» » » WannaCry XXL? 2nd even bigger global cyber attack already underway

A+ A-
    A US official on Tuesday put the number of computers infected by WannaCry at over 300,000.

The Shadow Brokers hacking group is responsible for the release of the National Security Agency’s (NSA) hacking exploits which highlighted a Windows vulnerability used by hackers in the recent WannaCry global ransomware attack.

The worm, known variously as WannaCry, WanaCryptor, and WannaCrypt, targets computers running Microsoft operating systems. It is built on an exploit named EternalBlue, one of many NSA “cyber-weapons” released by a group known as the Shadow Brokers, who first started leaking NSA tools late last summer. 

It isn’t clear where the Shadow Brokers got the NSA hacking tools, but the arrest of former NSA contractor Harold T. Martin III last August for stealing a massive amount of data has made him the most likely suspect.

Former NSA officials have claimed the Shadow Brokers’ tools are “identical” to those taken by Martin, reports The Washington Post.
The US government said it seized 50 terabytes of confidential data from Martin’s home which was stolen from the NSA and other intelligence agencies. A veteran contractor, Martin had access to classified information as part of his work in the intelligence-gathering division of the NSA named Tailored Access Operations.
He has been in custody since his arrest and is facing espionage charges. Another NSA employee was also arrested in 2015, but no information has been released about the individual.

The EternalBlue code formed the basis of the WannaCry ransomware, which struck networks on Friday in one of the biggest cyberattacks ever recorded
The EternalBlue code formed the basis of the WannaCry ransomware, which struck networks on Friday in one of the biggest cyberattacks ever recorded

It spread without exploiting user interactions.
Unlike phishing or spearphishing attacks, where a computer is compromised because a user clicks a link in a targeted email, WannaCry works without exploiting any human error.

Kaspersky Lab, a well-known cybersecurity company, wrote in a richly detailed FAQ about the attack that “Perhaps the main reason why Wannacry was so successful is the fact that the EternalBlue exploit works over the Internet without requiring any user interaction." Because it strikes over networks, it can still wreak havoc inside a local network even with the killswitch active, as the killswitch needs the internet to work.

Kaspersky recommendations:
  • Install the MS Security Bulletin patches for MS17-010. Please note that Microsoft also released an emergency patch for Windows XP, which is out of support!
  • Disable SMBv1.
  • Backup your data on a regular basis and be sure to store the backups offline.
  • Limit administrative privileges in the network.
  • Segment your network.
  • Make sure all nodes have security software installed and updated.
  • Kaspersky users: make sure System Watcher is enabled and the software updated. System watcher will ensure rollback of any encrypted files.
  • For those who do not use Kaspersky Lab solutions, we suggest installing the free Kaspersky Anti-Ransomware Tool for business (KART).
  • WannaCry is also targeting embedded systems. We recommend ensuring that dedicated security solutions for embedded systems are installed, and that they have both anti-malware protection and Default Deny functionality enabled.

An Evil Lair?
Unlikely the attackers will be able to do anything with the bitcoins. Even though the wallet owners are anonymous, the transactions are visible to everybody and can be tracked. Once the bitcoins reach a payment point, where the attackers use them to purchase something in the real world, that payment can be tracked to shipment details, services, or other IPs, effectively, increasing the chances of getting caught.

Adylkuzz cyberattack dwarfs WannaCry

As the world reels from the WannaCry ransomware attack, it’s now emerged that a second, potentially larger attack, is already under way. It seems the widespread proliferation of military-grade cyberweapons has ushered in a new era of digital crime.

Cyber bandits have again deployed both the EternalBlue and DoublePulsar exploits developed and used by the NSA which were released by the ShadowBrokers hackers back in April.

“Initial statistics suggest that this attack may be larger in scale than WannaCry, affecting hundreds of thousands of PCs and servers worldwide: because this attack shuts down SMB networking to prevent further infections with other malware (including the WannaCry worm) via that same vulnerability, it may have in fact limited the spread of last week's WannaCry infection,” wrote a security researcher who goes by the alias Kafeine at cybersecurity company Proofpoint.

This latest attack uses the two exploits to install the cryptocurrency miner Adylkuzz over corporate Local Area and wireless networks but, rather curiously, may actually have helped slow the spread of WannaCry.

 However, in an apparent case of “picking your poison,” the Adylkuzz miner dramatically slows PC and server performance as it extracts cryptocurrency but it does not lock users out of their machines and data, as WannaCry did.

Researchers at Proofpoint estimate that the Adylkuzz attack may have begun as early as April 24 but was subsequently overshadowed in the hysteria that followed the WannaCry ransomware attacks.
The attack is launched from multiple virtual private servers which scour the internet for vulnerabilities to install the Adylkuzz miner.


Adylkuzz is believed to have infected more computers than WannaCry, using the same vulnerabilities
Adylkuzz is believed to have infected more computers than
WannaCry, using the same vulnerabilities.

The malware infection occurs as follows:
The EternalBlue exploit opens the door for infection with DoublePulsar on a target machine. DoublePulsar then downloads and runs Adylkuzz on the computer.
Adylkuzz then stops any preexisting versions of itself on a target machine, while also blocking SMB network communications with other machines to prevent any further malware infections from disrupting its operations. It initially prevents cybersecurity professionals from identifying that there is a problem.
Once the door has been held open and detection risks have been minimized, Adylkuzz then downloads mining instructions, the cryptocurrency miner itself and a variety of cleanup tools to mask its activities.
While the term cryptocurrency is typically associated with Bitcoin, Adylkuzz actually mines Monero, a similar but more heavily encrypted digital currency. Monero recently saw a significant uptick in usage after it was adopted in the AlphaBay market on the Dark Web.
As with other cryptocurrencies, Monero expands in market cap through self-proliferation via digital mining. One monero is roughly equivalent to $27 at current exchange rates.
During its research, Proofpoint identified three addresses which had already generated $7,000, $14,000 and $22,000 respectively, before being shut down.

To cover their tracks, whoever is behind the attack regularly changes the online payment address to avoid attracting too much attention.
As in the case of the WannaCry attack, hackers have leveraged the NSA’s weaponized exploits of legacy Microsoft operating systems to infect hundreds of thousands of machines worldwide with malware. Since the Shadow Brokers’ leak of these NSA exploits there have been two high profile attacks with many more expected in the future.

Labels: ,

Share to:

Facebook Like Facebook Share Pinterest Bookmark and Share

Post a Comment Blogger Disqus

Subscribe to: Post Comments (Atom)
 
 
Errymath © 2016
Powered by Blogger
Top