- Petya Ransomware Patch Download Kingmaker 1.0.8 Patch Download World Of Warcraft Patch Download 1.12 Heroes V Tribes Of The East Patch Download The Walking Dead Pc Patch Download Digitech Rp355 User Patch Download Nascar 15 No Cd Patch Download Quicken Mondo Patch Download 2015 Hunt Down The Freeman Patch Download.
- (Balogh) Petya is a family of encrypting malware that was first discovered in 2016. The malware targets Microsoft Windows–based systems, infecting the master boot record to execute a payload that encrypts a hard drive's file system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system.
- This ransomware is a new variant of the Petya ransomware, and is much more sophisticated than its predecessor. This ransomware has a few improvements on the WannaCry ransomware, mainly that it has new capabilities that allow it to infect even up-to-date Windows systems running the latest security updates and latest software patches.
This message is primarily intended for U-M IT staff who are responsible for university machines running Microsoft Windows.
Summary
Petya Ransomware: What You Need to Know. Petya has affected more than 12,500 machines in Ukraine alone, and spread to another 64 countries, including Belgium, Brazil, Germany, Russia, and the US.
There are reports in the news media of a new global ransomware attack called Petya. The Petya ransomware is similar to WannaCry in that it leverages the EternalBlue exploit that was made public in April; it also uses other mechanisms to spread. Also, be aware that there are phishing attacks that reference global cyber attacks. Currently, there is no indication of any Petya infections of U-M systems. Information Assurance (IA) continues to monitor the situation.
Microsoft released patches for its supported systems in March and for unsupported systems in May. Computers with those patches installed are not vulnerable to the spread of Petya. Do not open shared documents or email attachments unless you are expecting them and trust the person who sent them; ransomware is often delivered through malicious attachments and shared documents.
Problem
Although patches have been available since March, and the WannaCry outbreak in May called attention to the need to update Windows, it appears many companies and organizations worldwide have been unable to apply the patches and protect their systems. The new Petya ransomware outbreak takes advantage of this. See the References below for information about organizations victimized by this new attack. The ransomware demands an average payment of $300 in bitcoins.
Affected Systems
- Microsoft Windows Vista, 7, 8.1, RT 8.1, 10
- Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016
- Microsoft Windows Server Core Installations 2008, 2008 R2, 2012, 2012 R2, 2016
- Microsoft Windows; XP SP2/SP3, Embedded SP3, 8 RT
- Microsoft Windows Server 2003 SP 2
Action Items
If you have not already done so, apply the patches provided by Microsoft to vulnerable systems immediately after appropriate testing.
- For manual downloads of the patches, see Microsoft Update Catalog.
System administrators should, as appropriate for their IT environment, take these additional precautions:
- Denylist of perfc.dat as well as the PSExec utility from Sysinternals Suite.
- Block ingress and egress traffic to TCP and UDP ports 139, 445, and 3389 at your demarcation point.
- Disable SMBv1 on all systems and utilize SMBv2 or SMBv3 after appropriate testing.
- Remove un-patchable hosts from the network.
Technical Details
Petya leverages the EternalBlue exploit that was made public in April by the Shadow Brokers and used by WannaCry to spread between systems on a network. EternalBlue utilizes a known SMB 1.0 vulnerability affecting most versions of Windows. Systems that have already had Microsoft’s MS17-010 security patch applied are not vulnerable to the EternalBlue exploit used by Petya.
Information for Users
- Be especially vary of emails asking you to update or confirm your account or access details because of a cyber attack. Ransomware often spreads through such malicious email, email attachments, and shared documents. You can check for recent phishing emails received at U-M on the Safe Computing Phishing Alerts page.
- In general, the best protection for your devices is this: keep your software and apps up-to-date, do not click suspicious links in email, do not open shared documents or email attachments unless you are expecting them and trust the person who sent them, and only use secure, trusted networks. For more information, see Phishing & Suspicious Email,Secure Your Devices, and Use a Secure Internet Connection on the U-M Safe Computing website.
Questions, Concerns, Reports
Petya Malware
References
Petya Ransomware Download
- Multiple Petya Ransomware Infections Reported (US-CERT, 6/27/17)
- ‘Petya’ Ransomware Outbreak Goes Global (Krebs on Security, 6/27/17)
- Petya cyber attack: Ransomware virus hits computer servers across globe, Australian office affected (ABC News, 6/27/17)
- Massive Ransomware Attack Hits Ukraine; Experts Say It's Spreading Globally (National Public Radio, 6/27/17)
- Petya Or NotPetya: Why The Latest Ransomware Is Deadlier Than WannaCry (Forbes Security, 6/27/17)
- A Scary New Ransomware Outbreak Uses WannaCry’s Old Tricks (Wired, 6/27/17)
- 'Petya' ransomware attack strikes companies across Europe and US (The Guardian, 6/27/17)
- Microsoft Security Bulletin MS17-010 - Critical (Microsoft, 3/14/17)