+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: [World] Petya Ransomware Spreads Rapidly Worldwide (/showthread.php?tid=5656858)
Pages: Pages
1
2
* - User1999 - Jun 27, 2017
(Jun 27, 2017 11:27 AM)jawsh33 Wrote: Yeah, I was so confused as to why they were using a posteo email adress haha.
So, they're just fucking stupid or what? RIP, this ransomware is fucking retarded.
I never even heard of posteo before this. Are they like a gmail for Germany?
Either way the results of this could be much more horrific than wannacry due to the fact no one now can decrypt their files. A huge shipping company and good amount of atms have been hit.
This is like a situation where do you let the email stay on your service to give people the ability to decrypt their files or not?
* - DigitalHighAss - Jun 28, 2017
(Jun 27, 2017 11:56 AM)User1999 Wrote: This is like a situation where do you let the email stay on your service to give people the ability to decrypt their files or not?
Allowing the attackers to keep that email will only encourage others to use that service again. Its a smart move to block them. In all reality there is no proof that paying the ransom would do anything either. They could just take the money and run. I just looked up the bitcoin address and they have about $10,000 so far. No money moved out of that address.
* - Xphile - Jun 28, 2017
(Jun 28, 2017 06:57 AM)DigitalHighAss Wrote: Allowing the attackers to keep that email will only encourage others to use that service again. Its a smart move to block them. In all reality there is no proof that paying the ransom would do anything either. They could just take the money and run. I just looked up the bitcoin address and they have about $10,000 so far. No money moved out of that address.
They appear to be getting some rather funny transactions though:
![[Image: EAZorrZNRCCcstXi6PRJZQ.png]](https://image.prntscr.com/image/EAZorrZNRCCcstXi6PRJZQ.png)
* - gdz$ - Jun 28, 2017
Jesus christ, not like this
* - jamdoughnut - Jun 28, 2017
This is a bit of a strange one to be fair. Did you see the kill-switch? Seems a little simplistic in design. Word of the twitter verse is that it started off with a poisoned update to a financial software company (me-doc). Thing is the update came out like the day before it all kicked off. Either that's some next level development or that update was really poorly written.
Either way super interesting.
(Jun 27, 2017 11:20 AM)User1999 Wrote: All those people that paid won't be getting their files back either. The company that the email is associated with shut down the email.
https://posteo.de/blog/info-zur-ransomware-petrwrappetya-betroffenes-postfach-bereits-seit-mittag-gesperrt
Google translate shows
At noon today we learned that Ransomware blackmail is currently providing a posteo address as a contact option.
Our abuse team checked this immediately - and the mailbox immediately blocked. We do not tolerate any misuse of our platform: The intermittent blocking of abused mailboxes is a normal procedure of providers in such cases. At the time of the blocking, there was no reporting on the Ransomware.
https://mobile.twitter.com/GossiTheDog/status/879745509015072769
The fact that the mail provider locked the entire account, denying them access to user decryption requests... Bit of a dick move really.
* - dismayed - Jun 28, 2017
Here is the Malware analyst if anyone wants to look at it
https://malwr.com/analysis/N2EwM2RjY2RkMDQwNDQwNjg2ZjM1OTNhOTY1YWE5NDA/
* - n31ght0 - Jun 29, 2017
So they just spreading by email? if so it's very easy to avoid this stuff. no worries even i use win 7
* - thesharp - Jun 29, 2017
This is only the start I'm afraid they'll be a lot more to come with more zero day releases from shadow brokers premium customers.
* - Numinous - Jun 29, 2017
You can prevent your system from Petya ransomware - https://goo.gl/A9QKmW (With 3 Methods)
* - veeeeeeee4 - Jun 29, 2017
This is cool, lets all use a type riter.
* - henixzer - Jun 29, 2017
So, does any one know from where(are they getting through shady downloads?) these people are getting infected by petya and wannacry?
* - AmericanExpress - Jun 29, 2017
(Jun 29, 2017 04:49 PM)henixzer Wrote: So, does any one know from where(are they getting through shady downloads?) these people are getting infected by petya and wannacry?Malware authors tend to spread malicious software through e-mails, download websites, drive-by-downloads/exploits, etc. It pretty much evolves around user-interaction of some sort for someone to become infected and the attacker attempting to social engineer the victim is a big part to play in people becoming infected (increases chances of the victim allowing a UAC alert or even downloading and running the attachment in the first place).
If people were careful about how they behave online (e.g. while handling downloads and dealing with e-mails from untrusted senders) then there would be a let loss infections world-wide.
It doesn't take much for someone to stay clean without any Anti-Virus protection just by thinking before they do things.
* - Xphile - Jun 30, 2017
(Jun 29, 2017 04:49 PM)henixzer Wrote: So, does any one know from where(are they getting through shady downloads?) these people are getting infected by petya and wannacry?
They both exploit the SMBv1 flaw that made DoublePulsar (the NSA tool leaked by the Shadow Brokers) so dangerous. After the Ransomware creates a foothold on one unpatched server, it will spread across the local network via PSEXEC and WMIC.
Basically, unpatched web-facing servers are the main cause of infections here.
Hope this helped. 🤝
* - MeanGene69 - Jun 30, 2017
Petya was pushed out through hijacked software updates via M.E. Docs which is an accounting software most prevalent in Ukraine.
I would suspect this is not the first time the company's servers have pushed out malware. Can anyone source this?
* - Cacao - Jul 1, 2017
would be interesting to see what happens next