HUGE 'Petya'>(Goldeneye) Cyber Attack Spreading Across World>Repeat of Wannacry Hack - DreamTeamDownloads1, FTP Help, Movies, Bollywood, Applications, etc. & Mature Sex Forum, Rapidshare, Filefactory, Freakshare, Rapidgator, Turbobit, & More MULTI Filehosts

Ladybbird · 09-06-17, 05:23

Interview With a Malware Hunter > Pieter Arntz

8 June 2017, by Malwarebytes LABs...

Ever wonder how Malwarebytes gets the latest info on new threats and how to beat them? It's our crack team of malware researchers. These cyber ninjas are responsible for gathering intel, reading between the lines of code, and rooting out the bad guys. When hunting for malware, they not only tip off our product team about new developments, but also blog about their discoveries to keep other folks safe. In our eyes, they're the unsung heroes of cybersecurity.

Unsung, that is, until now.

How did they get started in cybersecurity? Why do they do what they do? What advice do they have for newbies wanting to break into the field?

Our first interview is with one of our OG researchers and bloggers, Pieter Arntz, who's been helping Malwarebytes whoop malware tail for nearly eight years.
END...

NB: From Ladybbird Members..

Ransomworm Spread Across the NET, because so many did NOT READ OUR WARNINGS in our Thread LAST YEAR....It will continue to grow..

ONLY REGISTERED MEMBERS can now read this ANNOUNCEMENT & Advice

BUT...

How the heck did Malwarebytes miss those horrendous attacks that affected MANY Countries/Servers & Sites, which included not only DREAMTEAMDOWNLOADS1.. > BUT many sites thereafter..> Even Google & Social Media Continue to be SLOWER these days....

Do NOT be fooled into buying any OFFERs to solve it..

Simply look after ALL computers/APPs Yourselves..

+ That is why DREAMTEAMDOWNLOADS1.. has not been able to UPDATE our various Sections > NOR, respond to the many pms we receive..

We and our Volunteer Staff/Admins... PLUS Our Server are a little busy, 'Behind the Scenes' to protect ourselves and our Members..

.

Ladybbird · 28-06-17, 17:00

HUGE 'Petya' > ('Goldeneye') Cyber Attack Spreading Across the World in Potential Repeat of 'Wannacry' Hack

Cyber Attack Hits CHERNOBYL Radiation System: 'Goldeneye' Ransomware Strikes Across The Globe, with US Drug Firm Merck, Advertising Giants WPP and Ukrainian Power Grid Among Victims

New ransomware attack hit computers around the globe on Tuesday
Ukraine is worst hit so far, with Chernobyl radiation monitoring system affected
Country's deputy leader said all computers are down in 'unprecedented' attack
Companies in UK, US, France, Norway, Denmark have also confirmed issues
IT experts dubbed new virus GoldenEye and say it is similar to 'WannaCry'

Daily Mail/AP, 28 June 2017

Hackers have unleashed a major cyber attack causing huge disruption to companies and governments across the globe including in the UK, US and Russia.

The Petya ransomware hijacks victims' computers before encrypting their files and holding them hostage until a fee is paid.

Chernobyl's radiation monitoring system has been hit by the attack with its sensors shut down while UK advertising giant WPP, the largest agency in the world, among dozens of firms affected.

The ransomware appears to have been spread through popular accounting software and specifically targeted at bringing down business IT systems.

The outage began in Ukraine as the country's power grid, airport, national bank and communications firms were first to report problems, before it spread rapidly throughout Europe.

Companies in the US, Germany, Norway, Russia, Denmark and France are among those to have confirmed issues so far.

The Ukrainian government appears to be among the worst hit by a new ransomware virus that struck across Europe on Tuesday (pictured, a supermarket in Kharkov)

Users are being shown a message saying their data has been encrypted, with some asking for £300 in anonymous currency Bitcoin to retrieve it (pictured, an ATM in Ukraine)

It comes just weeks after the WannaCry attack which paralysed the NHS and left hundreds of thousands of users around the world unable to access their data.

More than 200,000 victims in 150 countries were infected by that software, which originated in the UK and Spain last month, before spreading globally.

But cyber security experts have warned that this time the virus is much more dangerous because it has no 'kill switch' and is designed to spread rapidly though networks.

Marcus Hutchins, who foiled the previous WannaCry attack by discovering a way to stop it from infecting new computers, told MailOnline that even if users pay the fee their files could now be lost forever.

Rozenko Pavlo, the Ukrainian deputy Prime Minister, tweeted this image of his computer screen - saying 'all computers of the government' had been affected

He said: 'The company that hosts the email account which the ransomware asks you to contact has closed the account. There's no way to get files back.
'It's early days - we don't know if we can find a fix yet. But if it's decryptable we will find a way.'

Hutchins, 22, continued: 'Everyone's looking at this right now and I'm working with other researchers.
'I was just praying it wasn't the Wannacry exploit again. Ideally we'll have to find a way to decrypt the files or else people are not going to get them back.'

The ransomware targets computers using the Windows XP operating system which have not installed the latest security updates released by Microsoft.

Marcus Hutchins, from UK, pictured, foiled the previous WannaCry attack by discovering a way to stop it from infecting new computers

Experts fear that could mean major infrastructure such as healthcare systems and power networks using archaic technology will be the worst affected.

One security researcher going by the name BleepingComputer told MailOnline that x-ray machines and other critical medical devices could be deactivated in hospitals, adding: 'We're going to see wide-scale damage.'
He continued: 'The biggest computers that may have an issue are those running old legacy hardware or software systems such as healthcare and control systems for industrial services.

Quote:

What is GoldenEye?

IT experts have dubbed the new virus GoldenEye, and say it appears to be a more-potent version of ransomware that started circulating recently.
GoldenEye is in turn a variant of even older code called Petya, which scrambles files on computer's hard drive, requiring a code to unlock it.

Petya is particularly effective because, rather than scrambling files one by one, it blocks access to a whole hard drive in one go, analyst hasherezadewrote previously.

Another analyst, Bogdan Botezatu, said that GoldenEye is a 'worm'-type virus, spreading from machine to machine automatically, with no need for human interaction.

'It's like somebody sneezing into a train full of people,' said Botezatu. 'You just have to exist there and you're vulnerable.'

Others said GoldenEye appears to be exploiting the same Windows weakness used by WannaCry in order to spread itself rapidly.

.

Things like that that are running on archaic operating systems simply because they don't have the ability to upgrade.

'There was a power plant infected by this which is really scary because those are the most vulnerable types of systems.'

Russia's Rosneft oil company and steel firm Evraz, Danish shipping giant A.P. Moller-Maersk, and global law firm DLA Piper confirmed issues, along with French industrial group Saint-Gobain.

Radiation checks at the Chernobyl nuclear disaster site in Ukraine were being carried out manually after the wave of cyber attacks.
A spokesman said:

'Due to the temporary disconnection of Windows systems, radiation monitoring of the industrial site is being carried out manually.'

Rozenko Pavlo, Ukraine's deputy Prime Minister, posted an image of his locked computer, saying 'all computers of the government' had fallen victim to the virus.

An image he uploaded shows a black screen covered in white text which warns that 'one of your disks contains errors and needs to be repaired'.
The screen also warns not to turn the computer off otherwise all data will be lost.
He called the attack 'unprecedented', though said vital services would not be affected.

Another screen with red text warns that files on the computer have been encrypted and will only be released if a payment of £300 in anonymous online currency Bitcoin is made.

Oleksandr Turchynov, head of Ukraine's national security council, immediately pointed the finger at Moscow, saying:

'Already on first analysis it is possible to talk of Russian fingerprints.'

Anders Rosendahl, a spokesman for Copenhagen-based AP Moller-Maersk, said:

'We are talking about a cyberattack.'
'It has affected all branches of our business, at home and abroad.'

WPP, the world's largest advertising firm based in London, confirmed that it had also fallen victim to the new virus

Anders Rosendahl, a spokesman for Copenhagen-based AP Moller-Maersk, said: 'We are talking about a cyberattack'

There's very little information about who might be behind the disruption, but technology experts who examined screenshots circulating on social media said it bears the hallmarks of ransomware.

Cyber security expert Daniel Gallagher told MailOnline:

'We are still in the early stages of determining the scope of impact, though there are indications that it is rapidly spreading.
'I think we will see a different kind of impact, since Wannacry had the side effect of forcing a lot of locations to patch their computers.

'The areas we will likely see impacted could be some of the worst though.
'They will be the locations that for some reason or another could not afford to patch in a timely manner.

The virus is similar in nature to the 'WannaCry' bug that hit computers around the world last month, and is thought to have originated in North Korea

'Places that may have industrial controls or other critical infrastructure that can't easily be taken offline to upgrade.'

Such viruses hold data to ransom, scrambling it until a payment is made, usually requesting virtual currency Bitcoin because it cannot be traced to a user.

The world is still recovering from a previous outbreak of ransomware, called WannaCry or WannaCrypt, which spread rapidly using digital break-in tools originally created by the U.S. National Security Agency and recently leaked to the web.

While experts cannot definitively say where that attack originated, information hidden in the code used to run in pointed to the involvement of North Korea.

Quote:

WannaCry: The Previous Cyber Attack that Crippled the World

What is ransomware?

Ransomware is a type of malicious software that criminals use to attack computer systems.

Hackers often demand the victim to pay ransom money to access their files or remove harmful programs.

The aggressive attacks dupe users into clicking on a fake link – whether it's in an email or on a fake website, causing an infection to corrupt the computer.

In some instances, adverts for pornographic website will repeatedly appear on your screen, while in others, a pop-up will state that a piece of your data will be destroyed if you don't pay.

In the case of the NHS attack, the ransomware used was called Wanna Decryptor or 'WannaCry' Virus.

What was the WannaCry virus?

The WannaCry virus targets Microsoft's widely used Windows operating system.

The virus encrypts certain files on the computer and then blackmails the user for money in exchange for the access to the files.

It leaves the user with only two files: Instructions on what to do next and the Wanna Decryptor program itself.

When opened the software tells users that their files have been encrypted and gives them a few days to pay up or their files will be deleted.

It can quickly spread through an entire network of computers in a business or hospital, encrypting files on every PC.

How to protect yourself from ransomware

Thankfully, there are ways to avoid ransomware attacks, and Norton Antivirus has compiled a list of prevention methods:

1. Use reputable antivirus software and a firewall
2. Back up your computer often
3. Set up a popup blocker
4. Be cautious about clicking links inside emails or on suspicious websites
5. If you do receive a ransom note, disconnect from the Internet
6. Alert authorities

.

Britain's National Cyber Security Centre blamed the attack on the Lazarus Group, a gang of hackers in the employ of Kim Jong-un's regime.
Pieces of code used in the WannaCry virus were identical to those used in previous attacks by the Lazarus Group, such as the Sony Pictures hack, analysts said.
Time stamps contained within the code also seemed to suggest it originated in North Korea's timezone.
However, it is possible that another, as-yet unidentified group was able to get hold of the code behind previous North Korea hacks, copied it, and is now using it for its own nefarious purposes.

Quote:

How Attackers are Holding the World to Ransom

Rosneft

Russia's top oil producer said its servers had been hit been a large-scale cyber attack but its oil production was unaffected.

Maersk

The Danish shipping giant, which handles one out of seven containers shipped globally, said a cyber attack had caused outages at its computer systems across the world.
Maersk's port operator APM Terminals was also hit. 17 shipping container terminals run by APM Terminals had been hacked, including two in Rotterdam and 15 in other parts of the world. Staff at the firm's Maidenhead office were sent home this afternoon.

WPP

The world's biggest advertising company - which is based in Britain - said computer systems within several of its agencies had been hit by a suspected cyber attack.

Merck

The pharmaceutical company said in a tweet its computer network was compromised as part of a global hack.

Russian banks

Russia's central bank said there had been 'computer attacks' on Russian banks and that in isolated cases their IT systems had been infected.
All Russian branches of the Home Credit consumer lender are closed because of a cyber attack, an employee of a Home Credit call centre in Russia said.

Ukrainian banks and power grid

A number of Ukrainian banks and companies, including the state power distributor, were hit by a cyber attack that disrupted some operations, a spokesman said.

Ukraine's international airport

Yevhen Dykhne, director of the capital's Boryspil Airport, said it had been hit. 'In connection with the irregular situation, some flight delays are possible,' Dykhne said in a post on Facebook.

Saint Gobain
The French construction materials company said it had been a victim of a cyber attack and it had isolated its computer systems to protect data.

Deutsche Post

The German postal and logistics company said systems of its Express division in the Ukraine have in part been affected by a cyber attack.

Metro

The German firm said its wholesale stores in the Ukraine had been hit by a cyber attack and the retailer was assessing the impact.

Mondelez International

The food company said employees in different regions were experiencing technical problems but it was unclear whether this was due to a cyber attack.

Evraz

The Russian steelmaker said its information systems had been hit by a cyber attack but its output was not affected.

Norway

A ransomware cyber attack is taking place in Norway and is affecting an unnamed international company, the Nordic country's national security authority said.

.
Quick Behavioural Analysis of Petya / Petrwrap Ransomware

09-06-17, 05:23	#1
Ladybbird Join Date: Feb 2011 Posts: 47,628 Thanks: 27,642 Thanked 14,458 Times in 10,262 Posts Awards Showcase Total Awards: 8	Interview With a Malware Hunter + Advice From Dreamteamdownloads1 Interview With a Malware Hunter > Pieter Arntz 8 June 2017, by Malwarebytes LABs... Ever wonder how Malwarebytes gets the latest info on new threats and how to beat them? It's our crack team of malware researchers. These cyber ninjas are responsible for gathering intel, reading between the lines of code, and rooting out the bad guys. When hunting for malware, they not only tip off our product team about new developments, but also blog about their discoveries to keep other folks safe. In our eyes, they're the unsung heroes of cybersecurity. Unsung, that is, until now. How did they get started in cybersecurity? Why do they do what they do? What advice do they have for newbies wanting to break into the field? Our first interview is with one of our OG researchers and bloggers, Pieter Arntz, who's been helping Malwarebytes whoop malware tail for nearly eight years. END... NB: From Ladybbird Members.. Ransomworm Spread Across the NET, because so many did NOT READ OUR WARNINGS in our Thread LAST YEAR....It will continue to grow.. ONLY REGISTERED MEMBERS can now read this ANNOUNCEMENT & Advice BUT... How the heck did Malwarebytes miss those horrendous attacks that affected MANY Countries/Servers & Sites, which included not only DREAMTEAMDOWNLOADS1.. > BUT many sites thereafter..> Even Google & Social Media Continue to be SLOWER these days.... Do NOT be fooled into buying any OFFERs to solve it.. Simply look after ALL computers/APPs Yourselves.. + That is why DREAMTEAMDOWNLOADS1.. has not been able to UPDATE our various Sections > NOR, respond to the many pms we receive.. We and our Volunteer Staff/Admins... PLUS Our Server are a little busy, 'Behind the Scenes' to protect ourselves and our Members.. . __________________ PUTIN TRUMP & Netanyahu Will Meet in HELL ..................*SHARKS are Closing in on TRUMP*.......................... *TRUMP WARNS; 'There'll Be a Bloodbath* If I Don't Get Elected'..MAGA - MyAssGotArrested...IT's COMING** PLEASE HELP THIS SITE..Click DONATE & Thanks to ALL Members of ... 1.. THIS SITE IS MORE THAN JUST WAREZ...& TO STOP SPAM-IF YOU WANT TO POST, YOUR FIRST POST MUST BE IN WELCOMES

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)