Attacks/Breaches

6/28/2017
12:15 PM
100%
0%

Researchers Find 'Vaccine' for Global Ransomware Attack

A vaccine, not a killswitch, has been discovered to prevent the Petya/NotPetya ransomware from infecting machines.

Researchers have yet to discover a killswitch that would prevent the spread of this week's massive ransomware outbreak, but one has found a "vaccine" that can halt the spread of the attack, reports BleepingComputer.

The rapidly spreading ransomware hit businesses, including those in critical infrastructure, across Russia, Ukraine, France, Netherlands, Spain, India, and Denmark. Some experts found similarities with the Petya malware, including its encryption of the Master Boot Record (MBR) on infected systems. Others say this malware hasn't been previously seen and call it NotPetya.

Amit Serper, a security researcher with Cybereason, discovered the ransomware operates by searching for a local file, and will exit the encryption process if the file already existed on the disk. Victims can block the ransomware from executing by creating this file on their machines.

To implement the vaccination, create a file called "perfc" in the "C:\Windows" folder and set it to read-only. Researchers call this a vaccination, not a killswitch, because it only vaccinates the machine where it's stored. A killswitch could be turned on to prevent all incidents of this ransomware.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
6/28/2017 | 12:25:27 PM
Nifty
Wow, this is nifty. Discovering the trigger and inserting it before the malware creates it maliciously is quite smart. What isn't smart however on the end of the creators of the malware is creating a check predicated on only one file.
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12630
PUBLISHED: 2018-06-21
NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI.
CVE-2018-12631
PUBLISHED: 2018-06-21
Redatam7 (formerly Redatam WebServer) allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/text?LFN=../ directory traversal.
CVE-2018-12632
PUBLISHED: 2018-06-21
Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/text URI.
CVE-2018-12581
PUBLISHED: 2018-06-21
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
CVE-2018-12613
PUBLISHED: 2018-06-21
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attack...