The recent “ransomware” computer virus outbreak is over, but the speculation is just beginning. And it begins with those quotes around the term ransomware.
On Tuesday, organizations in 64 countries around the globe, according to Microsoft, found themselves beating back a virus that’s been variously named Petya, GoldenEye, or even “NotPetya.” Infected computers suffered devastating attacks that disabled the machines and made files useless — encrypted, with instructions for paying a ransom, in typical ransomware fashion.
But there was something very atypical about this attack. The program itself was very sophisticated — far more sophisticated than WannaCry, last month’s most famous virus attack. Petya stole login credentials. It spread itself in multiple ways, meaning many folks who thought they were patched against Petya were not safe from it. Microsoft’s analysis of the malware shows how much effort was put into the crafting of the program.
But the ransom payout mechanism was as fragile as a single email address. That was disabled almost immediately, meaning victims couldn’t contact the virus writers to save their files.
That makes no sense. So much work on the software, so little work on the ‘revenue’ side — unless Petya wasn’t really about stealing money. Plenty of security experts have alighted on this theory.
Kaspersky Labs was most assertive in its analysis: it refused to call the malware ransomware, saying it was designed only to destroy data, not to raise money.
“This malware campaign was not designed as a ransomware attack for financial gain. Instead, it appears it was designed as a wiper pretending to be ransomware,” Kaspersky wrote on its SecureList.com site.
Other analysts came to much the same conclusion.
“The attackers behind the NotPetya had to know that they were making it very difficult for anyone to actually get their files back. Specifically, they provided just a single email address for victims to contact, to provide proof of payment,” said security firm SecureWorks in an email to me.
“Rather than being motivated by financial gain, these attackers created a disruptive attack masquerading as a ransomware campaign, and based on our investigation, it has been determined that (is) more likely,” SecureWorks said on its blog post about the attack. “While we recognize the possibility that this was a traditional ransomware campaign with some elements of poor execution, based on what we currently know… it is more likely that those apparent mistakes reflect elements of the campaign that were not important to the actor’s ultimate goal.”
So if the attack wasn’t about money, what was it about? Disruption, certainly. But why?
It’s dangerous to speculate on attribution because it’s so easy to leave false flags during an attack. But the virus got its start in Ukraine, and infected the most machines there, experts agree. That’s certainly fodder for speculation.
“We saw the first infections in Ukraine, where more than 12,500 machines encountered the threat. We then observed infections in another 64 countries, including Belgium, Brazil, Germany, Russia, and the United States,” wrote Microsoft in its analysis.
There’s been rampant speculation that the attack actually began with infection of tax software used in Ukraine called MEDoc. Criminals infected an automated update with the malware, which then was pushed out to unsuspecting victims, several outlets reported.
In its report, Microsoft said it had evidence that such a “supply chain attack” was indeed to blame.
“Microsoft now has evidence that a few active infections of the ransomware initially started from the legitimate MEDoc updater process,” it said.
Other circumstantial evidence suggests the attack targeted Ukraine. SecureWorks points out that the outbreak happened on the day before Ukrainian Constitution Day, which was Wednesday. It’s easy to raise the possibility that a nation-state or even rogue actors within it who are resentful of Ukrainian independence might seek to disrupt the nation on that day.
But, in the world of digital evidence, it’s hard to be conclusive about such attribution. The New York Times quoted an expert saying the I.P. address used in the attack was in Iran, who then pointed out that a hacker could have merely made it look like the attack came from Iran. This reminds me of a line from an 1980s TV comedy about a faux murder: “The killer is either a member of the family, or not a member of the family.” By now, Internet should be used to the idea that things often aren’t what they seem.
More important, the Petya attack is clear evidence that ransomware-style attacks are getting more sophisticated and more dangerous. Virus writers are learning from each other, and developing nastier payloads and better spreading mechanisms. Pay attention now. If you have escaped WannaCry and Petya, consider yourself lucky. There is a high likelihood that a future ransomware attack will attack you. There’s only one way to be ready: Back up. Make a copy of all the business files and photographs you care about and store them, physically, somewhere else.
For technologists, perhaps the biggest fear of all is the notion of the supply chain attack, raised by Microsoft recently. All computer users are now groomed to accept regular updates — ironically for security reasons — from software firms. If hackers learn to reliably infiltrate this update process, they will have found a powerful new attack vector.
Here’s a to-do list for network administrators from BeyondTrust:
- Remove administrator rights from end users
- Implement application control for only trusted applications
- Perform vulnerability assessment and install security patches promptly
- Train team members on how to identify phishing emails
- Disable application (specifically MS Office) macros
