Nasty Ransomware Overwrites Your PC’s Master Boot Record — Distributed As Emails Masquerading As Job Applications/Openings; Ransomware Thieves Shifting Their Focus From Individuals To Companies
Lucian Constantin writes on the March 28, 2016 website, PCWorld, about the latest ransomware virus that locks users out of their own computers. “The new Peyta ransomware overwrites the master boot record (MBR) of the affected PC’s, leaving their operating systems in an unbootable state,” according to researchers from the cyber security firm — Trend Micro.
“The MBR is the code stored in the first sectors of a hard disc drive,” Mr. Constantin writes. “It contains information about the disk’s partitions, and launches the operating system’s boot loader. Without a proper MBR, the computer [your computer] doesn’t know which partitions contain an OS, and how to start it.”
A Trend Micro [cyber security] researcher, in a blog post, explained that “Peyta is distributed through spam emails that masquerade as job applications.” “This suggests,” Mr. Constantin notes, “that its creators target businesses in particular, with the messages being being directed at Human Resources Departments. The emails have a link to a shared Dropbox folder that contains a self-extracting archive, posing as the applicant’s CV, and fake photo. If the archive is downloaded and executed, the ransomware is installed. The malicious program will [proceed] to rewrite the computer’s MBR, and will trigger a critical Windows error that will cause the computer to reboot — a condition know as Blue Screen of Death (BSOD). Following this initial reboot, the rouge MBR code will display a fake Windows check disc operation that normally occurs after a hard disc error, according to computer experts from popular tech support forum BleepingComputer.com. During this operation, the ransomware actually encrypts the master file table (MFT). This is a special file on NTFS partitions that contains information about every other file: their name, size, and mapping to to the hard disc sectors,” Mr. Constantin wrote.
“Petya does not encrypt the file data itself, which would take a long time for an entire hard drive; but, by encrypting the MFT, the OS will no longer know where the files are located on the disc. The file data can still be read with data recovery applications but rebuilding the actual files would likely be a lengthy and inexact process, especially in the case of fragmented files that are spread across different storage blocks in different regions of the disc,” Mr. Constantin notes.
“After the MFT encryption is done, the rouge Petya MBR code will display the ransom message accompanied by a skull drawn in ASCII characters. The message instructs users to access the attackers’ decryption site on Tor anonymity network, and provides them with a unique code that identifies their computer,” PCWorld warns.
“The price for the key required to decrypt the MFT is 0.99 bicoins (BTC), or around $430.”
Cyber Criminals Using Ransomware Shifting Their Focus From Individuals — To Companies
Intel Security Group’s Chief Technology Officer, Steve Grobman told CNBC’s Squawk Alley on Monday, that cyber criminals using ransomware are shifting their sights from individual targets, to bigger [more lucrative] ones. “We’re now starting to see the shift from not only consumers [to] even soft-target organizations and businesses, like hospitals, universities, and police stations.” Mr. Grobman warned that “key U.S. [critical] infrastructures are at risk of a ransomware attack”; and, said “greater coordination between government and private enterprises is needed to stave off such infiltrations.”
Ransomware attacks rose 26 percent in the last quarter of 2015 — from the previous quarter,” according to a recently released report from McAfee Labs and Intel.
FBI Seeking Help From U.S. Firms As It Investigates A Nasty New Strain Of Ransomware
And yet another new strain of ransomware called MSIL/Samas tries to encrypt data across entire networks — rather than single computers, according to a March 29, 2016 article from BBC News. “In a confidential advisory obtained by Reuters News Service, the BBC reports that the FBI said the group behind the release of this malicious new ransomware, “used a publicly available security program called Jexboss to scan networks looking for vulnerable versions of the widely used JBoss software. The cyber security firm Carbon Black has found yet another new strain of ransomware, “that goes after many firms that use Windows PowerShell — a scripting program widely used to administer machines running windows,” the BBC noted. “Dubbed PowerWare, this strain hides malicious code in Word documents, and calls on PowerShell to execute the power code when the booby-trapped files are opened.”
“Deceptively simple in code, PowerWare is a novel [new] approach to ransomware, reflecting a growing trend of malware authors thinking outside the box in delivering ransomware,” said Carbon Black’s Rico Valdez.
The bottom line: the only ‘safe’ computer is one no one ever uses. V/R, RCP