Contrary opinion: PetraWrap is buggy, poorly constructed ransomware

Topic

New Reply

Yesterday, I ran an article that says PetyaWrap (NyetPetya, Petya.2017, nPetya, pick your name) “was designed to make headlines, not to make money.” T
[See the full post at: Contrary opinion: PetraWrap is buggy, poorly constructed ransomware]

1 user thanked author for this post.

wdburt1

Reply | Quote

Replies

I like your theory, Woody.

As a (legitimate) software developer of complex products, I can say a few things from exprerience:

Complex software – and make no mistake, something that integrates so many different technologies/exploits, not to mention networking, system operations, disk operations, etc. is REALLY complex – MUST be tested thoroughly.

This is not software using documented and well-tested APIs.

This is not software that can just be sent out to a large group of beta testers to help validate it.

And it can’t be tested for a long time with even a small private group of systems. Somehow evidence of its existence will be leaked. It will be discovered. Maybe an early build would leak out of the test network (hm, maybe one DID). Maybe it would screw up the developer’s test systems. The exploits it needs will be patched soon, so it’s a RUSH JOB that must be done with nearly no testing.

This IS software that to work as intended would have to run on a large number of different systems with disparate network setups and who knows what anti-malware software running. That implies all its building blocks would have to be robust, reliable, solid…

This IS software that is being developed by people who are, shall we say, not of normal minds. They are not folks who go through life doing good, reliable work, nor those who have built up their application over years and years of hard work. They’re not folks who have long-term goals, because those people understand that the world only really works if you avoid screwing it up.

There is a fundamental disparity between the smart, disciplined, clear-thinking mindset NEEDED to create a properly functioning complex software system and that which is NEEDED to write software quickly to screw as many people as you can.

And that is a Very Good Thing.

Just look at how many people Microsoft has to get to test their complex software on the up and up, and how long they’ve been developing Windows – and it STILL isn’t perfect!

-Noel

4 users thanked author for this post.

JohnW, lurks about, Pepsiboy, Great Lake Bunyip

Reply | Quote

What I have failed to find is info regarding the possibilities of home users getting infected just by staying online, like WannaCry or even the DoublePulsar episode…

From what I have seen on PetyaWrap’s code it does not spread online, unlike WCry it will only run a local LAN scanning for other vulnerable systems and then makes use of trusted credentials to infect those systems, being this its worm capability.

That explains why patched systems got hit, they were infected by other, already compromised stations on the same network…

Also, there is the M.E.Doc theory, which could also explain why Ukraine felt the strike so bad, since it is a very popular software there, and hence the nature of this particular infecting mechanism, it did not rely on any TCP/IP vunerabilities, patched or not, which also corroborates with the reports of fully updated systems being affected…

Did anyone find anything indicating that put aside rigged third party software and its latteral LAN spread capabilities, it can hit someone with either Ports 445/139 closed to the web, and/or fully patched?

Also, what Windows versions are affected by this?

1 user thanked author for this post.

Noel Carboni

Reply | Quote

Also, adding to my post above, is it still spreading?

Reply | Quote

You’re right, and you’ve touched on something that bothers me more and more lately… All too few people are reporting on this issue for “the common good”.

Essentially, pretty much everyone today wants to use news for their benefit… The internet is all about monetizing information, even when the information content is thin to non-existent.

Anti-malware companies, of course, want to be the first to release juicy tidbits they’ve learned to earn “street cred” and presumably get more people to buy THEIR products because THEY look like they know what they’re doing. Think about all the products having come out lately touted specifically as “anti-ransomware”.

News people want to sell ad space, served up to those desperately looking for ways to avoid being victims. Making money from news is fine – news people gotta eat. But if journalistic integrity and getting the real story are just pushed aside for the sake of hype… That’s not so good.

Microsoft wants people to crave their latest, “most secure ever” operating system as well as to cede control of their computer systems, but – surprise – they’re not doing it entirely for users’ benefit. It’s their way to future riches.

It’s no coincidence that the term “fake news” has such mainstream exposure today.

While any particular malware package may be difficult and time consuming to analyze, details generally DO ultimately come out in time. Trouble is, all the sources of information don’t get very far toward their monetary goals if they immediately release a no-nonsense and effective “how to keep safe” guide. It sure seems to me they are hyping cyber crime news stories up as much as possible lately… Sigh.

-Noel

9 users thanked author for this post.

lurks about, SueW, Sessh, wdburt1, samak, Pepsiboy, ryegrass, Great Lake Bunyip, BobbyB

Reply | Quote

See The Windows firewall is the overlooked defense against WannaCry and Adylkuzz.

1 user thanked author for this post.

SueW

Reply | Quote

The Ukraine has been playing whack a mole with pirated software for decades. It is considered a cultural norm in eastern Europe and Russia. You can get a pirated copy of any flavor of Windows or a pirated Windows application (e.g. Office) for a mere pittance. This wave of cyber attacks will eventually collapse the house of cards that they have built and patching the exploits is not going to fix the underlying problem.

Also, it does not matter if PetraWrap was created by an idiot savant. It is more about piling on and the weight that more cyber attacks will add.

Reply | Quote

Fyi, the NyetPetya or PetyaWrap malware/ransomware was very likely a political cyber-attack by Russian-proxy agents/hackers against Ukraine. Now, very few international corporations will wanna buy Ukrainian software like MeDoc.
… Pirated Windows software are even more prevalent in China and India.

Reply | Quote

“Now, very few international corporations will wanna buy Ukrainian software like MeDoc.”

MeDoc makes accounting software to help people and businesses process taxes. Presumably in line with Ukrainian tax laws. I doubt there is much of an international market for their software anyway.

Windows 10 Home 22H2, Acer Aspire TC-1660 desktop + LibreOffice, non-techie

1 user thanked author for this post.

ch100

Reply | Quote

I think the quote is to be seen as referring to Ukrainian software in general, not this particular piece of software which is related to the local taxation laws.
The problem that we have today is that it is not only about Ukrainian software, but can be about Russian software, UK software, US software, any software in general.
Wasn’t recently proved that Windows had backdoors known only to few at least until the March 2017 updates?
I would pay a bit more attention to third-party antivirus software which has total control over any computer and in many cases backup software can be dangerous too.

1 user thanked author for this post.

samak

Reply | Quote

‘third-party antivirus software which has total control over any computer’
– which ones? example pls
do you mean those free AVs?
dont all, paid or unpaid, AVs try to take total control over the computer, in the name of max security for the user?
TIA

Reply | Quote

House of Cards for sure. India and China are in an even more precarious position because their future depends on computer technology and the services that come with it. India and China have no shortage of political enemies and many of them operate from within their own borders. Then of course there are the enemies from outside their borders. Cyber warfare will be more effective where the foundations are unstable. The ‘piling on’ is what will make it collapse in on itself.

Reply | Quote

Attack attribution is always very hard. Compared with that, determining motivation is harder still. Nevertheless, I don’t buy the “plotched encryption and payment pipeline” theory for this one.

Someone who can write code with the lateral movement agility of this malware is seriously not going to make such a stupid mistake in the encryption portion of the package, unless:

1)  The encryption code was written by someone other than the one(s) writing the exploit code AND the person(s) writing the encryption code were incompetent coders and/or testers AND the project leader didn’t notice.

2) The encryption code and payment pipeline was a mockup intended for testing purposes only, slated to be replaced later in the development cycle with a fully-functional encryptor and payment pipeline AND the malware was somehow released prematurely and/or accidentally with the prototype encryption and payment code still present.

Seems to me that both of these explanations require just as much, if not more, “special pleading” than does the original hypothesis that the ransomware aspect was intended merely to confuse and distract those trying to figure out how to defend against this threat.

But maybe I’m making an unintentional “straw man” argument, because I’m too tired tonight to think clearly enough to see it. If so, then I’m sure someone will tell me.

3 users thanked author for this post.

SueW, ch100, MrBrian

Reply | Quote

I suspect many of these things could be being pieced together from building blocks being passed around on the dark web. Thus someone who isn’t really a genius at software development but more like a child with Legos could be trying to get their “piece of the ransomware pie” by mixing and matching components with a relatively low effort, without a very good big picture understanding of how it’s going to play out. Put in a few days work, get a few thousand dollars, who cares who’s hurt by it… DID they actually get some payments before their infrastructure broke down? I have no idea.

-Noel

2 users thanked author for this post.

lurks about, ch100

Reply | Quote

Until the miscreants are identified this could be the work of almost anyone from a script kiddie to a targeted attack on Ukraine by presumably the Russians. I think Noel may be on to something with it likely being a script kiddie or someone with marginally more ability.

Reply | Quote

Holland’s Maersk seemed to be one company who got the brunt of the attack. Which does indicate that disruption was a primary effect target by the ransomware. If TNT was also a affected company then obviously transportation or more specifically global transportation was targeted. Was this to prove how vulnerable our transportation of goods globally is?

Reply | Quote

Danish.

Maersk is a danish company.

With that very important minor correction in place, carry on!

Reply | Quote

Apparently only a few freight carriers got hit hard by this so I suspect they have specific issue that left them more vulnerable.

Reply | Quote

Woody–

A quick editorial comment.  This reader stumbled when he came to the word “expose” in the third paragraph.  It appears to suggest that Graham’s piece discredits Bontchev’s claim, when, if I understand it correctly, it supports it.

Reply | Quote

Ukraine was cyber bombed and that is the story. It is so bad that they have put out a distress call to several nations to come to their aid. If the attack(s) were state sponsored they will need independent parties to prove it one way or the other. If proven, hopefully reparations will follow. Organised crime, anarchists, scumbags, haters or useful idiots are also on the list of whodunnit.

It is unfortunate that most of the media reports are focusing on ransomware. The public is being fed a pile of inaccuracies. It is not fake news, it is Dumb-Down news.

Cyber War has not been mentioned. Why?

1 user thanked author for this post.

Noel Carboni

Reply | Quote

Pandora’s box. If a major state actor is behind this, then there will be payback. This could start something cyber wise that  could quickly spiral out of control. Everybody loses.  Worst case, rolling collapse of  infrastructure. Some idiot decided to do a field test without thinking of the blowback. Good news is this is in all probability 1st or early 2 gen, so the damage will be limited. Bad news, well I don’t have to tell anyone that.

Reply | Quote

SLACK OPS?!

Thanks again to you and the crew for the reality view from The Bridge!

Just to lighten the mood…

Could the current round of crazy malware attacks be yet another attempt by The Microborg to get us all assimilated into the Win10 Hive Mind Upgrade?

Remember the old Klingon proverb:

“Just because you’re paranoid doesn’t mean they’re not out to get you.”

Keep beaming us up you guys and gals!

Live Long & Prosper!

sainty????

 

Reply | Quote