Endpoint

10/20/2016
03:36 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

New Free Tool Stops Petya Ransomware & Rootkits

Meanwhile, Locky puts ransomware on the Check Point Top Three Global Malware List for the first time ever.

Although Check Point reported today that ransomware operators have reached a new benchmark in their malicious spree, security researchers at Cisco Talos Labs have unveiled a new way to fight back. 

For the first time ever, reports Check Point, a ransomware strain has hit its Top Three Global Malware List -- specifically the Locky ransomware, which accounted for 6% of all attacks recognized globally during September.

Meanwhile, Cisco Talos has released a new free, open-source tool -- called MBRFilter -- to fight the insidious Petya ransomware and similar malware.

F-Secure first issued an alert about Petya in April. Most ransomware works by simply encrypting files; Petya uses a much different tactic, behaving more like a rootkit. Petya overwrites the system's Master Boot Record, which forces the system to reboot. On reboot, the malware encrypts the Master File Table of the infected system's hard drive.

The process happens more quickly than other ransomware's usual file-by-file grind. It leaves little time to notice there's a problem, much less call for help. 

MBRFilter defeats Petya in a rather simple, clever way. MBRFilter is a driver that simply places the MBR into read-only mode. Therefore, ransomware like Petya cannot overwrite the MBR or otherwise modify its contents. 

"Our vulnerability research team is constantly looking for new ways to exploit devices and identify ways to better protect them," says Craig Williams, senior technical leader and global outreach manager of Talos. "This project is a natural result." 

Although MBRFilter will not help organizations solve their problems with Locky, it has wide use beyond ransomware.

"This should be effective at stopping all rootkits which require MBR modification," says Williams. 

MBRFilter is a simple disk filter based on Microsoft's diskperf and classpnp example drivers. Cisco Talos Labs researchers caution security operations teams to test MBRFilter thoroughly before deploying it to production environments, because it was deliberately designed to be difficult to remove.

Related Content:

 

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/21/2016 | 11:14:50 AM
Cut out the middle man
I suppose this proliferation only makes sense.  The bad guys are finding out that they can make more money and keep 100% of the cut by taking money directly out of their victims' pockets as opposed to fighting for scraps in the decimated spam market.
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Number of Retailers Impacted by Breaches Doubles
Ericka Chickowski, Contributing Writer, Dark Reading,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.