Confirms what I have been posting this was a dliberate targeted Russian cyber attack....
Ransomware attack 'not designed to make money', researchers claim
https://www.theguardian.com/technolo...=share_btn_tw#
…
AND with the entire world reading Trump tweets as he pounds them out...notice the sheer silence from the WH on this confirmed hacking report.....
ABC News
@ABC
NEW: Federal authorities investigating breach into computer systems of at least one U.S. nuclear power plant.
http://abcnews.go.com/Politics/us-nu...ry?id=48314345
BUT WAIT...Trump called also ABC FAKE News so maybe we should ignore this report....
NOW this is interesting because if Petya made into the business side then LSADump was started which means all passwords and domain controller information was sent back to the hacking site from which Petya came...namely Russia....
AND that Trump 90 day cyber protection plan is exactly what again......crickets.......are all I hear lately from Trump's fast tweeting fingers...
This major malware attack was a massive cyber attack on Ukraine and really no one else....interesting is just how far it bled into other areas....and countries....
SO after the previous massive cyber attack with Wannacry this nuclear plant did not do the MS MARCH 2017 patching which would have prevented this from happening.......
Confirms what I have been posting this was a dliberate targeted Russian cyber attack....
Ransomware attack 'not designed to make money', researchers claim
https://www.theguardian.com/technolo...=share_btn_tw#
…
BREAKING: FedEx says TNT Express operations disrupted in Tuesday's cyber attack, all other services operating normally
"Misleading by Mistranslation" -
https://medium.com/dfrlab/misleading...d49d8c59b---4#
NATO Secretary General @jensstoltenberg said the next cyber attack could result in war
Russian troll claiming Ukraine is Russia's testing ground (property) @GicAriana projects RF control while asserting outrage at the idea.
She uses multiple sock accounts....to achieve this.....
Last edited by OUTLAW 09; 06-28-2017 at 05:34 PM.
Russian attack inside Ukraine is getting now interesting ......in this article they talk about one attack vector.......Kaspersky in their press release talks about multiple attack vectors......
And this is even more interesting no one has identified where within the upgrade the malware was inserted....that needs to be answered...... and it does not explain how it "lept" to other locations
Still does not explain a set of actual network hacking attacks to gain entry.....
https://www.bloomberg.com/news/artic...-software-firm
Attack Goes Global
Microsoft Corp., cybersecurity analysts, and Ukrainian police say the global hack that has disrupted companies across the globe can be traced to a Ukrainian accounting software producer called M.E.Doc.
The cybercrime unit of the Ukrainian police said late Tuesday that a software upgrade from M.E.Doc unwittingly contained the virus. Microsoft said in a blog post that the initial infection “appears to involve a software supply-chain threat involving the Ukrainian company M.E.Doc” and that it has evidence that some active infections started from the software maker’s updates.
“One infection vector used in this campaign was the M.E.Doc software,” John Miller, senior manager at cybersecurity firm FireEye, said in an email. Aleks Gostev, Kaspersky Lab’s chief security expert, also said M.E.Doc appeared to be the source of the malware.
M.E.Doc did not respond to requests for comment. In a Facebook post M.E.Doc said “major anti-virus companies” had vetted its software and that it#has no responsibility for spreading the virus. The company said that like other victims, some of its services had been affected by the attack, and that it’s working to restore them.
The attack Tuesday popped up in government systems in Kiev, then disabled operations at companies including Rosneft PJSC, advertiser WPP Plc, and the Chernobyl nuclear facility. More than 80 companies in Russia and Ukraine were initially affected, Moscow-based cybersecurity company Group-IB said. The hack quickly spread from Russia and Ukraine through Europe and into the U.S. and Asia.
A.P. Moller-Maersk A/S, one of those hardest hit by the attack, has shut down systems across its operations as it assesses the full impact. The container carrier has posted a job announcement in Kiev seeking staff with M.E.Doc experience.
Agree with this......
Estonia cyber attack of 2007 was child's play compare to this. The latest attack was probing of deep penetration.
Why major companies like MS or FireEye are pointing to this is interesting...
The deep probing refers to the coupling of LSADump with the malware.....
Again.....Kaspersky knew of multiple attack vectors.......how and why???
There was speculation, however, among some experts that once the new virus had infected one computer it could spread to other machines on the same network, even if those devices had received a security update."Microsoft now has evidence that a few active infections of the ransomware initially started from the legitimate MEDoc updater process," it said in a technical blog post.Over the next days we will see more attack avenues come out.....Russian security firm Kaspersky said a Ukrainian news site for the city of Bakhumut was also hacked and used to distribute the ransomware to visitors, encrypting data on their machines.
Petya/notpetya apparently a sabotage program that wipes stuff.
https://blog.comae.io/petya-2017-is-...-9ea1d8961d3b#
Petya.2017 is a wiper not a ransomware
THIS is the important part of the article....Ransomware-as-a-service soon to be renamed Lure-as-a-Service
TL;DR: The ransonware was a lure for the media, this version of Petya actually wipes the first sectors of the disk like we have seen with malwares such as Shamoon.
What’s the difference between a wiper and a ransomware#?
The goal of a wiper is to destroy and damage. The goal of a ransomware is to make money. Different intent. Different motive. Different narrative. A ransomware has the ability to restore its modification such as (restoring the MBR like in the 2016 Petya, or decrypting files if the victim pays) — a wiper would simply destroy and exclude possibilities of restoration.
Yesterday, we provided a preliminary analysis where we demonstrated that the 27th June 2017 version of Petya leveraged SMB exploits ETERNALBLUE and ETERNALROMANCE.
Today, we spent more time to understand how the files could be retrieved and how the actual MBR and MFT was being encoded.
Fortunately, there are multiple excellent existing analysis from 2016 Petya that have been published last year in multiple languages such as French, or English [1, 2]. Today, Microsoft published a very descriptive analysis of the 2017 Petya but for some reasons missed the below part.
542a38bf52afa6a4a008089a6fbf22c9d68ef5d6c634dd2c07 73d859a8ae2bbf (2016)
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b 30f6b0d7d3a745 (27th 2017)
After comparing both implementation, we noticed that the current implemented that massively infected multiple entities Ukraine was in fact a wiper which just trashed the 25 first sector blocks of the disk.
The first sector block is being reversibly encoded by XORed with the 0x7 key and saved later in the 34th block. But since it replaces it with a new bootloader (41f75e5f527a3307b246cadf344d2e07f50508cf75c9c2ef8 dc3bae763d18ccf) of 0x22B1 bytes it basically sets v19 to 0x19 (25).
16.0: kd:x86> ? 0x22B1 - (0x22B1 & 0x1FF) + 0x1024
Evaluate expression: 12836 = 00003224
16.0: kd:x86> ? 0x00003224 >> 9
Evaluate expression: 25 = 00000019
That would mean that 24 sector blocks following the first sector block are being purposely overwritten, they are not read or saved anywhere. Whereas the original 2016 Petya version correctly reads each sector block and reversibly encode them.
2016 Petya modifies the disk in a way where it can actually revert its changes. Whereas, 2017 Petya does permanent and irreversible damages to the disk.
On the left, we can see the current version of Petya clearly got rewritten to be a wiper and not a actual ransomware.
We believe the ransomware was in fact a lure to control the media narrative, especially after the WannaCry incidents to attract the attention on some mysterious hacker group rather than a national state attacker like we have seen in the past in cases that involved wipers such as Shamoon.
Lately, the number of attacks against Ukraine increased from Power Grids being shut down to the car a top military intelligence officer exploding yesterday — the day Petya.2017 infected Ukraine.
The fact of pretending to be a ransomware while being in fact a nation state attack — especially since WannaCry proved that widely spread ransomware aren’t financially profitable — is in our opinion a very subtle way from the attacker to control the narrative of the attack.[/B]
Last edited by OUTLAW 09; 06-28-2017 at 07:05 PM.
Actually this has been now confirmed by the CEO of Kaspersky......Originally Posted by OUTLAW 09
Eugene Kaspersky
@e_kaspersky
Update on #NotPetya #ExPetr: threat actors CAN'T decrypt files. Don't pay ransom. It won't help ->
Interesting use of the two words..."threat actors"......
Airport in Oslo is completely grounded due to #NotPetya attacks. No check in, no bag drop. Thousands of people stranded.
NOTE....if my assumptions are correct this malware is a totally new class of malware attack thus the name Petya in any form simply does not fit.....MAYBE the following suggestion.....
MassiveCoordinatedCyberInvasion works well even as a hashtag.....
What happened in Ukraine is long pass the concept of "a cyber attack".....
Last edited by OUTLAW 09; 06-29-2017 at 07:18 AM.
WHY is the "big boys" in IT anti viral security are still lagging after this attack on Ukraine.....
Right now individual IT analysts and small IT security companies are providing far more insight into this attack than "the big boys" who will at some point release massive reports and take all the credit.....
It was the "small guys" who immediately called this attack a true cyber attack by a state sponsored group ie Russia......based on the first single target...Ukraine...
From yesterday.....
Email of the attacker is down. And the code itself look more like a wiper than an encoder. cf below: #Petya
I am posting the entire article and giving credit to the author as it is important to fully understand this Russian cyber invasion as it has gone far past what is termed "cyber attack"......
https://www.cyberscoop.com/petya-ran...r-boot-record/
Global ransomware attack was meant to be destructive, not collect money
Written by
Chris Bing
Jun 28, 2017 | CyberScoop
A global ransomware outbreak Tuesday was inherently designed to be destructive in nature, according to private sector cybersecurity researchers.
An analysis of a unique variant of Petya ransomware#conducted by Comae Technologies’ Matthieu Suiche reveals that computer code in the June 27 version of the malware is different than previous samples which were tied to incidents involving monetary gain. The primary difference between past Petya variants and Tuesday’s malware comes in the form of a small block of code that effectively commands the virus to “erase the#Windows system’s#Master Boot Record#(MBR) on default,” said Suiche.
“After comparing both implementations, we noticed that the current [implementation] that massively infected multiple entities in Ukraine was in fact a wiper, which just trashed the 25 first sector blocks of the disk,” Suiche wrote in a blog post.
The new version of Petya, dubbed “NotPetya,” effectively demolishes a key function of the victim computer’s boot process even before a victim has the chance to read any ransom demands.
“Ransomware needs the ability to restore the MBR,” Suiche told CyberScoop. #“A wiper makes it so that files can’t be restored .. typically ransomware will decrypt files if you pay, or restore the MBR if you pay. This doesn’t do that. It’s destructive.”
The motive for this expansive cyberattack quickly became a hotly debated topic on social media among security researchers.
Analysts closely monitoring Petya’s spread#— an impact that crippled companies in Ukraine, France, Russia, Spain and the U.S. —#have been casting doubt on the idea that the ransomware was designed by cybercriminals to collect money.
“The goal of a wiper is to destroy and damage. The goal of ransomware is to make money. Different intent. Different motive. Different narrative,” Suiche explained.
Elements of the ransomware were poorly configured in such a way that receiving payment didn’t seem to be a priority for the hackers, according to Intel471 founder Mark Arena.
“The ransomware message was the same for all victims, used the same bitcoin wallet and provided a web email address that was promptly taken down by the web email provider,” Arena said. “In our opinion, the attacker or attackers clearly showed no interest in decrypting the files for victims that paid them.”
The contact email address left by the hackers for victims to reach out to unlock an encrypted system was registered through a public web platform, meaning that the email address was not hidden or blocked#from access by administrators.
Within hours of Tuesday’s outbreak, the email provider predictably shut down the account, making it impossible to authorize a decryption. The#hackers would have likely understood this would happen — a logical assumption that adds#to#to the idea that this wasn’t a financially motivated attack.
In addition, because of the relatively targeted nature of the Petya outbreak#— having been largely contained to organizations directly working with Ukrainian companies that interface with financial software developer MeDoc#— some analysts say the disruption was directly meant to specifically handicap the country in the days before a national holiday.
Tensions between Russia and Ukraine have been high in recent months.#
“We believe with medium confidence that [NotPetya] is not a ransomware campaign but was intended to cause wide scale damage to organizations in Ukraine,” Arena said. “We base this assessment on the advanced capability of the threat actor or group with M.E.Doc’s update system being compromised and used to spread the malware, the malware itself and it’s spreading capability.”
In an email to CyberScoop, a Kaspersky Lab spokesperson sent the follow statement regarding the company’s latest analysis of NotPetya
Last edited by davidbfpo; 06-29-2017 at 08:51 AM. Reason: Quote edited to within rules
The Kremlin has unleashed the full power of its propaganda machine against @Telegram, says David Homak. But why?
https://themoscowtimes.com/articles/...ensored-58272#
What worries me about NotPetya:
Unsophisticated .......but it really is not
Very repeatable......thus a massive attack weapon
Was pulling its punches targeting Ukraine...thus can be turned on any country the state sponsor wants attacked
No easy / simple fix for victims.........thus right now no fix in sights
AS it wipes the MicroSoft Master Boot File (MBF)....that thingy that controls both the computer and MS.....
AND without the "thingy" it is virtually impossible reboot the computer thus it is nothing but a piece of metal and plastic and worthless....
This malware was designed to destroy not hinder....
The Late, Great Russian Collusion Myth
By Victor Davis Hanson at American Greatness: https://amgreatness.com/2017/06/28/l...ollusion-myth/
Introduction:
Highlights:Incoming elected administrations, especially the Obama transition team of 2008 in the case of Russia and Iran, seek contacts with foreign diplomats before formally entering office.
Most presidential campaigns are staffed by at least a few free-lancing opportunists who see their candidate as a nexus for profiteering. There is no need for a reminder of the lucrative careers of Bill Clinton from 2009-2012, or of Hillary Clinton’s brother, or of the nature of some of John Podesta’s investments. And foreign governments, our own included as in the case of the Obama Administration’s entrance into the Israeli elections, are frequently accused of trying to sway or indeed interfere with another nation’s campaign cycles.
Yet what is strange about the charges of collusion between the Trump campaign and the Russian government is that those landscapes were concocted into something supposedly criminal and uniquely applicable to Donald Trump’s election and presidency. Indeed, one of the strangest events in recent political history was the post-election false news narrative that Trump and the “Russians” had colluded during the campaign to rob Hillary Clinton of a sure victory.
- FBI Director Comey informed President Trump on three occasions that he was not personally, the subject of any investigation about collusion with Russia
- Former DNI Clapper and former CIA Director Brennan admitted that there was no intelligence to their knowledge implicating Trump as a colluder with Putin to gain advantage over Clinton
- Former Homeland Security Secretary Johnson conceded that there was no evidence of any Trump campaign effort to persuade Russia to interfere in the elections
- President Obama, who had intelligence reports of Russian election-cycle hacking, dismissed the idea that any party could taint a U.S. presidential election and denounced Trump’s suggestion that the impending election might be “rigged”
- Poster's Note: read what Obama said in October 2016 regarding Trump’s claims of election “rigging”, which could refer to any type of voter fraud, suppression or “hacking”:
To Trump: “stop whining”
The voting process is protected because it is “so decentralized”
Trump’s claim is “not based on facts”
“I have never seen in my lifetime or in modern political history any presidential candidate trying to discredit the elections and the election process before votes have even taken place.”
“…if he [Trump] got the most votes, then it would be my expectation of Hillary Clinton to offer a gracious concession speech and pledge to work with him in order to make sure that the American people benefit from an effective government”
- Hillary Clinton lost because she was a poor candidate, her campaign was incompetent (wasting resources on red states rather than solidifying the “blue wall”), and because she did not offer a compelling story, other than the novelty of becoming the first female president.
- With respect to appeasement of the Russians, Obama launched a “reset” in reaction to Bush’s increasingly confrontational stance. Obama also was recorded explaining that he would need “space” from Putin until after the 2012 election, after which he could respond with “flexibility”. Lastly, Obama also in 2012 ridiculed presidential candidate Romney’s assertion that Russia was the primary threat to the United States.
- Republicans such as Nunes and McCain have denounced Obama for years, for not confronting Russian aggression in Ukraine, for various intelligence failures, and for not answering Russia’s information war against the U.S.
- VDH: “How the media was able in a matter of hours after the election to rebrand Democrats as anti-Russian hawks and Republicans as colluders with Putin is one of the strangest and yet most successful political fabrications in recent history.”
- Clinton seemed to be enjoying a comfortable lead in the last months of the 2016 campaign, but there were concerns that the DNC favoring her over Sanders, her private server and pay-for-play scandals were damaging.
- Putin was openly hostile to Obama, Clinton and Kerry, and believed that they had at various times meddled in Russia’s 2012 election and provoked the revolution in Ukraine in 2014.
- “Never Trump” Republican and Clinton campaign opposition research (e.g. the Steele Dossier) came to the attention of FBI Director Comey. Various bureaucrats later leaked salacious details of the Dossier to the press.
- Yet the media continued to largely ignore the Russian collusion story given that Clinton’s victory was almost a certainty. But then Trump won, despite losing the popular vote, and by crumbling the “blue wall”.
- Following Trump’s victory, the Clinton campaign needed to counter Trump (i.e. delegitimize and undermine) and to console itself, and revived the Russian collusion story. The media was eager for controversy and therefore public attention, and intelligence careerists who saw Trump as a threat to their “community” tried to authenticate the smear. The smear easily fit convenient stereotypes about Trump, Trump’s rhetoric and actions worsened the problem and Putin enjoyed watching Americans turn on one another rather than him. The smear also drowned out accusations that Obama leaked to the press or that Attorney General Lynch had obstructed the FBI’s investigation of Clinton.
Last edited by Azor; 06-29-2017 at 08:34 PM.
Is Russiagate Really Hillarygate?
By Paul Roderick Gregory: https://www.forbes.com/sites/paulrod.../#2d4697945cf6
Introduction:
Highlights:According to an insider account, the Clinton team, put together the Russia Gate narrative within 24 hours of her defeat. The Clinton account explained that Russian hacking and election meddling caused her unexpected loss. Her opponent, Donald Trump, was a puppet of Putin. Trump, they said, “encourages espionage against our people.” The scurrilous Trump dossier, prepared by a London opposition research firm, Orbis, and paid for by unidentified Democrat donors, formed a key part of the Clinton narrative: Trump’s sexual and business escapades in Russia had made him a hostage of the Kremlin, ready to do its bidding. That was Hillary's way to say that Trump is really not President of the United States—a siren call adopted by the Democratic party and media.
- The most uncovered story of RussiaGate is the connection between the Clinton campaign, an unregistered agent of Russia in Washington, and the Steele Dossier. It is possible that Russian intelligence fabricated the Dossier as part of its overall disinformation campaign to sow chaos in the American political system. If Clinton’s associates ordered and paid for the Dossier, then RussiaGate becomes a story of collusion between Clinton campaign operatives and Russian intelligence. Only the Wall Street Journal, The Federalist and National Review have covered the possible Russian intelligence-origins of the Dossier.
- On March 31, 2017, Senator Grassley (R-Iowa) demanded from the DOJ documentation on “Fusion GPS”, a firm that managed the Steele Dossier. Sen. Grassley explained that it would be of concern for his Judiciary Committee because: “when Fusion GPS reportedly was acting as an unregistered agent of Russian interests, it appears to have been simultaneously overseeing the creation of the unsubstantiated dossier of allegations of a conspiracy between the Trump campaign and the Russians.”
- On May 3, 2017, before the Senate Intelligence Committee, former FBI Director Comey refused to answer questions about Fusion GPS and the Dossier (“I don’t want to say”).
- Russia SME David Satter wrote:
Russian intelligence also acted to sabotage Mr. Trump. The ‘Trump dossier, full of unverified sexual and political allegations, was published in January by BuzzFeed, despite having all the hallmarks of Russian spy agency ‘creativity.’ The dossier was prepared by Christopher Steele, a former British intelligence officer. It employed standard Russian techniques of disinformation and manipulation…after the publication of the Trump dossier, Mr. Steele went into hiding, supposedly in fear for his life. On March 15, however, Michael Morell, the former acting CIA director, told NBC that Mr. Steele had paid the Russian intelligence sources who provided the information and never met with them directly. In other words, his sources were not only working for pay. Furthermore, Mr. Steele had no way to judge the veracity of their claims…Perhaps the time has come to expand the investigation into Russia’s meddling to include Mrs. Clinton’s campaign as well.- Poster’s Note: Satter was expelled from Russia and one of the first journalists to claim that the 1999 Russian apartment bombings were a plot by Russian intelligence to bring Putin to power and provide a pretext for the Second Chechen War (Darkness at Dawn). If this was what truly happened, and I believe that it was, nothing the current president has said or done with regard to U.S.-Russia relations can compare to the naïveté of his two predecessors in attempting to cooperate with Putin in good faith.
- According to Vanity Fair, Fusion GPS was initially paid for opposition research by an anti-Trump Republican donor, but then paid by Democratic donors whose identities remain secret.
- The Fusion GPS-Steele Dossier link must be investigated by Special Counsel Mueller, and Steele interviewed himself...
You really want a comment on this load of information that makes FAKE news actually look like FAKE news.........oh where to begin...??
BTW...was it not the former DHS Director that stated 21 State databases were in fact hacked and in especially two that are being reviewed "data was exfiltrated"..meaning actually stolen......
THEN we have this week the announcement that a GOP contractor actually SCL onwed by Bannon who sold it to Mercer and Cambridge Analytica "pushed a database containing 200M US voters with just about everything one needs for identity theft onto a totally unsecured with no password onto a Amazon cloud server for a total of 21 days and THEN was evidently surprised that it was stolen....
HELLO Moscow...REMEMBER this is Trump calling..please release those 200M records on all of the American voters...please..pretty please...you did help with the 30,000 so 200M should not be a problem.....???
Come on give me a break....
If by now you truly do not understand the depth of the Trump collusion and that of his close associates then there is not much hope for you when in the end a many end up in court ALL stating ...it was a Democratic smear operation...
Do you seriously want me to link you to a large money transfer made out of Russia via Cyprus to America Greatness???
All in due time as that money transfer was and is key for an ongoing GOP money laundering FBI investigation.....
We are at now 140 FBI investigators and 14 of the VERY BEST Federal prosecutors and RCO prosecutors many speaking Russian and YET there is now collusion...??
Last edited by davidbfpo; 07-01-2017 at 10:52 AM. Reason: brevity
Posting Permissions
Bookmarks