Wednesday, June 28, 2017

NSA Software Behind Latest Global Ransomware Attack


(Zero Hedge) “It’s like WannaCry all over again,” said Mikko Hypponen, chief research officer with Helsinki’s cybersecurity firm F-Secure, when discussing today’s latest outbreak of the WannaCry-like ransomeware attack, which as we reported earlier started in Ukraine, and has since spread to corporate systems across the world, affecting Russian state oil giant Rosneft, the international shipping and energy conglomerate Maersk, and the UK public relations company WPP, before jumping across the Atlantic and going global, by infecting the US-based division of global pharma giant Merck, which this morning confirmed it has been hit by the “Petya” attack.


Related BREAKING: “Massive Cyberattack” Spreads Across Europe, Hits Ukraine, Russia, UK, Denmark

Source - The Daily Sheeple

by
Zero Hedge, June 27th, 2017

“We confirm our company’s computer network was compromised today as part of global hack,” Merck said in a statement on Tuesday. “Other organizations have also been affected. We are investigating the matter and will provide additional information as we learn more.”
Merck employees were instructed to disconnect all mobile devices from the company network and advised not to speak to reporters or post messages on social media accounts.

Computers at Merck facilities in Pennsylvania and New Jersey locked up Tuesday morning around 8am local time, according to the Inquirer.




Back in mid-May, when WannaCry spread with tremendous speed around the globe, many said that it’s only a matter of time before the virus returns in a more advanced, weaponized version. Sure enough, cyber security experts quoted by Reuters said those behind the attack appeared to have exploited the same hacking tool used in the WannaCry ransomware attack that infected hundreds of thousands of computers in May before a British researcher created a temporary kill-switch.

Hypponen said he expected the outbreak to spread in the Americas as workers turned on vulnerable machines, allowing the virus to attack. “This could hit the U.S.A. pretty bad,” he said. And, as Merck confirmed, it already has.

Within hours of the first attack, the U.S. Department of Homeland Security said it was monitoring reports of cyber attacks around the world and coordinating with other countries.

The first reports of organizations being hit emerged from Russia and Ukraine, but the impact quickly spread westwards to computers in Romania, the Netherlands, Norway, and Britain.

Within hours, the attack had gone global.
In addition to the US, a Swiss government agency also reported computer systems were affected in India, though the country’s cyber security agency said it had yet to receive any reports of attacks according to Reuters.



For those infected, there may be just one option: pay the ransom. One victims of the cyber attack, a Ukrainian media company, said its computers were blocked and it had a demand for $300 worth of the Bitcoin crypto-currency to restore access to its files.


“If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don’t waste your time. Nobody can recover your files without our decryption service,” the message said, according to a screenshot posted by Ukraine’s Channel 24. The same message appeared on computers at Maersk offices in Rotterdam and at businesses affected in Norway.

Other companies that said they had been hit by a cyber attack included Russian oil producer Rosneft, French construction materials firm Saint Gobain and the world’s biggest advertising agency, WPP – though it was not clear if their problems were caused by the same virus. “The building has come to a standstill. It’s fine, we’ve just had to switch everything off,” said one WPP employee who asked not to be named.

The virus was seen on various Ukraine ATMs, leading to jokes that while normally you ask ATMs for money, in hacked Ukraine, ATMs ask you.


Cyber security firms scrambled to understand the scope and impact of the attacks, seeking to confirm suspicions hackers had leveraged the same type of hacking tool exploited by WannaCry, and to identify ways to stop the onslaught. Experts said the latest ransomware attacks unfolding worldwide, dubbed GoldenEye, were a variant of an existing ransomware family called Petya.




It uses two layers of encryption which have frustrated efforts by researchers to break the code, according to Romanian security firm Bitdefender. “There is no workaround to help victims retrieve the decryption keys from the computer,” the company said.

Russian security software maker Kaspersky Lab, however, said its preliminary findings suggested the virus was not a variant of Petya but a new ransomware not seen before.

As noted earlier, Ukraine was quick to accuse Russia. An advisor to Ukraine’s interior minister said the virus got into computer systems via “phishing” emails written in Russian and Ukrainian designed to lure employees into opening them. According to the state security agency, the emails contained infected Word documents or PDF files as attachments.

But whatever the origin of the geographic hacking operation, the actual software used is the same that was created by the NSA and subsequently leaked by a disgruntled non-Russian employee. Now we are just waiting for the confirmation.
As a reminder, the quick proliferation of the original WannCry malware, which infected nearly 300,000 computers worldwide within a day, was due entirely to its use of two powerful software exploits that were released to the public in April by the anonymous hacker group calling itself the Shadow Brokers, which said the exploits were developed by the US National Security Agency (NSA).

On Tuesday, Edward Snowden asked “How many times does @NSAGov’s development of digital weapons have to result in harm to civil infrastructure before there is accountability?”
Apparently, not enough.



Meanwhile, governments and so-called experts had laughably come to the conclusion that the North Korean government was behind the original WannaCry attack. We just can’t wait for the those same “experts” to again blame this latest global malware attack on Kim and his team of crack blackhats.

Finally, for those who want to keep track of how many people have made the ransom payment, there is a twitter for that: there is now a Twitter bot, @petya_payments, that will tweet each time a new ransom payment is made to the bitcoin wallets associated with the Petya attack.
_________________________
Stillness in the Storm Editor's note: Did you find a spelling error or grammar mistake? Do you think this article needs a correction or update? Or do you just have some feedback? Send us an email at sitsshow@gmail.com with the error, headline and urlThank you for reading.
_______
Source:
________________________________________________________________
Question -- What is the goal of this website? Why do we share different sources of information that sometimes conflicts or might even be considered disinformation? 
Answer -- The primary goal of Stillness in the Storm is to help all people become better truth-seekers in a real-time boots-on-the-ground fashion. This is for the purpose of learning to think critically, discovering the truth from within—not just believing things blindly because it came from an "authority" or credible source. Instead of telling you what the truth is, we share information from many sources so that you can discern it for yourself. We focus on teaching you the tools to become your own authority on the truth, gaining self-mastery, sovereignty, and freedom in the process. We want each of you to become your own leaders and masters of personal discernment, and as such, all information should be vetted, analyzed and discerned at a personal level. We also encourage you to discuss your thoughts in the comments section of this site to engage in a group discernment process. 

"It is the mark of an educated mind to be able to entertain a thought without accepting it." – Aristotle

The opinions expressed in this article do not necessarily reflect the views of Stillness in the Storm, the authors who contribute to it, or those who follow it. 

View and Share our Images
Curious about Stillness in the Storm? 
See our About this blog - Contact Us page.

If it was not for the gallant support of readers, we could not devote so much energy into continuing this blog. We greatly appreciate any support you provide!

We hope you benefit from this not-for-profit site 

It takes hours of work every day to maintain, write, edit, research, illustrate and publish this blog. We have been greatly empowered by our search for the truth, and the work of other researchers. We hope our efforts 
to give back, with this website, helps others in gaining 
knowledge, liberation and empowerment.

"There are only two mistakes one can make along the road to truth; 
not going all the way, and not starting." — Buddha

If you find our work of value, consider making a Contribution.
This website is supported by readers like you. 

[Click on Image below to Contribute]

Support Stillness in the Storm