Cyber attacks to the left, ransomware to the right

1 August 2017 Editor's Choice, Information Security, News & Events

With Petya sweeping the globe and proving that we all need to be agile and responsive to the new unknowns, here are some tips for preventing future nasties like WannaCry and Petya which are now making use of EternalBlue and related advanced exploit code.

Prevention tips

Admin privileges: The malware requires administrator rights to the local computer. Standard users should not have this in permission. Consider restricting who has local admin rights to prevent execution of exploit code within organisations. Home users should also consider using a standard user account for day-to-day operations.

No reboot on crash: Many Windows systems are configured to automatically reboot if it crashes. You can disable this feature in Windows. If you can prevent the MFT from being encrypted, you can still recover your data from your local disk.

Unlike WannaCry, Petya is a different kind of ransomware. Common delivery methods are via phishing emails or scams. The payload requires local administrator access. Once executed, the system’s master boot record (MBR) is overwritten by the custom boot loader, which loads a malicious kernel containing code that starts the encryption process.

Once the MBR has been altered, the malware will cause the system to crash. When the computer reboots, the malicious kernel is loaded, and a screen will appear showing a fake Check Disk process. This is where the malware is encrypting the Master File Table (MFT) that is found on NTFS disk partitions, commonly found in most Windows operating systems.

It is when the machine is rebooted to encrypt the MFT that the real damage is done.

Protecting your organisation

• Deploy the latest Microsoft patches, including MS17-010 which patches the SMB vulnerability.

• Consider disabling SMBv1 to prevent spreading of malware.

• Educate end-users to remain vigilant when opening attachments or clicking on links from senders they do not know.

• Ensure you have the latest updates installed for your anti-virus software.

• Ensure you have backup copies of your files stored on local disks. Generally, user files on local drives are replicated from a network share.

• Prevent users from writing data outside of designated areas on the local hard disk to prevent data loss if an attack occurs.

• Operate a least privileged access model with employees. Restrict who has local administration access.

What strategic lessons can we learn?

• We must take a step back and examine not only the “what now?” response, but also the “what next?” In other words, what does the avalanche of malware and other advanced attacks tell us?

• Our existing traditional trust models don’t work. With more critical assets moving to cloud, believing that the data centre is safer is a false philosophy.

• The idea that security practitioners can do any kind of one-time risk assessment and sign-off is flawed, and opens the door for future attacks.

• Trust and risk require continuous re-validation, and a one-time evaluation/accreditation is no longer fit for purpose.

• Adaptive systems providing advanced monitoring and analytics are key.

We need to spend more, but on what?

The BBC has reported that there are calls for a massive increase in cybersecurity spending (www.bbc.com/news/uk-scotland-scotland-politics-40341339), and it’s certainly true that many organisations have avoided spending money on cybersecurity for some years. Elsewhere, CSO online has described the impact of not having nearly enough cybersecurity professionals (www.csoonline.com/article/3201974/it-careers/cybersecurity-job-market-statistics.html). So, we need more competent, trained and enthusiastic professionals, and we need better systems that can analyse, detect and highlight threats requiring intervention.

A lot of people are throwing the ‘cyber’ word around now (and it does sound more fun that ‘IT security’, or ‘computer security’). But cyber has become a very wide term, including:

• Secure software engineers.

• Security evangelist.

• Security architects (and there’s a wealth of division on what secure architecture actually is).

• Security operations engineers.

• Incident responders.

• Penetration testers.

• Digital forensics specialists.

• Network engineers who understand security.

• Firewall engineers.

• Application testers.

• Wireless security engineers.

• Risk management experts.

• SecureDevOps.

• Security awareness.

Add to that, project managers, programme managers, administrators and the entire caboodle of corporate governance wrapping around the people at the sharp end. We know that budgets are limited (otherwise they wouldn’t be budgets) and so we need to decide what to spend our money on, and how to get the most out of our people.

Security and risk will be further discussed with local CTOs and CSOs at the Gartner Symposium/ITxpo taking place in Cape Town from 18 to 21 September (www.gartner.co.za)





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
The power of PKI and private sector innovation
Access Control & Identity Management News & Events Government and Parastatal (Industry)
At the recent ID4Africa 2025 Summit in Addis Ababa, the spotlight was firmly on building secure, inclusive, and scalable digital identity ecosystems for the African continent.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Value and industry insight
Securex South Africa Training & Education News & Events
Securex South Africa 2025, co-located with A-OSH EXPO, Facilities Management Expo, and Firexpo, drew thousands of security professionals from across the continent and beyond, offering a platform for networking, product discovery, and knowledge sharing.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Winners of the 2025 Southern Africa OSPAs
Editor's Choice
The winners of the 2025 Southern Africa Outstanding Security Performance Awards (OSPAs) were revealed on Wednesday, 4th June, at Securex South Africa. Winners from all categories (except the Lifetime Achievement) will be featured in the second Global OSPAs set to take place in 2026.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.