Tag Archives: security

Tuesday’s massive ransomware outbreak was, in fact, something much worse

By Dan Goodin

Enlarge / Code in Tuesday’s attack, shown on the left, was altered to permanently destroy hard drives. (credit: Matt Suiche)

Tuesday’s massive outbreak of malware that shut down computers around the world has been almost universally blamed on ransomware, which by definition seeks to make money by unlocking data held hostage only if victims pay a hefty fee. Now, some researchers are drawing an even bleaker assessment—that the malware was a wiper with the objective of permanently destroying hard drives.

Initially, researchers said the malware was a new version of the Petya ransomware that first struck in early 2016. Later, researchers said it was a new, never-before-seen ransomware package that mimicked some of Petya’s behaviors. With more time to analyze the malware, researchers on Wednesday are highlighting some curious behavior for a piece of malware that was nearly perfect in almost all other respects: its code is so aggressive that it’s impossible for victims to recover their data.

In other words, the researchers said, the payload delivered in Tuesday’s outbreak wasn’t ransomware at all. Instead, its true objective was to permanently destroy as many hard drives as possible on infected networks, in much the way the Shamoon disk wiper left a wake of destruction in Saudi Arabia. Some researchers have said Shamoon is likely the work of developers sponsored by an as-yet unidentified country. Researchers analyzing Tuesday’s malware—alternatively dubbed PetyaWrap, NotPetya, and ExPetr—are speculating the ransom note left behind in Tuesday’s attack was, in fact, a hoax intended to capitalize on media interest sparked by last month’s massive WCry outbreak.

Read 8 remaining paragraphs | Comments

Source:: Ars Tecnica


Follow Tim on Twitter @tl1000rzx2
Or check out my other Tablet Site: THE Tablet Test Server
Or you could get your own free WordPress site for free right now, here.
Shop Our Sponsor


Shop Our Sponsor


HP Laptops at Super Low Prices!

A new ransomware outbreak similar to WCry is shutting down computers worldwide

By Dan Goodin

Enlarge / This is the note that’s left on computers infected by PetyaWrap. (credit: Eset)

A new ransomware attack similar to last month’s self-replicating WCry outbreak is sweeping the world with at least 80 large companies infected, reportedly including drug maker Merck, international shipping company Maersk, law firm DLA Piper, UK advertising firm WPP, and snack food maker Mondelez International.

PetyaWrap, as the ransomware is called, uses the same potent National Security Agency exploit that allowed WCry to paralyze hospitals, shipping companies, and train stations in a matter of hours on May 12. EternalBlue, as the exploit was code-named by its NSA developers, was published in April by a still-unknown group calling itself the Shadow Brokers. The leak gave people with only moderate technical skills a powerful vehicle for delivering virtually any kind of digital warhead. Microsoft patched the underlying vulnerability in Windows 7 and 8.1 in March, and in a rare move the company issued fixes for unsupported Windows versions 24 hours after the WCry outbreak. That meant infections were only possible on machines that were running outdated versions of the OS.

PetyaWrap, according to researchers at antivirus provider F-Secure, uses a modified version of EternalBlue. There are also reports that it makes use of booby-trapped Microsoft Excel documents attached to phishing e-mails. The precise relationship between the malicious attachments and the EternalBlue exploit isn’t yet clear. One possibility is that the e-mails are used to infect one or more computers in an organization, and the ransomware then uses the NSA exploit to spread to other machines on the same network.

Read 5 remaining paragraphs | Comments

Source:: Ars Tecnica


Follow Tim on Twitter @tl1000rzx2
Or check out my other Tablet Site: THE Tablet Test Server
Or you could get your own free WordPress site for free right now, here.
Shop Our Sponsor


Shop Our Sponsor


HP Laptops at Super Low Prices!

Microsoft bringing EMET back as a built-in part of Windows 10

By Peter Bright

Enlarge / The new security analytics dashboard. (credit: Microsoft)

The Windows 10 Fall Creators Update will include EMET-like capabilities managed through a new feature called Windows Defender Exploit Guard.

Microsoft’s EMET, the Enhanced Mitigation Experience Toolkit, was a useful tool for hardening Windows systems. It used a range of techniques—some built in to Windows, some part of EMET itself—to make exploitable security flaws harder to reliably exploit. The idea being that, even if coding bugs should occur, turning those bugs into actual security issues should be made as difficult as possible.

With Windows 10, however, EMET’s development was essentially cancelled. Although Microsoft made sure the program ran on Windows 10, the company said that EMET was superfluous on its latest operating system. Some protections formerly provided by EMET had been built into the core operating system itself, and Windows 10 offered additional protections far beyond the scope of what EMET could do.

Read 6 remaining paragraphs | Comments

Source:: Ars Tecnica


Follow Tim on Twitter @tl1000rzx2
Or check out my other Tablet Site: THE Tablet Test Server
Or you could get your own free WordPress site for free right now, here.
Shop Our Sponsor


Shop Our Sponsor


HP Laptops at Super Low Prices!

This Windows Defender bug was so gaping its PoC exploit had to be encrypted

By Dan Goodin

(credit: Microsoft)

Microsoft recently patched a critical vulnerability in its ubiquitous built-in antivirus engine. The vulnerability could have allowed attackers to execute malicious code by luring users to a booby-trapped website or attaching a booby-trapped file to an e-mail or instant message.

A targeted user who had real-time protection turned on wasn’t required to click on the booby-trapped file or take any other action other than visit the malicious website or receive the malicious e-mail or instant message. Even when real-time protection was off, malicious files would be executed shortly after a scheduled scan started. The ease was the result of the vulnerable x86 emulator not being protected by a security sandbox and being remotely accessible to attackers by design. That’s according to Tavis Ormandy, the Google Project Zero researcher who discovered the vulnerability and explained it in a report published Friday.

Ormandy said he identified the flaw almost immediately after developing a fuzzer for the Windows Defender component. Fuzzing is a software testing technique that locates bugs by subjecting an application to corrupted data and other types of malformed or otherwise unexpected input.

Read 6 remaining paragraphs | Comments

Source:: Ars Tecnica


Follow Tim on Twitter @tl1000rzx2
Or check out my other Tablet Site: THE Tablet Test Server
Or you could get your own free WordPress site for free right now, here.
Shop Our Sponsor


Shop Our Sponsor


HP Laptops at Super Low Prices!

Windows 10 Source Code Leaked, 32 TB of Win 10 Beta Builds Dumped

By Radu Iorga

A major leak has happened over at Microsoft over the past days, with the Windows 10 source code leaking online this week. Files that have to do with Microsoft’s USB, storage and WiFi drivers are now out and sources claim that 32 TB of Windows 10 beta builds have popped up online.

Such files have been posted to Beta Archive, an enthusiast site, that tracks Windows releases that accepts contributions from members. They offer in exchange a free private FTP filled with Windows builds. The 32 TB include unreleased builds, source code for driver stack and more. Even the development version of Redstone 2 has been included, or as you know it, Creators Update.

Some of the builds are meant for 64 bit ARM chips and some include private debug symbols. A “Windows 10 Mobile Adaptation Kit” has also been leaked, the one used to assemble system images for Windows on smartphones. We don’t know the source of the leaks, but it appears to come from Microsoft’s own systems. There are severe consequences to this as the publication of Windows source code may lead to hacks and attacks in the future.

In the meantime BetaArchive claims it has deleted the Share Source Kit from its server and also says that the beta builds come from a variety of sources, not just one leak. The source code alone was 1.2 GB in size and has been removed. In possibly related news, two men were just arrested in the UK after they were found trying to hack Microsoft’s network.

Both men have been collecting confidential Windows 10 builds.

The post Windows 10 Source Code Leaked, 32 TB of Win 10 Beta Builds Dumped appeared first on Tablet News.

Source:: Tablet News


Follow Tim on Twitter @tl1000rzx2
Or check out my other Tablet Site: THE Tablet Test Server
Or you could get your own free WordPress site for free right now, here.
Shop Our Sponsor


Shop Our Sponsor


HP Laptops at Super Low Prices!