Petya virus – is it ransomware and which companies have been hit by the global cyber attack?

A CYBER attack dubbed “Petya” has hit computer servers around the world crippling companies in Britain, Europe and Chernobyl.

Here’s what you need to know behind the second major cyber attack – which is being likened to WannaCry – in two months.



GETTY IMAGES


3 Companies have been crippled by an attack dubbed ‘Petya’


What is the Petya?


Petya is a malicious software which targeted victims in the UK, Europe and the US with computer screens warning that their files and systems would be destroyed if they did not send the equivalent of about £300 in bitcoin.


Travis Farral, director of security strategy at tech firm Anomali, said: “This is a global attack. Just like WannaCry, organisations are locked out of their networks and a fee demanded to decrypt files.


“Bitcoin payments are currently already at $2,000+ already. But it’s essential that victims understand that payment may not actually allow them to access their data, and may just fund hackers to commit further crimes.”


The cyber-assault is particularly severe because it is understood that just 10 out of 61 antivirus programs are capable of tackling it.


The source of the attacks was not immediately clear.




3 A view of a computer that has been infected by the Petya ransomware

What is ransomware?


Ransomware is a virus which takes over a device (or computer) and freezes its files.


Hackers use it to hold the recipient to ransom, asking for money in return for access to their documents.


The ransomware can be spread by accidentally clicking a bad link.


It’s often shared in an email, or in some cases hackers could booby-trap a website they know employees will visit, like a government portal.


Security experts always advise against paying a ransom, as hackers will often destroy the files anyway.


Criminal gangs will send out thousands of these emails, called phishing scams, in the hope that just a few will click on the link.
Is the Petya virus a ransomware?


The virus that is sweeping the globe is believed to be a “wiper” designed to cause mayhem and is not actually ransomware.


Cyber experts say Petya is hell-bent on destroying files permanently.


Russian cybersecurity expert at Kaspersky Labs wrote in a blogpost: “After an analysis of the encryption routine of the malware used in the Petya attacks, we have thought that the threat actor cannot decrypt victims’ disk, even if a payment was made.


“This supports the theory that this malware campaign was not designed as a ransomware attack for financial gain.


“Instead, it appears it was designed as a wiper pretending to be ransomware.


“What does it mean? Well, first of all, this is the worst case news for the victims – even if they pay the ransom they will not get their data back.


“Secondly, this reinforces the theory that the main goal of the ExPetr attack was not financially motivated, but destructive.”
Which companies have been hit by the Petya ransomware attack?




3 Where the attacks are known to have hit so far


British advertising giant WPP and the French industrial group Saint-Gobain all said they came under attack and put protection protocols in place to avoid data loss.


Ukraine was the worst hit, with government ministries, banks, utilities, telecom operators and major companies attacked.


Computers at the Chernobyl nuclear power plant have been infected, although there is not believed to be any risk of radioactive contamination.


Shipping giant A.P. Moller-Maersk, a firm which handles one out of seven containers shipped globally, said its systems were down across “multiple sites and business units due to a cyber attack”.


The crippling virus has forced the Danish company to halt operations at the fully automated Maasvlakte II terminal in Rotterdam.


Mondelez, the owners of Cadbury, were also hit in the devastating attack.


Russian oil giant Rosneft announced that its servers has been hit by a “powerful hacking attack” carried out “against the company’s servers”.


Russian web security firm Group-IB said the Petya ransomware was used in today’s massive attack on oil, telecommunications and financial companies in the former Soviet Union.

Russian security service has hit Ukrainian state institutions with 6,500 hack attacks

Image Credit: Venture Beat

  30 Dec 2016 , 09:21

Hackers have targeted Ukrainian state institutions about 6,500 times in the past two months, including incidents that showed Russian security services were waging a cyberwar against the country, President Petro Poroshenko said on Thursday. In December, Ukraine suffered attacks on its finance and defense ministries and the State Treasury that allocates cash to government institutions. A suspected hack also wiped out part of Kiev’s power grid, causing a blackout in part of the capital.

“Acts of terrorism and sabotage on critical infrastructure facilities remain possible today,” Poroshenko said during a meeting of the National Security and Defence Council, according to a statement released by Poroshenko’s office.  The statement said the president stressed that “the investigation of a number of incidents indicated the complicity directly or indirectly of Russian security services waging a cyberwar against our country”.

Relations between Kiev and Moscow collapsed in 2014 following Russia’s annexation of Crimea and support for pro-Russian separatists in eastern Ukraine, where fighting continues despite a ceasefire agreement. Among the 6,500 attacks Poroshenko said the country had been hit by, the attack on the State Treasury halted its systems for several days, meaning state workers and pensioners had been unable to receive their salaries or payments on time.

Cyber security firm CrowdStrike said last week a hacking group linked to the Russian government likely used a malware implant on Android devices to track and target Ukrainian artillery units from late 2014 through 2016. Its findings are the latest to support a growing view among Western security officials and cyber security researchers that Russian President Vladimir Putin has increasingly relied on hacking to exert influence and attack geopolitical foes.

Russia has repeatedly denied hacking accusations. Poroshenko’s comments come as the Obama administration plans to announce retaliatory measures against Russia for hacking into U.S. political institutions and individuals and leaking information in an effort to help Donald Trump win the presidency. Trump has dismissed the assessments of the U.S. intelligence community.

In December 2015, Ukrainian regional power company Prykarpattyaoblenergo reported an outage, saying the area affected included the regional capital Ivano-Frankivsk. Ukraine’s state security service blamed Russia. Experts widely described that incident as the first known power outage caused by a cyber attack. The U.S. cyber firm iSight Partners identified the perpetrator as a Russian hacking group known as “Sandworm”. As a result of the cyber attacks, Ukraine’s security council agreed measures to protect state institutions, the statement said. It did not disclose what the measures were.

Reuters

Russian central bank loses $31 million in cyber attack

Russian central bank cyber attack

03 Dec 2016 , 08:43


Hackers stole more than 2 billion rubles ($31 million) from correspondent accounts at the Russian central bank, the bank said on Friday, the latest example of an escalation of cyber attacks on financial institutions around the globe.

Central bank official Artyom Sychyov discussed the losses at a briefing, saying that the hackers had attempted to steal about 5 billion rubles.

Sychyov was commenting on a central bank report released earlier in the day, that told about hackers breaking into accounts there by faking a client’s credentials. The bank provided few other details in its lengthy report.

Financial regulators around the world have recently urged banks to beef up cyber security in the wake of a string of high-profile heists on banks around the world.

Fears about attacks on banks have mounted since February when unknown cyber criminals stole $81 million in funds that Bangladesh’s central bank had on deposit at the New York Fed. Law enforcement agencies around the globe are hunting for the criminals who stole the money using fraudulent wire-transfer requests sent over the SWIFT bank messaging network.

Separately, Russia said on Friday that it had uncovered a plot by foreign spy agencies to sow chaos in the country’s banking system via a coordinated wave of cyber attacks and fake social media reports about banks going bust.

Reuters

Deutsche Telekom attack part of global campaign on routers

Representational Image

  30 Nov 2016 , 09:59

A cyber attack that infected nearly 1 million routers used to access Deutsche Telekom internet service was part of a campaign targeting web-connected devices around the globe, the German government and security researchers said on Tuesday.

The revelation from the German Office for Information Security, or BSI, stoked fears of an increase in cyber attacks that disrupt internet service by exploiting common vulnerabilities in widely used routers, webcams, digital video recorders and other web-connected devices.

Security researchers said the infections spread to countries including Brazil, Britain and Ireland using a technique similar to one that stopped millions of people in the United States and Europe from reaching websites including PayPal Holdings Inc , Twitter Inc and Spotify on Oct. 21.

The BSI said that German government networks were also targeted in Sunday’s attack on Deutsche Telekom customers, though authorities said they succeeded in keeping systems online.

Deutsche Telekom, Germany’s largest telecom company, said internet outages hit as many as 900,000 of its users, or about 4.5 percent of its fixed-line customers.

Deutsche Telekom and the German government did not identify other victims, though cyber security firm Rapid7 Inc said it observed the attackers trying to infect routers across the globe.

Irish telecom operator Eir and Vodafone Group Plc in Britain use routers that were vulnerable to same kind of attack, said Rapid7 security research manager Tod Beardsley.

Flashpoint, a second U.S. cyber security research firm, said it routers were infected in Brazil, Britain and Germany.

Eir said in a statement it was aware of potential vulnerabilities in broadband modems from Taiwan’s ZyXel Communications Corp used by about 30 percent of Eir customers.

“We have deployed of a number of solutions both at the device and network level which will remove this risk,” Eir said. It reported the incident to Irish regulators.

Vodafone declined to comment on whether it customers had been infected, but said it was aware of a vulnerability in routers that enables attackers to mount denial-of-service attacks.

The Brazilian National Computer Emergency Response Team told Reuters it was analyzing the impact of the attack on Brazil, but declined to say how many computers had been infected.

Mirai Botnet

The attacks were launched with software known as Mirai that seeks out vulnerable connected devices, then turns them into remotely controlled “bots” for mounting large-scale attacks that disrupt access to websites and computer systems.

Deutsche Telekom executives apologized for the outages, saying the company had provided details about the attack to other network operators and security agencies.

Security experts said the problem affected Deutsche Telekom customers using three types of routers manufactured by Taiwan’s Arcadyan Technology, which created a software patch that was pushed out to users on Monday.

Arcadyan did not reply to Reuters’ requests for comment.

Security experts said attributing blame for the attacks may prove impossible because the Mirai software had been released on the internet. It is relatively easy to use, which means hackers with relatively few technical skills could be to blame for follow-on attacks, they said.

Reuters

Cyber attacks hit Singapore telecom service provider StarHub

Image Credit: StarHub Facebook

  26 Oct 2016 , 14:34

Singaporean telecoms service provider StarHub Ltd said intentional cyber attacks had caused internet connection disruption for some of its home broadband customers on Oct. 22 and Oct. 24. The company said it analysed network logs of the disruptions and found that it had experienced intentional and likely malicious distributed denial-of-service (DDoS) attacks on its domain name servers (DNS).

DDoS attackers typically target sites by flooding servers with messages from multiple systems so they are unable to respond to legitimate traffic. StarHub said there was no evidence of any impact on the rest of its services, and the security of its customers’ information was not compromised. “On both occasions, we mitigated the attacks by filtering unwanted traffic and increasing our DNS capacity, and restored service within two hours,” it said in a statement late on Tuesday.

The incidents come close on the heels of attacks on Twitter Inc, PayPal Holdings Inc, Spotify AB and other customers of Dyn, a U.S. company which acts as a switchboard for internet traffic. StarHub said it was investigating the intent and source of the two attacks, which it called “unprecedented in scale, nature and complexity” for the company.

It told Reuters in an email on Wednesday that it does not use Dyn services. As of June 30, StarHub’s residential broadband subscribers totalled 473,000. Singapore authorities on Tuesday advised other telecom firms to strengthen defences to protect against similar disruptions.

Singapore Telecommunications Ltd, the city-state’s biggest telecom operator, said it did not observe any abnormal traffic trends over the weekend but will continue to monitor networks closely. Third-ranked M1 Ltd said it was aware of the cyber-attacks and was on alert.\

Reuters