Tuesday 27th June saw a new cyber attack hitting the world. Not long after the WannaCry ransomware attacks that affected more than 150 countries, most famously the British NHS health service, there’s a new attack based on the same ‘EternalBlue’ exploit, thought to have been developed by the NSA and leaked by Shadow Brokers.
The new attack is known as Petya and seems to be even worse than WannaCry in that it won’t be as easy to stop. Petya takes advantage of the Server Message Block (SMB) vulnerability in Windows – which has been patched.
GNLcyber.com reports that a string of large companies have already been hit, from UK advertising company WPP, through to Russian oil producer Rosneft, and the Danish shipping giant Maersk. Multinationals in Spain are also in the firing line.
Worst hit, up to the time of writing, is the Ukraine where it is said that government departments, the central bank, an aircraft manufacturer and the Kiev airport (among other large targets) have all been paralysed by Petya.
For those who have not been affected by Petya, GNLcyber.com recommends:
• Ensure all versions of Windows on all your computers are patched up to the latest updates available. (Microsoft’s auto-update is a pain, but very useful.)
• The company also recommends disabling the outdated protocol SMBv1.
• Isolate all unpatched systems from the network.
If you feel unhappy about paying the $300 in Bitcoin that the criminals want to restore computers, update your systems and applications, and don’t open suspicious email attachments or even suspicious emails.
Of course, when paying the $300 you are relying on the word of a criminal. GNLcyber.com informed Hi-Tech Security Solutions that as of about 21:00 on Tuesday night, about 27 Petya victims had paid a total of just over $6800 in ransom, and did not get their files back. The company says this indicates the attack may be more cyber terrorism than simply for financial gain.
Nigel Tozer, solutions marketing director, Commvault, said: “The only reliable defence against the recent Petya ransomware attacks, is backup. Clearly the malicious forces behind this and other recent attacks continue to be one step ahead of threat detection software, so if your systems and data is held to ransom the only true means of recovery is to be able to revert back to data from the last backup before the infection.
“When files are encrypted and corrupted by a ransomware attack, cloud sync and share tools aren’t something you can rely on either, because the sync facility means cloud files are as infected as their originals. The other issue is that these cloud services, especially free or those targeted at consumers, typically don’t cover all of your data and may not always have retention policies that pre-date the attack.
“The best option, to insure against data-mincing malware, is an in-house centrally managed backup solution. Whilst reverting to the backup prior to the infection might mean losing a limited amount of data, it is nominal compared to the impact of losing all your data permanently.”
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version