishy is going on.
- tyingq 9y ago
  Aide is a popular utility to monitor for changes to files on Linux systems. http://aide.sourceforge.net http://aide.sourceforge.net You could also use the built in audit subsystem if you wanted to watch a specific canary file, directory, filesysyem, etc. https://www.linux.com/learn/customized-file-monitoring-auditd https://www.linux.com/learn/customized-file-monitoring-audit...
  - agumonkey 9y ago
    I thought tripwire was the standard.. happy to know another name.
    - tyingq 9y ago
      Tripwire got very stale after they split off a non open source commercial version. Aide filled that gap. I believe most people prefer it to the open source tripwire.
  - dotancohen 9y ago
    I'd like to emphasize the canary file. This is a file that you should never access in normal operations. Thus, if the file was in fact accessed, that is a sign that something is scanning your file system. Depending on the threat, such a scan might be a good reason to pull the cord from the mains socket. You don't want to let a normal shutdown occur, rather pull the cord and mount the disk on another system to recover / analyze.
  - singularity2001 9y ago
willstrafach 9y ago
FYI to Sysadmins: Paying the ransom at this point will be a waste of money, as the contact e-mail address has been blocked. https://posteo.de/blog/info-zur-ransomware-petrwrappetya-betroffenes-postfach-bereits-seit-mittag-gesperrt https://posteo.de/blog/info-zur-ransomware-petrwrappetya-bet... (German) https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomware-email-account-in-question-already-blocked-since-midday https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomwa... (English)
- sillysaurus3 9y ago
  It's always seemed like the best way to end ransomware is to launch hundreds of variants that demand money but don't actually decrypt anything. Unethical, to be sure, but eventually people would learn not to give them money. All the competent ransomware authors are probably quite unhappy whenever a defective ransomware strain pops up.
  - comboy 9y ago
    If it gets big enough then people just hear from each other if paying unlocks the data or not. The best way to end ransomware is to get serious about security. In many cases, being attacked by a ransomware, is paying a low price compared to if it was a targeted attack. edit: Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment.
    - notgood 9y ago
      >If it gets big enough then people just hear from each other if paying unlocks the data or not. The idea would be to create "fake" ransomware that looks exactly like the real one >The best way to end ransomware is to get serious about security No matter how serious you get there always gonna be bugs, there isn't a single piece of mass distributed software in human history without bugs. That said, we should try to improve security of software but expecting it to be THE solution is wrong. >Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment. Forging a signature is not that hard.
dagaci 9y ago
I'm afraid that this attack demonstrates that the old PC architecture: Side-loading any app, userspace, privilege escalation, low level file sharing functionality just isn't for purpose. If malware can exploit a 0-day, 100-day, 1000-day security hole in a corporate network of 2000 machines, its too easy for that malware to share itself across the network and send emails attachments to AllUsers (every single company I've worked for still allow Everyone to send anything to Everyone). Microsoft's next XP patch should be to remove SMB functionality or just outright disable it (and probably remove IE and other nonsense installed by default too). And when Windows 7 expires the final patch should be a severe lock down too..
- cm2187 9y ago
  It's clear that nothing bad can happen on a machine where you can't do anything.
- KGIII 9y ago
  If the final patch does that, nobody will apply it. Security is a process, not an application.
kator 9y ago
Looks like people are paying the ransom: https://blockchain.info/charts/balance?address=1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX https://blockchain.info/charts/balance?address=1Mz7153HMuxXT...
- dx034 9y ago
  Not a lot though. Given the huge number of infections, $9000 seems a pretty bad return.
Animats 9y ago
Maersk is down. Their main site says: Maersk IT systems are down We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack. We continue to assess the situation. The safety of our employees, our operations and customer's business is our top priority. We will update when we have more information.[1] Maersk is the largest shipping company in the world. 600 ships, with ship space for 3.8 million TEU of containers. (The usual 40-foot container counts as two TEUs.) If this outage lasts more than a few hours, port operations worldwide will be disrupted. [1] http://www.maersk.com/en http://www.maersk.com/en
- nothrabannosir 9y ago
  Great. Maybe we can finally put a price on lack of security protocol.
  - olewhalehunter 9y ago
    OSHA violation in 2025: operator was not using a deterministic operating system
    - lilott8 9y ago
      what you are suggesting has grave realities for those who cannot or do not want to mess with formal verification techniques. This is the future of computing and a lot of people will be left behind once this catches on.
      - ktta 9y ago
        >lot of people will be left behind once this catches on if this catches on.
  - merrickread 9y ago
    I dream of seeing a "security first" development process adopted ..
r721 9y ago
>Cyberattack hits entire Heritage Valley Health System, shuts down computers >A cyberattack is affecting the Beaver and Sewickley hospitals and all other care facilities in the Heritage Valley Health System on Tuesday. http://amp.wtae.com/article/cybersecurity-incident-heritage-valley-health-system/10228015 http://amp.wtae.com/article/cybersecurity-incident-heritage-...
agumonkey 9y ago
Did these ships are also oil tanker ?
- xapata 9y ago
  Oh, did you see that one in "Hackers" -- the DaVinci virus?
- kahnpro 9y ago
  The little boat tipped over
  - subcosmos 9y ago
    LOL! https://www.youtube.com/watch?v=2PxcDyfKV90 https://www.youtube.com/watch?v=2PxcDyfKV90
- sctb 9y ago
  We detached this subthread from https://news.ycombinator.com/item?id=14647605 https://news.ycombinator.com/item?id=14647605 and marked it off-topic.
emersonrsantos 9y ago
Does anyone know if this decrypt app still work? https://github.com/leo-stone/hack-petya https://github.com/leo-stone/hack-petya
agumonkey 9y ago
How can one check quickly if his OS is vulnerable ? I know MS pushed updates, but sometimes updates are stuck, or fail to install or are delayed by the user .. so
- 80211 9y ago
  Just do a Windows Update -> Update History and see if you have a cumulative update after 5/24. https://imgoat.com/uploads/2e74f10e03/26813.png https://imgoat.com/uploads/2e74f10e03/26813.png
HIBC2017 9y ago
If you're infected, don't pay the ransom. The email address that's used has been blocked by the email provider. https://twitter.com/HIBC2017/status/879747282173911040 https://twitter.com/HIBC2017/status/879747282173911040
elcapitan 9y ago
Kill switch has been found: https://twitter.com/PTsecurity_UK/status/879779707075665922 https://twitter.com/PTsecurity_UK/status/879779707075665922
- veb 9y ago
  The killswitch: https://twitter.com/0xAmit/status/879789734469488642 https://twitter.com/0xAmit/status/879789734469488642
  - SnowingXIV 9y ago
    This confirmed to work? Anyone else speak on this? If so props to the guy who discovered this.
    - lowpro 9y ago
      It is, although it isn't really a 'kill switch' in the sense it can't be deployed universally, but per system it works. This could be considered temporary though, as is turning off your computer if infected and NOT turning it back on. The encryption only takes effect after a restart.
- deleted 9y ago
  [deleted]
- benzinschleuder 9y ago
  Is a kill switch purpose to protect against a new infection? It doesn't help decrypting the files i guess? What is it used for?
- chipperyman573 9y ago
  Why would a ransomware author include a killswitch in their software?
  - gilgoomesh 9y ago
    Even ransomeware authors accidentally infect themselves and lose keys.
kronos29296 9y ago
I remember reading something about a guy warning about intrusions on his company during Wannacry to steal company data and install malware. Now we have this. This is giving me goosebumps.
jl6 9y ago
Could someone write a whitehat worm or virus to get into all those vulnerable Windows systems and close the door behind them by patching the hole?
- ChicagoBoy11 9y ago
  Software virus vaccines - I like it. Can’t believe I’ve never run across the concept before. Must be a thing, no?
  - msielski 9y ago
    https://en.m.wikipedia.org/wiki/Anti-worm https://en.m.wikipedia.org/wiki/Anti-worm
faragon 9y ago
Why Ransomware authors are not yet in jail? /cc FBI CIA BND MI5 FSB
- coolspot 9y ago
  FSB lol Even if FSB found hackers, they would take a share of profit and close the case.
kuon 9y ago
Those attacks are still "gentle" as if you have (and you should) a read only backup you can resolve it with near 0 dataloss. What I fear are cancer like virus, not wiping or encrypting data at time T, but introducing subtle errors on a longer period. You would be contacted by hackers saying your last 6 months of data contain error. That's scary.
tonyplee 9y ago
Wonder if they manage to disable the UK's Trident Nuclear Submarine this time. "Windows for Warship" https://en.wikipedia.org/wiki/Submarine_Command_System https://en.wikipedia.org/wiki/Submarine_Command_System "Want to Nuke someone, please send Bitcoin to unlock the systems." https://www.theregister.co.uk/2017/06/27/hms_queen_elizabeth_running_windows_xp/ https://www.theregister.co.uk/2017/06/27/hms_queen_elizabeth...
- flukus 9y ago
  The news here was reporting earlier that the Chernobyl monitoring computers were compromised. Edit: No link, but it was on ABC (Australia) live news, which is pretty reliable. Here is a less reliable source: https://www.independent.co.uk/life-style/gadgets-and-tech/news/hack-cyber-attack-ukraine-russia-wannacry-petya-security-internet-broken-computer-not-working-a7810626.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne...
  - deleted 9y ago
    [deleted]
  - xyrnoble 9y ago
    Is there a public link for that?
runeks 9y ago
> Ukraine's government, National Bank [..] Now there's a new attack target: the central bank. Send 100 BTC to this address and I will decrypt the balances stored by your central bank, so you, again, know how much money you own.
memracom 9y ago
Note that having a good multi-generational backup system in place for all machines, servers and laptops, would render this kind of ransomware harmless. But the state of IT has deteriorated so badly these days because management doesn't care any more. After all why care when you can just take your severance pay and get an increase in salary and more responsibility at another company. Rinse and repeat. It used to be that the primary job of system admins was to keep the data safe from loss. That was more important than keeping the systems running. How did we lose this?
andruby 9y ago
I always replay the end-game of Uplink [0] in my head when I read news like this. Great game with great music. [0] https://www.introversion.co.uk/uplink/ https://www.introversion.co.uk/uplink/
zvrba 9y ago
So.. ransomware authors want payments in Bitcoins. The obvious counter-attack from the governments would be to target and shut-down all services exchanging bitcoins (or other digital money) to real money. Heck, they can hack them and delete all data, so they shut down on their own.

504 points by smn1234 9y ago

> with WannaCry it was alleged a nation state was likely responsible for spreading the malware: North Korea Is there any evidence for this? Looks like another fake rumor.

deleted 9y ago
[deleted]
smn1234 9y ago
there are claims that it came from the Lazarus group...
hacker_9 9y ago
Security researchers matched parts of the WannaCry code to previous viruses that were thought to originate from NK. Of course they also said anyone could of copied and pasted the code and just made it look like that, but the media ignored that part.
- nyolfen 9y ago
  > The haystack needle Mehta presented Monday now connects Lazarus to WCry, although the tie connecting the two isn't precisely clear just yet. WCry's creators may have deliberately added code found in Cantopee in an attempt to trick researchers into mistakenly believing Lazarus Group is behind the ransomware. Researchers at antivirus provider Kaspersky Lab said such a "false flag" is plausible but improbable. The Cantopee code snippet, the researchers explained, was removed from later versions of WCry, making it hard to spot and hence ill-suited to act as a decoy. > [...] > Grooten went on to say, "BTW, 'North Korea' may well be a foreign hacker group paid by them." https://arstechnica.com/security/2017/05/virulent-wcry-ransomware-worm-may-have-north-koreas-fingerprints-on-it/ https://arstechnica.com/security/2017/05/virulent-wcry-ranso...
zmmz 9y ago
There's an article on it in NYT which provides a short list of the reaons: https://www.nytimes.com/2017/05/22/technology/north-korea-ransomware-attack.html https://www.nytimes.com/2017/05/22/technology/north-korea-ra... It basically comes to it looking like Lazarus Group The WannaCry attacks used the same command-and-control server used in the North Korean hack of Sony Pictures Entertainment in 2014, which wiped out nearly half of the company’s personal computers and servers. ... Other digital crumbs linking the North Korean group to WannaCry include a tool that deletes data that had been used in other Lazarus attacks. The hackers behind WannaCry also used a rare encryption method and an equally unusual technique to cover their tracks.
- slim 9y ago
  Then WikiLeaks published CIA's Marble Framework https://wikileaks.org/ciav7p1/cms/page_14588467.html https://wikileaks.org/ciav7p1/cms/page_14588467.html

paulpauper 9y ago

store important stuff on external hard drives never download suspicious stuff specially from emails

Analemma_ 9y ago
That's not enough anymore: good ransomware will look for backup systems and wipe those out before proceeding. You need read-only, airgapped backups before you can consider yourself safe.
- derekp7 9y ago
  That doesn't help for targeted attacks, which corrupt the backups as they are being written. Not sure how to protect against that though.
  - danarmak 9y ago
    Use a filesystem that lets you take regular snapshots, like zfs.
    - pmlnr 9y ago
      This is good for now, but snapshots are like RAID: they are not backups.
      - tensor 9y ago
        They are if you send them offsite. Backups with version history are great if you can swing them.
        floatboth 9y ago
        Startup idea: zfssend.net, a place to send snapshots to As A Service :D
        9y ago

nlte 9y ago

This isn't yet the cyberattack "the world isn't ready for" (https://www.nytimes.com/2017/06/22/technology/ransomware-attack-nsa-cyberweapons.html https://www.nytimes.com/2017/06/22/technology/ransomware-att...), is it?

devopsproject 9y ago
no. you will know when the big one hits because you won't be able to ask this question online and get an immediate answer.
deleted 9y ago
[deleted]
strictnein 9y ago
No. This attack is using the EternalBlue vector (MS17-010[0]) and CVE-2017-0199[1]. Updated systems are unaffected. [0] https://technet.microsoft.com/en-us/library/security/ms17-010.aspx?f=255&MSPPError=-2147217396 https://technet.microsoft.com/en-us/library/security/ms17-01... [1] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

bkor 9y ago

The Netherlands and various other countries have created laws where either their version of the NSA and/or police can hoard 0days to be used for hacking. This massive outbreak is so widespread that at this stage it appears that it either was a very recent 0day or something which only recently was fixed by a patch. Instead of having loads of countries hoarding security problems I highly encourage a focus on security instead. Seems much better for the economy overall.

rm_-rf_slash 9y ago
In theory, yes. In practice, the reality may be more complicated. How many ongoing investigations and clandestine operations rely on 0days that could be patched tomorrow? Even if this weren't the case somehow, I could imagine intelligence chiefs and the like defending their 0days as necessary on public safety or national security grounds. Edit: just to clarify, I believe 0days should be reported and patched to make everybody safer.
- tobltobs 9y ago
  Your strange theory, that the economical damage is unavoidable to improve security will break down hard if those 0days are used by terrorists for the first time.
  - rm_-rf_slash 9y ago
    I'm not condoning this action I'm just arguing that it's a likely path for politicians to take because of political and media pressures. Of course I think 0days should be reported and patched immediately.
  - criley2 9y ago
    "Your strange theory, that the economical damage is unavoidable to improve security will break down hard if those 0days are used by terrorists for the first time" It's not a "strange theory", it's the literal reason: NatSec is not a strange theory, it's the stated reason by multiple administrators and officials for why this behavior occurs. Plus, how much economic damage was mitigated by using zerodays against terrorists and foiling their plots? What if they used a zero day and prevented a 9/11 size 3000 person, multi-billion-dollar terrorist attack? To suggest that the needle is at 0 and any negative use makes the entire NatSec angle bad is very naive, because any successful NatSec use that has succeeded is classified and we're not privy. So we don't know the score, and we certainly can't claim that the score favors one side after any particular event... But, keep this in mind, Israeli hackers compromised an ISIS computer and were keeping tabs on plots including a plot to weaponize laptop batteries, up until DJT burned the source by outing the Israeli op to Russians. So the idea that zero days aren't in active use seeing results against terrorists is very naive, I believe.

jdc0589 9y ago

FYI, looks like this is still using EternalBlue.

mbaha 9y ago

A friend sent me the bitcoin address, they've already collected 2600$. [EDIT] Now 3230$ Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaA...

mrb 9y ago
What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.
- cynicalreason 9y ago
  it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected. company I work for disabled all working from home VPN accounts for the time being until we do a security audit
- SmallDeadGuy 9y ago
  There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.
  - mbaha 9y ago
    Exactly. This is a huge attack. The amounts paid don't mean a thing.
  - 49para 9y ago
    Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.
- 9y ago

mighty_warrior 9y ago

Your own fault if you didnt patch out eternalblue. No sympathy for hacked orgs.

strictnein 9y ago
Also uses a client side exploit in Word/Wordpad, although that was patched earlier this month: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
- cm2187 9y ago
  Moronic design of the microsoft page. It requires you to acknowledge some bullshit T&C on first visit, then redirects you to the website home page. Which means that someone clicking on the CVE to check if there is anything important will be redirected to a home page with no information. Most sane people will go back to the original link, but if there were only sane people in this world, this second wave of malware would be toothless. That's not exactly helping awareness of the vulnerability.

nuclx 9y ago

As someone affected by the ransomware - did anyone else notice empty console windows popping up from time to time the days before the ransomware triggered the encryption?

simopaa 9y ago
This is most likely due to the Office bug: https://www.digitaltrends.com/computing/here-is-a-fix-for-microsoft-office-command-prompt-issue/ https://www.digitaltrends.com/computing/here-is-a-fix-for-mi...
- Flammy 9y ago
  Agreed. Previously following the steps here removed the problem for me on 3 different Windows 10 computers. (PC gamers were particularly impacted by this, as the command prompt flickering would minimize full screen games...)
- devopsproject 9y ago
  this was really annoying
misterdata 9y ago
I did see those console windows here on Windows 10 but I am not (yet?) affected. So might also be related to something else (Windows Defender updates?).
paulpauper 9y ago
how do you think you got infected?

r721 9y ago

>We have confirmed U.S. cases of Petya ransomware outbreak https://twitter.com/Bing_Chris/status/879713682242117634 https://twitter.com/Bing_Chris/status/879713682242117634

voidmain0001 9y ago

Kaspersky wrote about Petya 16 months ago. https://blog.kaspersky.com/petya-ransomware/11715/ https://blog.kaspersky.com/petya-ransomware/11715/ Has the delivery changed causing it to resurface again?

wila 9y ago
Yes, it is a "petya variant" [0] [0] https://isc.sans.edu/diary/22560 https://isc.sans.edu/diary/22560

athenot 9y ago

Do these attacks affect anything else beyond Windows?

neoeldex 9y ago
Not that I'm aware of, just windows in this case.
swiley 9y ago
They can supposedly be manually run in wine on non-windows.

jannes 9y ago

This is even more proof how powerful a 0-day in the wrong hands can be. All of the affected companies' should be considered compromised by the NSA. Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised. Ransomware is much more visible than spyware. Think about all the spyware-infected PCs/networks that nobody knows about.

rsync 9y ago
"Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised." March 14 of what year ? I would say 2000 but I am open to discussion ...
- spacemanmatt 9y ago
  I sent my first packet-of-death to an unprotected Windows machine in 1996, so...
  - samstave 9y ago
    1997 here :-) hat was that XP xploit app from back then... I cant recall what it was called...
    - colecut 9y ago
      back orifice? subseven?
      - freeflight 9y ago
        Subseven was just a trojan, tho a really fancy one I had lots of fun with as a kid.
      - samstave 9y ago
        Back orifice!

vldx 9y ago

Interestingly, WPP mandates all it's employees to shut down their computers – irrespective of the OS. > As a precaution, WPP is mandating that everyone immediately shut down all computers, both Macs and PCs. This applies to you whether you are in the office or elsewhere. Working on an office computer remotely is not an option. Please leave your computers turned off until you hear from us again. > Many thanks for your co-operation and patience. > Best regards,

SpeakMouthWords 9y ago
How do they plan on contacting the employees en masse if the computer is off?
- hsod 9y ago
  Probably via their smart phones
  - rahkiin 9y ago
    So a smartphone is not a computer anymore? The world we live in..
    - ccozan 9y ago
      I think is a matter of semantics, not of functionality. A smartphone is a computer per design, but no one is calling it like that.
    - devopsproject 9y ago
      its a colloquialism computer = desktop\laptop
    - khedoros1 9y ago
      My calculator's a computer, but I don't call it that. My game systems are all computers, but I don't call them that either (and never have, unless I was discussing semantics).
    - 9y ago

jz10 9y ago

My friend's work laptop is a victim of this same attack... all the way here in the Philippines. There was a company wide email blast to disconnect all workstations from the internet at once. Fascinating development

kozhevnikov 9y ago
A literal case of 'in case of cyberattack break glass' https://i.imgur.com/fHhkdxX.jpg https://i.imgur.com/fHhkdxX.jpg
dirtylowprofile 9y ago
What company in the PH is this?

hackrack 9y ago

Idea: What if the purpose of these WannaCry style ransomware attacks isn't to get people to pay in Bitcoin, but to drive up the price of Bitcoin?

fpgaminer 9y ago
WannaCry caused the price to drop, rather sharply. If anything, the purpose would be to buy cheap Bitcoins and hope the price later corrects back upwards after the news has blown over. I suspect the price drop is due to some trading algorithms using sentiment analysis. They see all the negative press around these ransomware, see the included word Bitcoin, assume the negative article is about Bitcoin, and automatically sell. But that's just my theory, since I have a hard time imagining human traders seeing news like this and selling because of it.
- 52-6F-62 9y ago
  It would certainly have a cascading effect, however, because the news soon follows about Bitcoin/all crypto dropping and both bots and watchful traders take their profits out and either get scared out of the market, or hope to capitalize on the dip.
- smitherfield 9y ago
  >But that's just my theory, since I have a hard time imagining human traders seeing news like this and selling because of it. Sure they might; the more Bitcoin/cryptocurrency is associated with cybercrime, the more likely it is to be banned (sending the price to ~0 in the affected countries).
- dx034 9y ago
  I doubt wannacry was the reason for the price drop. Rather extensive media coverage about bitcoin hitting $3k which probably woke up some people who realised that it might be the time to cash in.
  - fpgaminer 9y ago
    This was long before $3k. The price tanked immediately on May 12th and remained depressed until the 17th which was shortly after the initial outbreak was halted by the domain registration.

110011 9y ago

Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Does it always require human intervention for A. ? Thank you.

dijit 9y ago
Depends on The ransomware. Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet
- jonknee 9y ago
  > Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet That's not at all what a 0-day means, it just means a previously unknown vulnerability. We've never seen a ransomware attack anywhere close to as sophisticated at Stuxnet. This latest attack is nothing new and is only affecting people who haven't kept their systems up to date.
  - dijit 9y ago
    I understand that this is not what it means. But generally speaking when an article says "0-day malware" it usually ends up meaning that no human involvement is needed. Please don't assume I don't know what 0-day actually means. I chose my words carefully as not not imply that I was saying the definition of the term.
- astrodust 9y ago
  "0-day" does not mean without human intervention. That just means "previously undisclosed".
  - dijit 9y ago
    I understand that. Which is why I said "usually". Typically when we see news using the term 0-day it's because there was no human element needed in the infection of machines. Thinking back in recent memory (17~ years) I can't remember a time when 0-day was used when it didn't mean autonomous infection. Although. I fully understand that the term means that it's a previously unknown issue. Which is why I chose my words as carefully as I did.

secfirstmd 9y ago

(Sorry for the repost but I feel the pain of sysadmins so it might be useful to some people as everything melts down around them this evening)... Hey, FWIW we had to do some response for ransomware cases recently. There was a lack of decent stuff out there for how IT teams should deal with it. So we contributed to putting together this quick checklist: https://github.com/0xswap/guides/blob/master/ransomware-triage.txt https://github.com/0xswap/guides/blob/master/ransomware-tria... Would be great if more people wanted to add to it.

voltagex_ 9y ago
A minor nit: if you convert this over to markdown or ReStructuredText, it'll display more nicely on the page and be easier to move over to GitHub pages or the like.
- secfirstmd 9y ago
  Good idea! Will do that.

gmisra 9y ago

Is anyone aware of an entity that attempts to objectively quantify the economic impact of an event like this (ransoms paid, data lost, labor hours lost, new security costs, etc)?

d33 9y ago
I wouldn't say new security is a cost - unless it's fake security, like antiviruses.

dz0ny 9y ago

Public analysis is tracked here https://otx.alienvault.com/pulse/59525e7a95270e240c055ead/ https://otx.alienvault.com/pulse/59525e7a95270e240c055ead/ Seems that payload servers are in Germany, France, and Malaysia. https://securelist.com/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks/77762/ https://securelist.com/petrwrap-the-new-petya-based-ransomwa...

butz 9y ago

One of my clients got some strange emails around 12:00 GMT with links to probably infected websites. Is this related to ransomware?

the_cat_kittles 9y ago

i said this before and it was met with mostly hostility, but im still wondering... bitcoin has enabled ransomware, so its a boon to crooks. what has it done for non-crooks? i dont mean conceptually (no fed! decentralized! etc. etc.), i mean since its come into being, what has it done for you personally? for me: i bought a vpn subscription, anonymously. probably not able to do that as easily without btc. but, i would personally trade that for not having ransomware attacks. thoughts?

scottLobster 9y ago
Depends on where you live. I doubt you'd have faced any repercussions for buying that VPN subscription with your credit card, but the governments of other countries might not be so understanding. Bitcoin should exist for the same reasons Tor exists. Just because Tor is used by child predators and of little practical use to the average Western citizen doesn't negate its positive value.
- the_cat_kittles 9y ago
  "Just because Tor is used by child predators and of little practical use to the average Western citizen doesn't negate its positive value." you cant just say that and expect me to decide its worth it on balance, you need to make a case for it. maybe this isnt the place, but its a funny thing to just kind of assert. arguing that things should exist because there are potential upsides is missing the point, which is that the downsides may outweigh the upsides. its particularly bold to make that claim about tor- there must be a hell of an upside to justify the child predators...
  - KGIII 9y ago
    It enables secure, private, exchange of data. That is reason enough.
  - E6300 9y ago
    > its particularly bold to make that claim about tor- there must be a hell of an upside to justify the child predators Even if Tor didn't exist, there would be child pornography. Would there more, less, or just as much of it? That's difficult to say. It's also difficult to say how much easier it makes the lives of those fighting for freedom of speech. Thus, saying whether Tor is, overall, a "good" or "bad" technology would involve comparing two unknown quantities.

tudorconstantin 9y ago

Maybe this is the year of Linux on desktop.

mikegerwitz 9y ago
(You may or may not be joking; let's assume you're not for this response.) This is a dangerous argument. I'm a free software activist, and I firmly believe that security without free software is a facade, but that doesn't mean that free software is more always more secure; it's an open source argument that's been fairly easily refuted lately with high-profile bugs in software like OpenSSL. It's easier to hide secrets in proprietary software, but most security vulnerabilities are bugs, not explicit backdoors. So even bit-for-bit reproducibility won't defend you against that. I'm not saying you shouldn't use GNU/Linux---I think that every user deserves an operating system that is fully free, and hope that people will use it (or another free/libre OS). But my argument is on the basis of freedom, which still stands _regardless_ of security. It just so happens that I believe that strong confidence in the security of a system is not possible with proprietary software.
- tudorconstantin 9y ago
  So far this year, Windows leads the scorecard regarding mass infections and business downtime due to them. So while indeed, open source is not a guarantee for better security, the results are in its favor. It might also be because it's not such an attractive target to hackers due to its low share in the desktop market. But still there millions of linux servers online 24h/24h and I assume they have a bigger potential for monetisation.
  - deleted 9y ago
    [deleted]
  - theossuary 9y ago
    Windows also leads the score card in installation base, which I think is the real causal relationship. If Linux was installed on 90% of desktops you better well believe there'd be a similar number of exploits for it. Something similar happened to Mac OSX not too long ago, as they grew in popularity more and more exploits were found for the operating system.

sniper007 9y ago

Test

strictnein 9y ago

On a related note, I don't understand the reason behind transactions like this: https://blockchain.info/tx/9778c698f3f2a2c9b9e9f0fdea3c96e8fe200b19cd4db382642178dd08405f4d https://blockchain.info/tx/9778c698f3f2a2c9b9e9f0fdea3c96e8f... Is there something special about using numerous senders like that?

lordnacho 9y ago
That just means someone's got a wallet containing the private keys corresponding to a lot of addresses. So when they want to move some coins, they just sign all the various transactions and send the money to new addresses.
3kajjak3 9y ago
Some sort of attempt at laundering, perhaps?
deleted 9y ago
[deleted]

maddyboo 9y ago

Does anyone know if any tools exist on Linux which can be used for early detection of ransomeware? Something that monitors file access, disk activity, etc. for suspicious behavior and can trigger some action or alert? I think I remember some discussion about using a 'canary file' - some innocent looking file with known contents which should never be modified. If a modification is detected, you know something fishy is going on.

tyingq 9y ago
Aide is a popular utility to monitor for changes to files on Linux systems. http://aide.sourceforge.net http://aide.sourceforge.net You could also use the built in audit subsystem if you wanted to watch a specific canary file, directory, filesysyem, etc. https://www.linux.com/learn/customized-file-monitoring-auditd https://www.linux.com/learn/customized-file-monitoring-audit...
- agumonkey 9y ago
  I thought tripwire was the standard.. happy to know another name.
  - tyingq 9y ago
    Tripwire got very stale after they split off a non open source commercial version. Aide filled that gap. I believe most people prefer it to the open source tripwire.
- dotancohen 9y ago
  I'd like to emphasize the canary file. This is a file that you should never access in normal operations. Thus, if the file was in fact accessed, that is a sign that something is scanning your file system. Depending on the threat, such a scan might be a good reason to pull the cord from the mains socket. You don't want to let a normal shutdown occur, rather pull the cord and mount the disk on another system to recover / analyze.
- singularity2001 9y ago

willstrafach 9y ago

FYI to Sysadmins: Paying the ransom at this point will be a waste of money, as the contact e-mail address has been blocked. https://posteo.de/blog/info-zur-ransomware-petrwrappetya-betroffenes-postfach-bereits-seit-mittag-gesperrt https://posteo.de/blog/info-zur-ransomware-petrwrappetya-bet... (German) https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomware-email-account-in-question-already-blocked-since-midday https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomwa... (English)

sillysaurus3 9y ago
It's always seemed like the best way to end ransomware is to launch hundreds of variants that demand money but don't actually decrypt anything. Unethical, to be sure, but eventually people would learn not to give them money. All the competent ransomware authors are probably quite unhappy whenever a defective ransomware strain pops up.
- comboy 9y ago
  If it gets big enough then people just hear from each other if paying unlocks the data or not. The best way to end ransomware is to get serious about security. In many cases, being attacked by a ransomware, is paying a low price compared to if it was a targeted attack. edit: Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment.
  - notgood 9y ago
    >If it gets big enough then people just hear from each other if paying unlocks the data or not. The idea would be to create "fake" ransomware that looks exactly like the real one >The best way to end ransomware is to get serious about security No matter how serious you get there always gonna be bugs, there isn't a single piece of mass distributed software in human history without bugs. That said, we should try to improve security of software but expecting it to be THE solution is wrong. >Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment. Forging a signature is not that hard.

dagaci 9y ago

I'm afraid that this attack demonstrates that the old PC architecture: Side-loading any app, userspace, privilege escalation, low level file sharing functionality just isn't for purpose. If malware can exploit a 0-day, 100-day, 1000-day security hole in a corporate network of 2000 machines, its too easy for that malware to share itself across the network and send emails attachments to AllUsers (every single company I've worked for still allow Everyone to send anything to Everyone). Microsoft's next XP patch should be to remove SMB functionality or just outright disable it (and probably remove IE and other nonsense installed by default too). And when Windows 7 expires the final patch should be a severe lock down too..

cm2187 9y ago
It's clear that nothing bad can happen on a machine where you can't do anything.
KGIII 9y ago
If the final patch does that, nobody will apply it. Security is a process, not an application.

kator 9y ago

Looks like people are paying the ransom: https://blockchain.info/charts/balance?address=1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX https://blockchain.info/charts/balance?address=1Mz7153HMuxXT...

dx034 9y ago
Not a lot though. Given the huge number of infections, $9000 seems a pretty bad return.

Animats 9y ago

Maersk is down. Their main site says: Maersk IT systems are down We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack. We continue to assess the situation. The safety of our employees, our operations and customer's business is our top priority. We will update when we have more information.[1] Maersk is the largest shipping company in the world. 600 ships, with ship space for 3.8 million TEU of containers. (The usual 40-foot container counts as two TEUs.) If this outage lasts more than a few hours, port operations worldwide will be disrupted. [1] http://www.maersk.com/en http://www.maersk.com/en

nothrabannosir 9y ago
Great. Maybe we can finally put a price on lack of security protocol.
- olewhalehunter 9y ago
  OSHA violation in 2025: operator was not using a deterministic operating system
  - lilott8 9y ago
    what you are suggesting has grave realities for those who cannot or do not want to mess with formal verification techniques. This is the future of computing and a lot of people will be left behind once this catches on.
    - ktta 9y ago
      >lot of people will be left behind once this catches on if this catches on.
- merrickread 9y ago
  I dream of seeing a "security first" development process adopted ..

r721 9y ago

>Cyberattack hits entire Heritage Valley Health System, shuts down computers >A cyberattack is affecting the Beaver and Sewickley hospitals and all other care facilities in the Heritage Valley Health System on Tuesday. http://amp.wtae.com/article/cybersecurity-incident-heritage-valley-health-system/10228015 http://amp.wtae.com/article/cybersecurity-incident-heritage-...

agumonkey 9y ago

Did these ships are also oil tanker ?

xapata 9y ago
Oh, did you see that one in "Hackers" -- the DaVinci virus?
kahnpro 9y ago
The little boat tipped over
- subcosmos 9y ago
  LOL! https://www.youtube.com/watch?v=2PxcDyfKV90 https://www.youtube.com/watch?v=2PxcDyfKV90
sctb 9y ago
We detached this subthread from https://news.ycombinator.com/item?id=14647605 https://news.ycombinator.com/item?id=14647605 and marked it off-topic.

emersonrsantos 9y ago

Does anyone know if this decrypt app still work? https://github.com/leo-stone/hack-petya https://github.com/leo-stone/hack-petya

agumonkey 9y ago

How can one check quickly if his OS is vulnerable ? I know MS pushed updates, but sometimes updates are stuck, or fail to install or are delayed by the user .. so

80211 9y ago
Just do a Windows Update -> Update History and see if you have a cumulative update after 5/24. https://imgoat.com/uploads/2e74f10e03/26813.png https://imgoat.com/uploads/2e74f10e03/26813.png

HIBC2017 9y ago

If you're infected, don't pay the ransom. The email address that's used has been blocked by the email provider. https://twitter.com/HIBC2017/status/879747282173911040 https://twitter.com/HIBC2017/status/879747282173911040

elcapitan 9y ago

Kill switch has been found: https://twitter.com/PTsecurity_UK/status/879779707075665922 https://twitter.com/PTsecurity_UK/status/879779707075665922

veb 9y ago
The killswitch: https://twitter.com/0xAmit/status/879789734469488642 https://twitter.com/0xAmit/status/879789734469488642
- SnowingXIV 9y ago
  This confirmed to work? Anyone else speak on this? If so props to the guy who discovered this.
  - lowpro 9y ago
    It is, although it isn't really a 'kill switch' in the sense it can't be deployed universally, but per system it works. This could be considered temporary though, as is turning off your computer if infected and NOT turning it back on. The encryption only takes effect after a restart.
deleted 9y ago
[deleted]
benzinschleuder 9y ago
Is a kill switch purpose to protect against a new infection? It doesn't help decrypting the files i guess? What is it used for?
chipperyman573 9y ago
Why would a ransomware author include a killswitch in their software?
- gilgoomesh 9y ago
  Even ransomeware authors accidentally infect themselves and lose keys.

kronos29296 9y ago

I remember reading something about a guy warning about intrusions on his company during Wannacry to steal company data and install malware. Now we have this. This is giving me goosebumps.

jl6 9y ago

Could someone write a whitehat worm or virus to get into all those vulnerable Windows systems and close the door behind them by patching the hole?

ChicagoBoy11 9y ago
Software virus vaccines - I like it. Can’t believe I’ve never run across the concept before. Must be a thing, no?
- msielski 9y ago
  https://en.m.wikipedia.org/wiki/Anti-worm https://en.m.wikipedia.org/wiki/Anti-worm

faragon 9y ago

Why Ransomware authors are not yet in jail? /cc FBI CIA BND MI5 FSB

coolspot 9y ago
FSB lol Even if FSB found hackers, they would take a share of profit and close the case.

kuon 9y ago

Those attacks are still "gentle" as if you have (and you should) a read only backup you can resolve it with near 0 dataloss. What I fear are cancer like virus, not wiping or encrypting data at time T, but introducing subtle errors on a longer period. You would be contacted by hackers saying your last 6 months of data contain error. That's scary.

tonyplee 9y ago

Wonder if they manage to disable the UK's Trident Nuclear Submarine this time. "Windows for Warship" https://en.wikipedia.org/wiki/Submarine_Command_System https://en.wikipedia.org/wiki/Submarine_Command_System "Want to Nuke someone, please send Bitcoin to unlock the systems." https://www.theregister.co.uk/2017/06/27/hms_queen_elizabeth_running_windows_xp/ https://www.theregister.co.uk/2017/06/27/hms_queen_elizabeth...

flukus 9y ago
The news here was reporting earlier that the Chernobyl monitoring computers were compromised. Edit: No link, but it was on ABC (Australia) live news, which is pretty reliable. Here is a less reliable source: https://www.independent.co.uk/life-style/gadgets-and-tech/news/hack-cyber-attack-ukraine-russia-wannacry-petya-security-internet-broken-computer-not-working-a7810626.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne...
- deleted 9y ago
  [deleted]
- xyrnoble 9y ago
  Is there a public link for that?

runeks 9y ago

> Ukraine's government, National Bank [..] Now there's a new attack target: the central bank. Send 100 BTC to this address and I will decrypt the balances stored by your central bank, so you, again, know how much money you own.

memracom 9y ago

Note that having a good multi-generational backup system in place for all machines, servers and laptops, would render this kind of ransomware harmless. But the state of IT has deteriorated so badly these days because management doesn't care any more. After all why care when you can just take your severance pay and get an increase in salary and more responsibility at another company. Rinse and repeat. It used to be that the primary job of system admins was to keep the data safe from loss. That was more important than keeping the systems running. How did we lose this?

andruby 9y ago

I always replay the end-game of Uplink [0] in my head when I read news like this. Great game with great music. [0] https://www.introversion.co.uk/uplink/ https://www.introversion.co.uk/uplink/

zvrba 9y ago

So.. ransomware authors want payments in Bitcoins. The obvious counter-attack from the governments would be to target and shut-down all services exchanging bitcoins (or other digital money) to real money. Heck, they can hack them and delete all data, so they shut down on their own.