7 ms·

Petya: “I Want to Believe”

168 points by r721 9y ago

e9 9y ago
"It has a vendetta against Kaspersky Lab. If this malware finds running Kaspersky processes on the system, it writes junk to the first 10 sectors of the disk, and then reboots, bricking the machine completely." lol
- 2sk21 9y ago
  This is the part I don't understand at all - why Kaspersky?
  - beefhash 9y ago
    Should this really be a nation-state actor's malware, it may be a dig at Russia because Kaspersky is a Russian company.
    - nulldev 9y ago
      That is almost certainly an incorrect analysis
    - thg 9y ago
      Or it could be the US that wants you to believe it's Russia. Or any other nation, organization or group that wants to frame Russia. Without any evidence, it's nothing but pure speculation and rumor-mongering.
  - Qerub 9y ago
    If we assume Kaspersky is highly popular in Russia it might have been a way to avoid spreading the malware inside Russia (while keeping the behaviour non-obvious). jaclaz notes in another comment that it is easy to recover from this "vendetta".
    - csydas 9y ago
      While it may be a reasonable conclusion, such assumptions aren't supported by some rudimentary survey evidence, as per AV-Comparatives.org [1] The Kaspersky condition in Petya is indeed unusual, but I would agree with the initial blog post that right now there isn't enough information to make even an educated guess. Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses. While I appreciate and even sometimes enjoy speculation such as this for fun, I agree with the F-Secure blog post that it is not useful in the current situation as there just isn't enough evidence to develop anything more than wild guesses. [1] https://www.av-comparatives.org/wp-content/uploads/2017/01/security_survey2017_en.pdf https://www.av-comparatives.org/wp-content/uploads/2017/01/s...
      - zzzcpan 9y ago
        "Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses." But it is also banned in Ukraine, where most targets were.
        BoiledCabbage 9y ago
        And I'd assume the reason it's is banned in Ukraine is likely due to the persistant rumors that Kaspersky is tied to the Russian FSB. Anti-virus would be a brilliant way to gain access to millions of machines, send back "sample" files via specific user targeted updates... If so (and again I'm starting this sentence with IF), being lenient on Kaspersky would have dual benefits of focusing the target Ukraine, provide a "cure" for any critical machines hit in Russia, and allow existing Kaspersky users to recover once the cure is known. The Interesting thing here is if this was a trial run, I don't think you get another one. If there is another bit of malware that treads lightly on Kaspersky machines, or "accidentally" fails to activate on them then the gig is up. Still speculation, but will be interesting to follow.
        qb45 9y ago
        Problem: user files are still being encrypted regardless of what happens to MBR so you end up doing MBR recovery only to boot a system without your data.
- jaclaz 9y ago
  To me it doesn't sound much as a vendetta. Basically - if I get right the note - if you have some Kaspersky Lab software running the malware ONLY writes junk to the first 10 sectors and reboots, which basically means: 1) on MBR rebuild the MBR partitiontable entries from the existing (untouched) partition/volumes on disk 2) on GPT restore the partition table from the backup Both are perfectly doable to restore the system in a full working condition. It sounds more like a sort of (indirect) "vaccine", instead of getting a deadly influence, you get just a cold, a couple of aspirins and all is well (and the malware cannot spread from that machine to other machines on the network, since it rebooted to the junk and the OS is not running anymore).
  - masswerk 9y ago
    As I read it, first there's user-mode encryption in every case. Then, admin-mode is attempted, and, when successful, either the first 10 sectors including the MBR are overwritten by garbage, in case Kapersky software was found, or there's a botched attempt to encrypt the first 25 disk sectors. Mind that user-mode and admin-mode tasks are apparently in separate modules and that the user-mode module is run first, while detecting the Kapersky lab process and overwriting the disk sectors requires admin mode. To me, the "Kapersky branch" appears to be more destructive than the default branch. Edit: Also, there have been reports of the malware scanning and transmitting any credentials stored on the machine, while in "encrypted mode." (Suggesting, there's still a functional basic system left in order to accomplish these tasks.) Couldn't it be for Kapersky AV still being able to detect this activity and hence rather bricking the machine than giving away some of the features early?
    - qb45 9y ago
      Certainly more destructive for the 99.9% of owners who don't know what MBR or GPT is.
      - dsfyu404ed 9y ago
        x2. Someone on the team probably had beef with Kaspersky and decided to hose the partition table of anyone using it. Hosing the partition table is a pretty poor way of minimizing damage because as you point out, 99.9% of people affected will be more affected if the partition table is hosed.
- SamUK96 9y ago
  I'm pretty much a total novice with low-level aspects of storage, but if this is essentially writing junk to the windows bootloader or something to preveny booting to OS, couldn't one just plug the HDD as a non-ROOT drive to another PC and recover some of the important files? I've seen people successfullu do this before after their super old ROOT disk gets corrupted exactly where the windows bootloader is...
  - barrkel 9y ago
    No, that wouldn't work; you'd have to scan the disk for partition information to reconstruct it, or otherwise guess reasonable values (backup being best).
    - ptero 9y ago
      Which does not seem like a particularly difficult task for me. Not quite trivial, not particularly quick, not guaranteed to work 100%, but for main partition types the task should be suitable as an undergraduate CS assignment. However, as you say, having data backed up is a better solution.
  - jaclaz 9y ago
    Two cases: 1) MBR "style" partitioning: in first sector of the disk there are at most 4 addresses pointing to the partitions on the disk (which may consist of primary partitions and as such volumes, or one of them may point to an extended partition that has a chain of EMBR's pointing to logical voluems inside it) It is trivial nowadays, using freely available software, to search the disk for the volumes and rebuild the partition tabel in the MBR. 2) GPT disk: The first sector is only a "protective MBR" where in the partition table there is only one entry spanning from sector 2 up to the end of the disk (this can of course be rebuilt in no time). The issue is that the GPT partition table (i.e. addresses of the volumes) is in the following sectors (and the overwriting of 24 or 9 sectors will destroy the data for good, as normally only two sectors are used) and due to the peculiariries of the way these GPT entries are stored it is slightly more difficult to rebuild the data (though the actual volumes on disk can anyway be found and retrieved/imaged). But - IMHO more or less the only good thing about GPT - the MBR and all GPT tables are automatically backed up to the end of the disk, so there is usually no need to rebuild anything, it is just a matter to properly restore the entries from the backup.
- kbenson 9y ago
  Since when does writing over the MBR brick the machine? Has the term "bricking" lost its original meaning? If the device isn't only useful as a brick afterwards, it's not bricking. Requiring reformatting or replacing a hard drive is hardly enough to do that in most circumstances.
nenreme 9y ago
> there’s evidence that development on the network propagation component was completed in February. Yet no evidence is provided. Why would they want to hide it?
- r721 9y ago
  They just added another update: "Some of the payloads utilized by the network propagation component have compilation timestamps from February 2017. The compilation dates on these payloads don’t have any bearing on when the Eternal* exploits were implemented in the network propagation code." https://twitter.com/FSLabs/status/880688502769414144 https://twitter.com/FSLabs/status/880688502769414144
shroom 9y ago
I am an average web developer and I have sound computer and programing skills. I'm interested in computer security and always fascinated by these articles. When I read stuff like "Petya (binary edited)" I feel like a complete noob. Anyone care to elaborate how editing binaries would be done? Sounds like a daunting task. Even on a normal program. Much more so on malware that is obfuscated to begin with. Just curious :-)
- adrianN 9y ago
  Well, you look up the format of executable files under your operating system and find the parts of the program that you want to edit, like the code segments. Then you write the code you'd like to run, let your compiler translate it into the appropriate binary format (or you do this step by hand) and write it at the right spot. You have to be careful if addresses change (because you changed the size of the code for example), then you have to to the linker's job again.
- pjmlp 9y ago
  The first step is to get hold of a hexdump editor. https://en.wikipedia.org/wiki/Hex_dump https://en.wikipedia.org/wiki/Hex_dump Then you need to have an idea of the executable file format so that you can extract information from the respective file sections. Of course, there are tools that will extract those sections. So manual work only occurs if the tools fail to do their work. In the case of executables, reverse engineering tools like IDA give an helping hand. https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ Then it goes from there, with lots of Assembly love and knowledge of OS internals.
  - bitexploder 9y ago
    Okteta for Linux, Hex Fiend for Mac , 010 for Windows. Radare is a free disassembler. Hopper is good a good disassembler for Mac. IDA is great, but very expensive. Manual work happens almost always with weird malware and or packers. They almost always do something that makes trivial reversing harder.
- indigochill 9y ago
INTPenis 9y ago
About robust components being developed in February; couldn't that just mean that it's a sort of pre-made malware or "malware framework" being used to deploy these two exploits? I'm thinking that the malware world develops code on the same level as the rest of the coding world. So developing a robust MBR and network component that can use drop-in exploits would make sense.
- taneq 9y ago
  That's basically my reading: Some script kiddy got hold of spook-grade malware and tried to mod it.
  - gozur88 9y ago
    This. I don't get the impression people who set up ransomware typically write all or even very much of the virus. They cobble together bits and pieces from the web, writing only the portion they couldn't find. Seems like the tough part would be setting up the whole chain such that you actually wind up with money in your own bank account without also setting up a big neon Arrest Me financial trail.
robryk 9y ago
> There’s only two choices to communicate with your customers/victims: use email or create a service portal. What about "have them publish a specially crafted transaction in Bitcoin blockchain using provided software"?
amq 9y ago
Honestly, quite a poor write-up. Bold claims in the beginning, but then too many meaningless words and too little technical details.
- smoyer 9y ago
  Yes ... there's no content here so don't waste your time reading it.
mariusmg 9y ago
" For instance, a machine infected with this malware can re-infect itself via one of its own propagation mechanisms" Not even malware gets proper QA these days....
etiam 9y ago
The followup has arrived: https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-a-developers-perspective/ https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-...
- smoyer 9y ago
  Same lack of facts as the first article but with new and improved speculation.
  - waihtis 9y ago
    Speculation is all there is to this incident. Would you rather have them pose speculation as facts like many other vendors are doing?
  - draw_down 9y ago
    Yeah, well. If all you're willing to accept is facts then this is the wrong area of inquiry for you. As if the NSA periodically releases a fact sheet of what they've been up to lately.
- etiam 9y ago
  ...and some thoughts on the matter by another lab member: https://labsblog.f-secure.com/2017/06/30/what-good-is-a-not-for-profit-eternal-petya/ https://labsblog.f-secure.com/2017/06/30/what-good-is-a-not-...
bsaul 9y ago
This post really reads like high school students trying to write something that looks professional... I hope this field doesn't get too poluted by people looking for a thrill. The stakes start to be too high for that.
- albedoa 9y ago
  I can't believe this was published. It reads like someone attempting to mock a high school student who tries to write something professional.
matthewaveryusa 9y ago
I find all of this absolutely hilarious. "this is not nation state because it is written in a shoddy way" is akin to "he does not look like a spy because he's too stupid." Get out. Attribution is almost impossible so don't even try. "It's sometimes the height of wisdom to feign stupidity.” -Cato 149 B.C. (that's right, people knew about this simple trick before Jesus was born, you bet humanity has refined on it since)
- count 9y ago
  Attribution is not 'almost impossible', it just takes human intelligence sources, and not technology, to get an accurate attribution. And due to the nature of those sources, those who get the actual attribution won't disclose it.
  - heartbreak 9y ago
    Exactly. This is like the people who said it was impossible to attribute the DNC email hack. Then they attributed it via classic human intelligence sources. We forget there's more to attribution than what can be determined from the bits.
EGreg 9y ago
Followup: https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-a-developers-perspective/ https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-...
- jaclaz 9y ago
  Interesting, thanks, but still more questions than answers and a somewhat condescending or at the opposite (as some other HN readers noted previously) somewhat "high school" trying to put together something that the teacher would approve, "Here we establish ..." ?.

168 points by r721 9y ago

e9 9y ago

"It has a vendetta against Kaspersky Lab. If this malware finds running Kaspersky processes on the system, it writes junk to the first 10 sectors of the disk, and then reboots, bricking the machine completely." lol

2sk21 9y ago
This is the part I don't understand at all - why Kaspersky?
- beefhash 9y ago
  Should this really be a nation-state actor's malware, it may be a dig at Russia because Kaspersky is a Russian company.
  - nulldev 9y ago
    That is almost certainly an incorrect analysis
  - thg 9y ago
    Or it could be the US that wants you to believe it's Russia. Or any other nation, organization or group that wants to frame Russia. Without any evidence, it's nothing but pure speculation and rumor-mongering.
- Qerub 9y ago
  If we assume Kaspersky is highly popular in Russia it might have been a way to avoid spreading the malware inside Russia (while keeping the behaviour non-obvious). jaclaz notes in another comment that it is easy to recover from this "vendetta".
  - csydas 9y ago
    While it may be a reasonable conclusion, such assumptions aren't supported by some rudimentary survey evidence, as per AV-Comparatives.org [1] The Kaspersky condition in Petya is indeed unusual, but I would agree with the initial blog post that right now there isn't enough information to make even an educated guess. Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses. While I appreciate and even sometimes enjoy speculation such as this for fun, I agree with the F-Secure blog post that it is not useful in the current situation as there just isn't enough evidence to develop anything more than wild guesses. [1] https://www.av-comparatives.org/wp-content/uploads/2017/01/security_survey2017_en.pdf https://www.av-comparatives.org/wp-content/uploads/2017/01/s...
    - zzzcpan 9y ago
      "Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses." But it is also banned in Ukraine, where most targets were.
      - BoiledCabbage 9y ago
        And I'd assume the reason it's is banned in Ukraine is likely due to the persistant rumors that Kaspersky is tied to the Russian FSB. Anti-virus would be a brilliant way to gain access to millions of machines, send back "sample" files via specific user targeted updates... If so (and again I'm starting this sentence with IF), being lenient on Kaspersky would have dual benefits of focusing the target Ukraine, provide a "cure" for any critical machines hit in Russia, and allow existing Kaspersky users to recover once the cure is known. The Interesting thing here is if this was a trial run, I don't think you get another one. If there is another bit of malware that treads lightly on Kaspersky machines, or "accidentally" fails to activate on them then the gig is up. Still speculation, but will be interesting to follow.
        qb45 9y ago
        Problem: user files are still being encrypted regardless of what happens to MBR so you end up doing MBR recovery only to boot a system without your data.
jaclaz 9y ago
To me it doesn't sound much as a vendetta. Basically - if I get right the note - if you have some Kaspersky Lab software running the malware ONLY writes junk to the first 10 sectors and reboots, which basically means: 1) on MBR rebuild the MBR partitiontable entries from the existing (untouched) partition/volumes on disk 2) on GPT restore the partition table from the backup Both are perfectly doable to restore the system in a full working condition. It sounds more like a sort of (indirect) "vaccine", instead of getting a deadly influence, you get just a cold, a couple of aspirins and all is well (and the malware cannot spread from that machine to other machines on the network, since it rebooted to the junk and the OS is not running anymore).
- masswerk 9y ago
  As I read it, first there's user-mode encryption in every case. Then, admin-mode is attempted, and, when successful, either the first 10 sectors including the MBR are overwritten by garbage, in case Kapersky software was found, or there's a botched attempt to encrypt the first 25 disk sectors. Mind that user-mode and admin-mode tasks are apparently in separate modules and that the user-mode module is run first, while detecting the Kapersky lab process and overwriting the disk sectors requires admin mode. To me, the "Kapersky branch" appears to be more destructive than the default branch. Edit: Also, there have been reports of the malware scanning and transmitting any credentials stored on the machine, while in "encrypted mode." (Suggesting, there's still a functional basic system left in order to accomplish these tasks.) Couldn't it be for Kapersky AV still being able to detect this activity and hence rather bricking the machine than giving away some of the features early?
  - qb45 9y ago
    Certainly more destructive for the 99.9% of owners who don't know what MBR or GPT is.
    - dsfyu404ed 9y ago
      x2. Someone on the team probably had beef with Kaspersky and decided to hose the partition table of anyone using it. Hosing the partition table is a pretty poor way of minimizing damage because as you point out, 99.9% of people affected will be more affected if the partition table is hosed.
SamUK96 9y ago
I'm pretty much a total novice with low-level aspects of storage, but if this is essentially writing junk to the windows bootloader or something to preveny booting to OS, couldn't one just plug the HDD as a non-ROOT drive to another PC and recover some of the important files? I've seen people successfullu do this before after their super old ROOT disk gets corrupted exactly where the windows bootloader is...
- barrkel 9y ago
  No, that wouldn't work; you'd have to scan the disk for partition information to reconstruct it, or otherwise guess reasonable values (backup being best).
  - ptero 9y ago
    Which does not seem like a particularly difficult task for me. Not quite trivial, not particularly quick, not guaranteed to work 100%, but for main partition types the task should be suitable as an undergraduate CS assignment. However, as you say, having data backed up is a better solution.
- jaclaz 9y ago
  Two cases: 1) MBR "style" partitioning: in first sector of the disk there are at most 4 addresses pointing to the partitions on the disk (which may consist of primary partitions and as such volumes, or one of them may point to an extended partition that has a chain of EMBR's pointing to logical voluems inside it) It is trivial nowadays, using freely available software, to search the disk for the volumes and rebuild the partition tabel in the MBR. 2) GPT disk: The first sector is only a "protective MBR" where in the partition table there is only one entry spanning from sector 2 up to the end of the disk (this can of course be rebuilt in no time). The issue is that the GPT partition table (i.e. addresses of the volumes) is in the following sectors (and the overwriting of 24 or 9 sectors will destroy the data for good, as normally only two sectors are used) and due to the peculiariries of the way these GPT entries are stored it is slightly more difficult to rebuild the data (though the actual volumes on disk can anyway be found and retrieved/imaged). But - IMHO more or less the only good thing about GPT - the MBR and all GPT tables are automatically backed up to the end of the disk, so there is usually no need to rebuild anything, it is just a matter to properly restore the entries from the backup.
kbenson 9y ago
Since when does writing over the MBR brick the machine? Has the term "bricking" lost its original meaning? If the device isn't only useful as a brick afterwards, it's not bricking. Requiring reformatting or replacing a hard drive is hardly enough to do that in most circumstances.

nenreme 9y ago

> there’s evidence that development on the network propagation component was completed in February. Yet no evidence is provided. Why would they want to hide it?

r721 9y ago
They just added another update: "Some of the payloads utilized by the network propagation component have compilation timestamps from February 2017. The compilation dates on these payloads don’t have any bearing on when the Eternal* exploits were implemented in the network propagation code." https://twitter.com/FSLabs/status/880688502769414144 https://twitter.com/FSLabs/status/880688502769414144

shroom 9y ago

I am an average web developer and I have sound computer and programing skills. I'm interested in computer security and always fascinated by these articles. When I read stuff like "Petya (binary edited)" I feel like a complete noob. Anyone care to elaborate how editing binaries would be done? Sounds like a daunting task. Even on a normal program. Much more so on malware that is obfuscated to begin with. Just curious :-)

adrianN 9y ago
Well, you look up the format of executable files under your operating system and find the parts of the program that you want to edit, like the code segments. Then you write the code you'd like to run, let your compiler translate it into the appropriate binary format (or you do this step by hand) and write it at the right spot. You have to be careful if addresses change (because you changed the size of the code for example), then you have to to the linker's job again.
pjmlp 9y ago
The first step is to get hold of a hexdump editor. https://en.wikipedia.org/wiki/Hex_dump https://en.wikipedia.org/wiki/Hex_dump Then you need to have an idea of the executable file format so that you can extract information from the respective file sections. Of course, there are tools that will extract those sections. So manual work only occurs if the tools fail to do their work. In the case of executables, reverse engineering tools like IDA give an helping hand. https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ Then it goes from there, with lots of Assembly love and knowledge of OS internals.
- bitexploder 9y ago
  Okteta for Linux, Hex Fiend for Mac , 010 for Windows. Radare is a free disassembler. Hopper is good a good disassembler for Mac. IDA is great, but very expensive. Manual work happens almost always with weird malware and or packers. They almost always do something that makes trivial reversing harder.
indigochill 9y ago

INTPenis 9y ago

About robust components being developed in February; couldn't that just mean that it's a sort of pre-made malware or "malware framework" being used to deploy these two exploits? I'm thinking that the malware world develops code on the same level as the rest of the coding world. So developing a robust MBR and network component that can use drop-in exploits would make sense.

taneq 9y ago
That's basically my reading: Some script kiddy got hold of spook-grade malware and tried to mod it.
- gozur88 9y ago
  This. I don't get the impression people who set up ransomware typically write all or even very much of the virus. They cobble together bits and pieces from the web, writing only the portion they couldn't find. Seems like the tough part would be setting up the whole chain such that you actually wind up with money in your own bank account without also setting up a big neon Arrest Me financial trail.

robryk 9y ago

> There’s only two choices to communicate with your customers/victims: use email or create a service portal. What about "have them publish a specially crafted transaction in Bitcoin blockchain using provided software"?

amq 9y ago

Honestly, quite a poor write-up. Bold claims in the beginning, but then too many meaningless words and too little technical details.

smoyer 9y ago
Yes ... there's no content here so don't waste your time reading it.

mariusmg 9y ago

" For instance, a machine infected with this malware can re-infect itself via one of its own propagation mechanisms" Not even malware gets proper QA these days....

etiam 9y ago

The followup has arrived: https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-a-developers-perspective/ https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-...

smoyer 9y ago
Same lack of facts as the first article but with new and improved speculation.
- waihtis 9y ago
  Speculation is all there is to this incident. Would you rather have them pose speculation as facts like many other vendors are doing?
- draw_down 9y ago
  Yeah, well. If all you're willing to accept is facts then this is the wrong area of inquiry for you. As if the NSA periodically releases a fact sheet of what they've been up to lately.
etiam 9y ago
...and some thoughts on the matter by another lab member: https://labsblog.f-secure.com/2017/06/30/what-good-is-a-not-for-profit-eternal-petya/ https://labsblog.f-secure.com/2017/06/30/what-good-is-a-not-...

bsaul 9y ago

This post really reads like high school students trying to write something that looks professional... I hope this field doesn't get too poluted by people looking for a thrill. The stakes start to be too high for that.

albedoa 9y ago
I can't believe this was published. It reads like someone attempting to mock a high school student who tries to write something professional.

matthewaveryusa 9y ago

I find all of this absolutely hilarious. "this is not nation state because it is written in a shoddy way" is akin to "he does not look like a spy because he's too stupid." Get out. Attribution is almost impossible so don't even try. "It's sometimes the height of wisdom to feign stupidity.” -Cato 149 B.C. (that's right, people knew about this simple trick before Jesus was born, you bet humanity has refined on it since)

count 9y ago
Attribution is not 'almost impossible', it just takes human intelligence sources, and not technology, to get an accurate attribution. And due to the nature of those sources, those who get the actual attribution won't disclose it.
- heartbreak 9y ago
  Exactly. This is like the people who said it was impossible to attribute the DNC email hack. Then they attributed it via classic human intelligence sources. We forget there's more to attribution than what can be determined from the bits.

EGreg 9y ago

Followup: https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-a-developers-perspective/ https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-...

jaclaz 9y ago
Interesting, thanks, but still more questions than answers and a somewhat condescending or at the opposite (as some other HN readers noted previously) somewhat "high school" trying to put together something that the teacher would approve, "Here we establish ..." ?.