4 ms·
Essence of Maersk attack in one tweet https://twitter.com/craiu/status/879690795946827776 https://twitter.com/craiu/status/879690795946827776 New Petrwrap/Pety
by smartbit 9y ago
Essence of Maersk attack in one tweet https://twitter.com/craiu/status/879690795946827776 https://twitter.com/craiu/status/879690795946827776
New Petrwrap/Petya ransomware has a fake Microsoft digital signature appended. Copied from Sysinternals Utils.
I was sitting next to someone who wanted didn't close his laptop immediately when notified, 1 minute later it was too late.
Most of my colleagues went home, even if their laptop was not infected (also over de VPN) they are no allowed to start the machine. Some departments ask people to stay home tomorrow too. Those with MacBooks continue working. And externals.
In Rotterdam APM Terminals has shutdown.
- exhilaration 9y agoHow is it spreading from machine to machine?
- the-dude 9y agoOver the internet.
- jnosCo 9y agoHeard it's using the same SMB expolit as wCry (ETERNALBLUE)
- exhilaration 9y agoExcellent, thank you. I disabled SMBv1 on my Windows VM after the WannaCry outbreak so I should be safe.
- dsacco 9y agoHilariously, Twitter requires me to click through an acknowledgement to view that image, because it "may be sensitive material."
- samstave 9y agoJust curious, could the fake sig have been begotten/created from the supposed "32 TB of source/internal MS code that was 'leaked'" recently?
- willstrafach 9y agoI don't believe there were any private keys in that leak, so that is unlikely.
- nucleardog 9y agoThe comment you replied to answered your question completely: No. The signature doesn't validate, and was simply copied from a published Microsoft application (something from sysinternals). You can do this at home right now by visiting Microsoft.com, downloading any signed application, and copying the signature verbatim onto your application.