7 ms·

"It has a vendetta against Kaspersky Lab. If this malware finds running Kaspersky processes on the system, it writes junk to the first 10 sectors of the disk, a

by e9 9y ago

"It has a vendetta against Kaspersky Lab. If this malware finds running Kaspersky processes on the system, it writes junk to the first 10 sectors of the disk, and then reboots, bricking the machine completely." lol

2sk21 9y ago
This is the part I don't understand at all - why Kaspersky?
- beefhash 9y ago
  Should this really be a nation-state actor's malware, it may be a dig at Russia because Kaspersky is a Russian company.
  - nulldev 9y ago
    That is almost certainly an incorrect analysis
  - thg 9y ago
    Or it could be the US that wants you to believe it's Russia. Or any other nation, organization or group that wants to frame Russia. Without any evidence, it's nothing but pure speculation and rumor-mongering.
- Qerub 9y ago
  If we assume Kaspersky is highly popular in Russia it might have been a way to avoid spreading the malware inside Russia (while keeping the behaviour non-obvious). jaclaz notes in another comment that it is easy to recover from this "vendetta".
  - csydas 9y ago
    While it may be a reasonable conclusion, such assumptions aren't supported by some rudimentary survey evidence, as per AV-Comparatives.org [1] The Kaspersky condition in Petya is indeed unusual, but I would agree with the initial blog post that right now there isn't enough information to make even an educated guess. Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses. While I appreciate and even sometimes enjoy speculation such as this for fun, I agree with the F-Secure blog post that it is not useful in the current situation as there just isn't enough evidence to develop anything more than wild guesses. [1] https://www.av-comparatives.org/wp-content/uploads/2017/01/security_survey2017_en.pdf https://www.av-comparatives.org/wp-content/uploads/2017/01/s...
    - zzzcpan 9y ago
      "Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses." But it is also banned in Ukraine, where most targets were.
      - BoiledCabbage 9y ago
        And I'd assume the reason it's is banned in Ukraine is likely due to the persistant rumors that Kaspersky is tied to the Russian FSB. Anti-virus would be a brilliant way to gain access to millions of machines, send back "sample" files via specific user targeted updates... If so (and again I'm starting this sentence with IF), being lenient on Kaspersky would have dual benefits of focusing the target Ukraine, provide a "cure" for any critical machines hit in Russia, and allow existing Kaspersky users to recover once the cure is known. The Interesting thing here is if this was a trial run, I don't think you get another one. If there is another bit of malware that treads lightly on Kaspersky machines, or "accidentally" fails to activate on them then the gig is up. Still speculation, but will be interesting to follow.
        qb45 9y ago
        Problem: user files are still being encrypted regardless of what happens to MBR so you end up doing MBR recovery only to boot a system without your data.
        Qerub 9y ago
        No, the Kaspersky check is done before encrypting any files. Source: https://blogs.technet.microsoft.com/mmpc/2017/06/29/windows-10-platform-resilience-against-the-petya-ransomware-attack/?platform=hootsuite https://blogs.technet.microsoft.com/mmpc/2017/06/29/windows-...
        qb45 9y ago
        It seems checks are done early but MBR destruction only at the end: During malware initialization phase, this malware maintains a global variable that dictates its behavior. It alters its behavior based on the presence of processes related to certain antivirus applications running in the system. Specifically, it looks for names of processes belonging to Kaspersky Antivirus and Symantec Antivirus and alters its behavior if it finds them. Information controlling threats behavior is stored in a global variable (gConfig in the screenshots), which is then used to check during MBR modification. If Kaspersky Antivirus process is found in the system or if the MBR infection is unsuccessful, the malware then proceeds to destroy the first 10 sectors of the hard drive.
jaclaz 9y ago
To me it doesn't sound much as a vendetta. Basically - if I get right the note - if you have some Kaspersky Lab software running the malware ONLY writes junk to the first 10 sectors and reboots, which basically means: 1) on MBR rebuild the MBR partitiontable entries from the existing (untouched) partition/volumes on disk 2) on GPT restore the partition table from the backup Both are perfectly doable to restore the system in a full working condition. It sounds more like a sort of (indirect) "vaccine", instead of getting a deadly influence, you get just a cold, a couple of aspirins and all is well (and the malware cannot spread from that machine to other machines on the network, since it rebooted to the junk and the OS is not running anymore).
- masswerk 9y ago
  As I read it, first there's user-mode encryption in every case. Then, admin-mode is attempted, and, when successful, either the first 10 sectors including the MBR are overwritten by garbage, in case Kapersky software was found, or there's a botched attempt to encrypt the first 25 disk sectors. Mind that user-mode and admin-mode tasks are apparently in separate modules and that the user-mode module is run first, while detecting the Kapersky lab process and overwriting the disk sectors requires admin mode. To me, the "Kapersky branch" appears to be more destructive than the default branch. Edit: Also, there have been reports of the malware scanning and transmitting any credentials stored on the machine, while in "encrypted mode." (Suggesting, there's still a functional basic system left in order to accomplish these tasks.) Couldn't it be for Kapersky AV still being able to detect this activity and hence rather bricking the machine than giving away some of the features early?
  - qb45 9y ago
    Certainly more destructive for the 99.9% of owners who don't know what MBR or GPT is.
    - dsfyu404ed 9y ago
      x2. Someone on the team probably had beef with Kaspersky and decided to hose the partition table of anyone using it. Hosing the partition table is a pretty poor way of minimizing damage because as you point out, 99.9% of people affected will be more affected if the partition table is hosed.
SamUK96 9y ago
I'm pretty much a total novice with low-level aspects of storage, but if this is essentially writing junk to the windows bootloader or something to preveny booting to OS, couldn't one just plug the HDD as a non-ROOT drive to another PC and recover some of the important files? I've seen people successfullu do this before after their super old ROOT disk gets corrupted exactly where the windows bootloader is...
- barrkel 9y ago
  No, that wouldn't work; you'd have to scan the disk for partition information to reconstruct it, or otherwise guess reasonable values (backup being best).
  - ptero 9y ago
    Which does not seem like a particularly difficult task for me. Not quite trivial, not particularly quick, not guaranteed to work 100%, but for main partition types the task should be suitable as an undergraduate CS assignment. However, as you say, having data backed up is a better solution.
- jaclaz 9y ago
  Two cases: 1) MBR "style" partitioning: in first sector of the disk there are at most 4 addresses pointing to the partitions on the disk (which may consist of primary partitions and as such volumes, or one of them may point to an extended partition that has a chain of EMBR's pointing to logical voluems inside it) It is trivial nowadays, using freely available software, to search the disk for the volumes and rebuild the partition tabel in the MBR. 2) GPT disk: The first sector is only a "protective MBR" where in the partition table there is only one entry spanning from sector 2 up to the end of the disk (this can of course be rebuilt in no time). The issue is that the GPT partition table (i.e. addresses of the volumes) is in the following sectors (and the overwriting of 24 or 9 sectors will destroy the data for good, as normally only two sectors are used) and due to the peculiariries of the way these GPT entries are stored it is slightly more difficult to rebuild the data (though the actual volumes on disk can anyway be found and retrieved/imaged). But - IMHO more or less the only good thing about GPT - the MBR and all GPT tables are automatically backed up to the end of the disk, so there is usually no need to rebuild anything, it is just a matter to properly restore the entries from the backup.
kbenson 9y ago
Since when does writing over the MBR brick the machine? Has the term "bricking" lost its original meaning? If the device isn't only useful as a brick afterwards, it's not bricking. Requiring reformatting or replacing a hard drive is hardly enough to do that in most circumstances.

by e9 9y ago

2sk21 9y ago

This is the part I don't understand at all - why Kaspersky?

beefhash 9y ago
Should this really be a nation-state actor's malware, it may be a dig at Russia because Kaspersky is a Russian company.
- nulldev 9y ago
  That is almost certainly an incorrect analysis
- thg 9y ago
  Or it could be the US that wants you to believe it's Russia. Or any other nation, organization or group that wants to frame Russia. Without any evidence, it's nothing but pure speculation and rumor-mongering.
Qerub 9y ago
If we assume Kaspersky is highly popular in Russia it might have been a way to avoid spreading the malware inside Russia (while keeping the behaviour non-obvious). jaclaz notes in another comment that it is easy to recover from this "vendetta".
- csydas 9y ago
  While it may be a reasonable conclusion, such assumptions aren't supported by some rudimentary survey evidence, as per AV-Comparatives.org [1] The Kaspersky condition in Petya is indeed unusual, but I would agree with the initial blog post that right now there isn't enough information to make even an educated guess. Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses. While I appreciate and even sometimes enjoy speculation such as this for fun, I agree with the F-Secure blog post that it is not useful in the current situation as there just isn't enough evidence to develop anything more than wild guesses. [1] https://www.av-comparatives.org/wp-content/uploads/2017/01/security_survey2017_en.pdf https://www.av-comparatives.org/wp-content/uploads/2017/01/s...
  - zzzcpan 9y ago
    "Kaspersky isn't just popular in Russia, it's consistently a top 3 world-wide, both for individual users and for businesses." But it is also banned in Ukraine, where most targets were.
    - BoiledCabbage 9y ago
      And I'd assume the reason it's is banned in Ukraine is likely due to the persistant rumors that Kaspersky is tied to the Russian FSB. Anti-virus would be a brilliant way to gain access to millions of machines, send back "sample" files via specific user targeted updates... If so (and again I'm starting this sentence with IF), being lenient on Kaspersky would have dual benefits of focusing the target Ukraine, provide a "cure" for any critical machines hit in Russia, and allow existing Kaspersky users to recover once the cure is known. The Interesting thing here is if this was a trial run, I don't think you get another one. If there is another bit of malware that treads lightly on Kaspersky machines, or "accidentally" fails to activate on them then the gig is up. Still speculation, but will be interesting to follow.
      - qb45 9y ago
        Problem: user files are still being encrypted regardless of what happens to MBR so you end up doing MBR recovery only to boot a system without your data.
        Qerub 9y ago
        No, the Kaspersky check is done before encrypting any files. Source: https://blogs.technet.microsoft.com/mmpc/2017/06/29/windows-10-platform-resilience-against-the-petya-ransomware-attack/?platform=hootsuite https://blogs.technet.microsoft.com/mmpc/2017/06/29/windows-...
        qb45 9y ago
        It seems checks are done early but MBR destruction only at the end: During malware initialization phase, this malware maintains a global variable that dictates its behavior. It alters its behavior based on the presence of processes related to certain antivirus applications running in the system. Specifically, it looks for names of processes belonging to Kaspersky Antivirus and Symantec Antivirus and alters its behavior if it finds them. Information controlling threats behavior is stored in a global variable (gConfig in the screenshots), which is then used to check during MBR modification. If Kaspersky Antivirus process is found in the system or if the MBR infection is unsuccessful, the malware then proceeds to destroy the first 10 sectors of the hard drive.

jaclaz 9y ago

To me it doesn't sound much as a vendetta. Basically - if I get right the note - if you have some Kaspersky Lab software running the malware ONLY writes junk to the first 10 sectors and reboots, which basically means: 1) on MBR rebuild the MBR partitiontable entries from the existing (untouched) partition/volumes on disk 2) on GPT restore the partition table from the backup Both are perfectly doable to restore the system in a full working condition. It sounds more like a sort of (indirect) "vaccine", instead of getting a deadly influence, you get just a cold, a couple of aspirins and all is well (and the malware cannot spread from that machine to other machines on the network, since it rebooted to the junk and the OS is not running anymore).

masswerk 9y ago
As I read it, first there's user-mode encryption in every case. Then, admin-mode is attempted, and, when successful, either the first 10 sectors including the MBR are overwritten by garbage, in case Kapersky software was found, or there's a botched attempt to encrypt the first 25 disk sectors. Mind that user-mode and admin-mode tasks are apparently in separate modules and that the user-mode module is run first, while detecting the Kapersky lab process and overwriting the disk sectors requires admin mode. To me, the "Kapersky branch" appears to be more destructive than the default branch. Edit: Also, there have been reports of the malware scanning and transmitting any credentials stored on the machine, while in "encrypted mode." (Suggesting, there's still a functional basic system left in order to accomplish these tasks.) Couldn't it be for Kapersky AV still being able to detect this activity and hence rather bricking the machine than giving away some of the features early?
- qb45 9y ago
  Certainly more destructive for the 99.9% of owners who don't know what MBR or GPT is.
  - dsfyu404ed 9y ago
    x2. Someone on the team probably had beef with Kaspersky and decided to hose the partition table of anyone using it. Hosing the partition table is a pretty poor way of minimizing damage because as you point out, 99.9% of people affected will be more affected if the partition table is hosed.

SamUK96 9y ago

I'm pretty much a total novice with low-level aspects of storage, but if this is essentially writing junk to the windows bootloader or something to preveny booting to OS, couldn't one just plug the HDD as a non-ROOT drive to another PC and recover some of the important files? I've seen people successfullu do this before after their super old ROOT disk gets corrupted exactly where the windows bootloader is...

barrkel 9y ago
No, that wouldn't work; you'd have to scan the disk for partition information to reconstruct it, or otherwise guess reasonable values (backup being best).
- ptero 9y ago
  Which does not seem like a particularly difficult task for me. Not quite trivial, not particularly quick, not guaranteed to work 100%, but for main partition types the task should be suitable as an undergraduate CS assignment. However, as you say, having data backed up is a better solution.
jaclaz 9y ago
Two cases: 1) MBR "style" partitioning: in first sector of the disk there are at most 4 addresses pointing to the partitions on the disk (which may consist of primary partitions and as such volumes, or one of them may point to an extended partition that has a chain of EMBR's pointing to logical voluems inside it) It is trivial nowadays, using freely available software, to search the disk for the volumes and rebuild the partition tabel in the MBR. 2) GPT disk: The first sector is only a "protective MBR" where in the partition table there is only one entry spanning from sector 2 up to the end of the disk (this can of course be rebuilt in no time). The issue is that the GPT partition table (i.e. addresses of the volumes) is in the following sectors (and the overwriting of 24 or 9 sectors will destroy the data for good, as normally only two sectors are used) and due to the peculiariries of the way these GPT entries are stored it is slightly more difficult to rebuild the data (though the actual volumes on disk can anyway be found and retrieved/imaged). But - IMHO more or less the only good thing about GPT - the MBR and all GPT tables are automatically backed up to the end of the disk, so there is usually no need to rebuild anything, it is just a matter to properly restore the entries from the backup.

kbenson 9y ago

Since when does writing over the MBR brick the machine? Has the term "bricking" lost its original meaning? If the device isn't only useful as a brick afterwards, it's not bricking. Requiring reformatting or replacing a hard drive is hardly enough to do that in most circumstances.