Monkeys beware really dangerous ransomware X 2

Discussion in 'Technical' started by sec_monkey, May 12, 2017.


  1. 3M-TA3

    3M-TA3 Cold Wet Monkey

    sec_monkey likes this.
  2. sec_monkey

    sec_monkey SM Security Administrator


    yep

    however win 7 updates have been broken for months plus plus

    v 1.0 of the Wana Decrypt0r, WannaCry, WannaCrypt0r, WannaCrypt, or WCry malware/ransomware has been stopped from spreading experts believe

    this is a temporary victory at best

    those that are infected are still infected, even if it has stopped spreading those infected still have backdoors installed on their systems

    we do not yet know if it has a reactivation switch

    versions 2.0 plus 3.0 plus 4.0 are almost certainly under development, they probably have a couple of dozen other unpatched exploits to choose from for the next attack

    the Jaff malware/ransomware which demands $3,700 plus per PC is also out there and as far as we know has not been stopped
     
    3M-TA3 likes this.
  3. 3M-TA3

    3M-TA3 Cold Wet Monkey

    One more reason to ditch Windows and IOS wherever possible for Internet connected systems. Expect future attacks to target IOS and not just Windows. If all you need is web browsing and basic office productivity then Linux will do it just as well and twice as fast.
     
    Brokor and sec_monkey like this.
  4. 3M-TA3

    3M-TA3 Cold Wet Monkey

    Yes, because Microsoft wants to force everyone to 10.
     
    Brokor and sec_monkey like this.
  5. VisuTrac

    VisuTrac Ваша мать носит военные ботинки Site Supporter+++

    I'm going to go out on a limb here. Mr. Hero might know something more about the exploit than accidentally finding the kill switch.
    Lives with his parents .. works for a threat intelligence co.
    Sounds like a prototype that escaped the sandbox.
    just musing out loud.
     
  6. Brokor

    Brokor Live Free or Cry Moderator Site Supporter+++ Founding Member

    FEAR
    the walking dead
     
    Yard Dart likes this.
  7. HK_User

    HK_User A Productive Monkey is a Happy Monkey

    [​IMG]

    [​IMG]
    [​IMG]
    [​IMG]
    [​IMG]
    FedEx Service Alerts
    [​IMG]
    FedEx Express National Service Disruption
    [​IMG]
    [​IMG]
    [​IMG]
    Saturday, May 13, 2017[​IMG]
    [​IMG]
    FedEx experienced interference with some of our systems which caused disruptions to the FedEx Express Memphis Hub sort operations. We immediately implemented contingency plans to minimize the impact to our customers. We regret any inconvenience this has caused. Consistent with the provisions of the FedEx Service Guide, the money-back guarantee is not in effect for FedEx Express packages due for delivery on May 13, 2017.
    [​IMG]
    [​IMG]
    [​IMG]
     
    Motomom34 and sec_monkey like this.
  8. sec_monkey

    sec_monkey SM Security Administrator

    more than 230,000 computers in 99 countries were infected


    Major Infections

    NHS (uk) turning away patients, unable to perform x-rays.
    Telefonica (spain)
    FedEx (us)
    University of Waterloo (us)
    Russia interior ministry & Megafon (russia)
    Сбера bank (russia)
    Shaheen Airlines (india, claimed on twitter)
    Train station in frankfurt (germany)
    Neustadt station (germany)
    the entire network of German Rail seems to be affected
    Russian Railroads (RZD), VTB russian bank
    Portugal Telecom

    plus

    Nissan UK
    Renault France
     
    Last edited: May 13, 2017
    Motomom34 likes this.
  9. 3M-TA3

    3M-TA3 Cold Wet Monkey

    Makes me wonder if the black hats who stole this from the NSA were in fact the NSA. Interesting that the release was timed to do damage in Russia and Europe but not North America. Perhaps a test that could be blamed elsewhere...

    Would the NSA really advertise it had been compromised and malware stolen? Almost like a drunk reporting his car stolen a few minutes after the crash.
     
    Tully Mars, Motomom34 and Brokor like this.
  10. Brokor

    Brokor Live Free or Cry Moderator Site Supporter+++ Founding Member

    That's the genius behind the system --there are so many vulnerabilities with executables it's not even a matter of trying to analyze the fingerprints because it truly is a veritable digital playground.
     
    Motomom34 and chelloveck like this.
  11. sec_monkey

    sec_monkey SM Security Administrator

    [respect]

    Fedex plus the University of Waterloo plus several other US entities were also hit.

    just sayin
     
    Last edited: May 14, 2017
    3M-TA3 and chelloveck like this.
  12. Tully Mars

    Tully Mars Metal weldin' monkey

    sigh, remember when the worse thing to get in your E-Mail was an offer to send ya a mil from yer friendly Nigerian??
     
    Homer Simpson, sec_monkey and 3M-TA3 like this.
  13. 3M-TA3

    3M-TA3 Cold Wet Monkey

    Was North America hit as hard as Europe or on a similar scale?
     
  14. DarkLight

    DarkLight Live Long and Prosper - On Hiatus

    No. The only North American company/facility/entity that has gone public with any kind of large impact was FedEx (that I'm aware of). If there are more they haven't been big news.
     
  15. sec_monkey

    sec_monkey SM Security Administrator

    [applaud] @stg58

    that is what trunk monkey has been saying since Friday

    this aint over by a longshot
     
  16. enloopious

    enloopious Rocket Surgeon

    This is a good thing. You are all looking at it as a bad thing but I tell you, issues like this force people to evolve and become tougher. Its like getting a cold or flu, your system either recovers or it doesn't. Evolve or die. It makes you tough.
     
    HK_User likes this.
  17. sec_monkey

    sec_monkey SM Security Administrator

    [​IMG]

    way more widespread than initially reported 150 plus countries hit

    over 300,000 PCs infected

    it could grow to 1-2mil plus

    the false flag theories do not make sense

    this map shows known infections as of last night
     
    Tully Mars and Yard Dart like this.
  18. ghrit

    ghrit Bad company Administrator Founding Member

    Are those hits not all businesses of fairly good size? Max disruption for min effort. So far as I know, there have been no private party hits; can that be confirmed?
     
    sec_monkey likes this.
  19. sec_monkey

    sec_monkey SM Security Administrator

    nope that cannot be confirmed
     
  20. VisuTrac

    VisuTrac Ваша мать носит военные ботинки Site Supporter+++

    It's going to come down to IT governance practices. While there are some small/midsized businesses that continue to run old software due to it cost, most of them tend to be more nimble than the big corps.

    Big corporations have software release cycles, test and deployment practices that delay patching machines for months if not years. That makes them vulnerable to exploits such as these.

    In a previous life we had a large NA corp with 400 franchise locations and maybe 100 corp locations and most of them were running Windows Vista (which was an upgrade from XP) about 3 years ago. I heard that they finally moved to windows 7 last year. They'd run our software in a sandbox for a year before they'd bless it and allow their locations to install it (from a corp provided DVD as opposed to downloading the service patched version). Yep corporations and governments are going to continue to shoot themselves in the head .. pretty much until they are dead.
     
    sec_monkey likes this.
survivalmonkey SSL seal        survivalmonkey.com warrant canary
17282WuJHksJ9798f34razfKbPATqTq9E7