Why Africans should be worried about PETYA 0 213

  • The malicious software has been identified as a modified version of a previously known ransomware, called Petya or Petrwrap, that has been substantially altered.
  • Due to its unique characteristics, it has been dubbed as NotPetya and ExPetya, which is currently detected by ESET as Win32/Diskcoder.C Trojan.
  • NotPetya can be termed as a worm, which can self-replicate across multiple networks. Petya uses two primary methods to spread across networks. Execution across network shares and SMB exploits
  • The current global ransomware trend utilises the EternalBlue Exploit in order to take advantage of the vast use of the Windows Operating System.
  • More than 80% of enterprise servers and endpoints in the African Digital Economy run on the Windows Operating System.
africans-worried-petya

It all begins with the MS17-010 Exploit

The EternalBlue Exploit, otherwise known as MS17-010, developed by the NSA and pilfered by the Shadow Brokers continues to open opportunities for malicious malware authors as fresh ransomware attacks continue to ravage Europe while spreading through the globe at an alarming pace.

Notably, it has become evident that in the realm of cybersecurity, the adage of once bitten, twice shy, seldom applies as unpatched computer systems have been utilised for a second time by cybercriminals to achieve exponential infection rates, reminiscent of the WannaCry nightmare that the globe experienced only two months ago.

NotPetya

The malicious software has been identified as a modified version of a previously known ransomware, called Petya or Petrwrap, that has been substantially altered, prompting a debate among researchers over whether it is new malware.

Due to its unique characteristics, it has been dubbed as NotPetya and ExPetya, which is currently detected by ESET as Win32/Diskcoder.C Trojan. If it successfully infects the MBR (Master Boot Record), it will encrypt the whole drive itself. Otherwise, it encrypts all files, like Mischa.

How does NotPetya replicate?

In many ways, NotPetya can be termed as a worm, which can self-replicate across multiple networks. Petya uses two primary methods to spread across networks. These include:

  • Execution across network shares: It attempts to spread to the target computers by copying itself to [COMPUTER NAME]\\admin$ using the acquired credentials. It is then executed remotely using either PsExec or the Windows Management Instrumentation Command-line (WMIC) tool. Both are legitimate tools.
  • SMB exploits: It attempts to spread using variations of the EternalBlue and EternalRomance exploits.

Crucially, NotPetya seeks to gain administrator access on a machine and then leverages that power to commandeer other computers on the network: it takes advantage of the fact that far too many organizations employ flat networks in which an administrator on one endpoint can control other machines, or sniff domain admin credentials present in memory, until total control over the Windows network is achieved. It achieves primary access through using phishing techniques to trick administrators into running the malware with high privileges.

What institutions have been adversely affected?

africans-worried-petya

The most severe damage is being reported by Ukrainian businesses, with systems compromised at Ukraine’s central bank, state telecom, municipal metro, and Kiev’s Boryspil Airport. Systems were also compromised at Ukraine’s Ukrenego electricity supplier, although a spokesperson said the power supply was unaffected by the attack. The attack has even affected operations at the Chernobyl nuclear power plant, which has switched to manual radiation monitoring as a result of the attack.

Infections have also been reported in more isolated devices like point-of-sale terminals and ATMs. The virus has also spread internationally. The Danish shipping company Maersk has also reported systems down across multiple sites, including the company’s Russian logistics arm Damco.

The virus also reached servers for the Russian oil company Rosneft, although it’s unclear how much damage was incurred. There have also been several recorded cases in the United States, including the pharmaceutical company Merck, a Pittsburgh-area hospital, and the US offices of law firm DLA Piper.

The attacks have been indiscriminate across every vulnerable vertical as institution after institution falls short against the unique threat posed by NotPetya.

Why Africans should be concerned about the current global ransomware trend

The current global ransomware trend, of utilising the EternalBlue Exploit in order to take advantage of the vast use of the Windows Operating System should send chills down the spines of any executive worth his salt in the African Digital Market for the following reasons.

Firstly, more than 80% of enterprise servers and endpoints in the African Digital Economy run on the Windows Operating System, thus exposing majority of our organisations to the next-generational strains of ransomware being designed by savvy malware authors. Moreover, a significant percentage of these Windows systems are run on legacy platforms such as XP and Windows Vista which exponentially increase the probability that these systems are probably unpatched.

Secondly, there is an astounding number of citizens who are unaware of the cybersecurity risks present within their daily lives. Kenya, serves as a key example to the plight of the African digital economy. With an 85.3% internet penetration rate, Kenya boasts a wealth of 37.7m netizens, actively contributing to their digital ecosystem.

Moreover, due to the proliferation of mobile banking, internet banking continues to rise within the region. However, contrary to logical perception, about 90% of Kenya’s netizens remain unaware of the increased cyber risks within their digital market. This poses a unique and advanced risk as ransomware’s primary source of entry is through A

In conclusion, new strains of ransomware seem to tactically replicate across networks utilising unpatched Windows systems and untrained company personnel through phishing e-mails to wreak havoc across targeted networks. The African Digital Economy is especially vulnerable to these risks as they exploit our unique weaknesses.

Our recommendations:

  1. Invest in new-school cybersecurity awareness training.
  2. Deploy reputable endpoint protection.
  3. Strengthen your business continuity capabilities.
  4. Evaluate and Patch Installed Software.
  5. Monitor access rights.
Previous ArticleNext Article

Security trends to look out for in 2018 0 247

After a turbulent 2017 with Cyber Security making regular headlines, looking ahead to the coming year, there will no doubt be further discussions about the threat landscape.

Ransomware Revolution  – Ransomware of Things

Technological advances and their accelerated use have led to a number of scenarios considered unlikely just few years prior, are now within the realm of possibility. The advice going into 2018 from ESET researchers is to back up everything that matters to you, often, by keeping at least some backups offline – to media that aren’t routinely exposed to corruption by ransomware and other malware – in a physically secure location. As the Internet of Unnecessarily Networked Things becomes less avoidable, the attack surface increases, with networked devices and sensors embedded into unexpected items and contexts: from routers to fridges to smart meters, from TVs to toys, from power stations to petrol stations and pacemakers. As everything gets ‘smarter’, the number of services that might be disrupted by malware becomes greater.

Criminals following the money

With data being the most valuable asset, ransomware is set to remain in great demand among cybercriminals. It is important to note that many ransomware attacks are not sophisticated enough or never intended to recover the victim’s data once the ransom has been paid. For these reasons we suggest not only backing up of data online and offline but also implementing proper security measures such as proactively training staff on what phishing emails entail and how to avoid clicking on them and entering any credentials.

Critical infrastructure attacks on the rise

Cyber attacks on the Ukrainian power companies resulted in electricity service being turned off in hundreds of thousands of homes. The implications of this for future attacks of this kind include more than just the power grid but also includes critical manufacturing and food production, water and transport and the defence and healthcare sectors.

Safer for all

This year has seen ESET’s malware analysts continue to help law enforcement crack down on malicious campaigns and, by extension, the criminals spewing them. We are confident that 2018 will bring further successful investigations as we will continue to lend a hand to authorities so that, ultimately, the internet can become a safer place for everyone – except cybercriminals.

Download the full Security Trends 2018 report here

ESET’s top 5 tips for safe online shopping this festive season 0 288

safe online shopping

Holiday shopping is so quick and easy to do online, no traffic to get to the store, no waiting in queues or travelling to one specific shop just to find out – oh no, they’re out of stock of the one item you went there for.

We want to make sure your holiday shopping experience is quick, easy and most of all safe. Here are our top 5 tips for safe shopping this festive season:

  1. Don’t have the same passwords for all online shopping sites, have strong passwords and for extra security, change them before the holiday shopping commences.
  2. Only shop on trusted sites and directly from vendors.
  3. Don’t click on links from emails, instead go straight to the site on your browser.
  4.  When shopping online use a secure internet connection such as your home WiFi and make sure the necessary firewalls are in place – Avoid online payments via public WiFi.
  5. This coupled with a strong antivirus and/or anti-spyware software for scanning email, applications, and data that resides on your computer, you can rest assured that only you will catch or detect any form of intrusion in good time.

To find out how ESET can help secure your online shopping experience visit our website or contact us at sales@esetafrica.com