Okjokes Posted May 14, 2017 Report Share Posted May 14, 2017 Au dat și ei peste un exploit și sunt hackeri... 1 Quote Link to comment Share on other sites More sharing options...
adba Posted May 14, 2017 Report Share Posted May 14, 2017 2 hours ago, Okjokes said: Au dat și ei peste un exploit și sunt hackeri... Se poate afla cum a ajuns virusul în rețeaua de calculatoare a celor de la Dacia Mioveni? A fost descărcat prin intermediul e-mail-ului de către un angajat? Quote Link to comment Share on other sites More sharing options...
Sithalkes Posted May 14, 2017 Report Share Posted May 14, 2017 Probabil ca da. Pentru autentificare, firmele folosesc certificate de securitate care trebuie acceptate/instalate de/in browser iar acestea fiind criptate nu mai sunt accesibile, si deci pa acces. Pa acces, pa activitate. 1 Quote Link to comment Share on other sites More sharing options...
cretu_dan Posted May 14, 2017 Report Share Posted May 14, 2017 Vreo tipologie a mail-urilor? Ceva caracteristici? 1 Quote Link to comment Share on other sites More sharing options...
asswipe Posted May 14, 2017 Report Share Posted May 14, 2017 (edited) 200'000 infections but only $32k in ransom so far 8.27 BTC https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw 4.0 BTC https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn 5.84 BTC https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 New variant with no kill-switch https://blog.comae.io/wannacry-new-variants-detected-b8908fefea7e Edited May 14, 2017 by asswipe Quote Link to comment Share on other sites More sharing options...
tjt Posted May 14, 2017 Report Share Posted May 14, 2017 Partea buna e ca dupa ce se termina toate astea va creste tarifu' si numarul de clienti pentru cei ce sunt in IT Security. 2 hours ago, asswipe said: 200'000 infections but only $32k in ransom so far 8.27 BTC https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw 4.0 BTC https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn 5.84 BTC https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 E normal, pentru ca din ce am citit pe net nu a existat un target ... pur si simplu s-a trimis random la tot felul de firme, spitale si alte institutii. "Europol: Atacul cibernetic de vineri a afectat 200.000 de computere din 150 de tari. Numarul va creste puternic luni cand lumea revine la munca" http://economie.hotnews.ro/stiri-it-21765865-europol-atacul-cibernetic-vineri-afectat-200-000-computere-din-150-tari-numarul-creste-puternic-luni-cand-lumea-revine-munca.htm 1 Quote Link to comment Share on other sites More sharing options...
miska Posted May 15, 2017 Report Share Posted May 15, 2017 Nu e nimic nou in afara de exploit. Acest ransomw. nu zboara si nici nu merge singur. Nu are cum intra in ATM pentru ca nu are cine sa dea click pe el. Totusi acest "virus" foloseste un motor de spreading si se raspandeste asa: De pe root pe partitii secundare pe urma pe stick usb sau pe sdcard telefon, in mediul LAN in retelele ce nu necesita token de acces ca in cazul windows 7 ultimate, el cautand fisiere sharuite pe care le suprascrie cu el insasi dar nu le infecteaza in acelasi timp lansand mesajul de gen "your computer need update" sau alte mesaje pe computerul din LAN pacalind utilizatorul sa execute replicantul ca sa poata incepe procesul de criptare a datelor. Ce este nou? S-a descoperit un procedeu automat de download a virusului la deschiderea unui fisier .txt ! Virusul ataca principalul sistem infectat in unele versiuni (ultimele) printr-un procedeu asemsnator cu procesul de update bazat pe API ce asculta si comunica pe anumite porti deschise cu anumite servere (un server este folosit foarte putin intr-o ora nu mai exista si este inlocuit cu altul asemeni retelei botnet) de pe care se face infectarea propriu-zisa. Daca se face dezinfectia porturile raman deschise si api-ul nu este detectat. Destul aici ca aglomeram, PM pentru cine este interesat de mai multe detalii. 7 Quote Link to comment Share on other sites More sharing options...
cretu_dan Posted May 15, 2017 Report Share Posted May 15, 2017 Miska Se spunea aici ca a fost descărcat prin intermediul e-mail-ului. Asa este? 1 Quote Link to comment Share on other sites More sharing options...
miska Posted May 15, 2017 Report Share Posted May 15, 2017 Este un spreading. Nu este neaparat nevoie pe email. Poate sa fie un link catre un ebook-document sau altceva. Dupa cum am zis nu functioneaza pe retele LAN windows 7 ultimate, dar lasa urme care pot constitui brese chiar si pe w7u (vezi cum e facut infectorul pdf pt. Bitlocker/Truecrypt). Nu am un sistem infectat sa lucrez dar cred ca se pot recupera 80% din date. De decriptat nici vorba poate doar sn0w...sau nsa :). Presupun ca acum lucreaza sute de specialisti ca noi sa dormim bine si sa lasam treaba asa cum este, nu are rost sa stim motorul doar nu ne apucam de ransomanit. Quote Link to comment Share on other sites More sharing options...
u0m3 Posted May 15, 2017 Report Share Posted May 15, 2017 Daca e cineva interesat de un articol care descrie relativ bine (a se citi "cu multe poze") cum se executa WCry: https://www.endgame.com/blog/wcrywanacry-ransomware-technical-analysis. 3 Quote Link to comment Share on other sites More sharing options...
DuTy^ Posted May 16, 2017 Author Report Share Posted May 16, 2017 @miska mai documenteazate tinere inainte sa spui numai prostii... Quote Link to comment Share on other sites More sharing options...
yoyois Posted May 16, 2017 Report Share Posted May 16, 2017 @miska BroScience! Cat va mai place sa mancati kkt sa va dati specialisti. De ce nu recunosti ca nu stii si bagi vrajeli de urme de triangulare in retea pdf cu 80% sn0w. De unde ati aparut? Poate sunt unii care sunt interesanti si chiar stiu ce e ala ASM si debuger si vector de atac. PS: Mai are cineva samples/fisierele originale din WannaCry si UIWIX. Eu am gasit niste binare dar nu sunt multumit. Poate cineva cu insight la un AV/sysadmim. Quote Link to comment Share on other sites More sharing options...
miska Posted May 16, 2017 Report Share Posted May 16, 2017 (edited) Eu am toate fisierele initiale de la UIWIX Uite si o analiza WannaCry Edited May 16, 2017 by miska Quote Link to comment Share on other sites More sharing options...
DuTy^ Posted May 16, 2017 Author Report Share Posted May 16, 2017 Aveti Droperul? Quote Link to comment Share on other sites More sharing options...
yoyois Posted May 16, 2017 Report Share Posted May 16, 2017 (edited) 34 minutes ago, DuTy^ said: Aveti Droperul? https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168 Pe scurt ai: https://transfer.sh/PnDIl/CYBERed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.EXE https://transfer.sh/ZhnxR/CYBER1be0b96d502c268cb40da97a16952d89674a9329cb60bac81a96e01cf7356830.EXE (main dll) Testate intr-un VM windows 10. (atentie va infectati, nu lasati o connexiune internet din 2 motive) 1. Killswitch was sinkholed, virus stop execution. 2. Careful if you have vulnerable devices in your network. (even host-guest VM)!!! Edited May 16, 2017 by yoyois Quote Link to comment Share on other sites More sharing options...
miska Posted May 16, 2017 Report Share Posted May 16, 2017 Asta este tot UNICORN pune ultima versiune de UIWIX sau o pun eu daca nu o aveti.... Quote Link to comment Share on other sites More sharing options...
gigiRoman Posted May 17, 2017 Report Share Posted May 17, 2017 https://blogs.sans.org/computer-forensics/files/2017/05/Williams-WanaCryptor.pdf https://www.sans.org/newsletters/newsbites/xix/39#204 Quote Link to comment Share on other sites More sharing options...
Technetium Posted May 21, 2017 Report Share Posted May 21, 2017 (edited) https://www.exploit-db.com/ghdb/4486/ https://github.com/RiskSense-Ops/MS17-010 https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168 map: https://attacks.mgmt.cloud/ SAMPLES: main dll aici environmentID envid virustotal https://www.sendspace.com/file/dl2ftg https://www.sendspace.com/file/hf9jhr https://www.sendspace.com/file/42xugv Medicine: https://github.com/gentilkiwi/wanadecrypt/releases Edited May 21, 2017 by Technetium 1 Quote Link to comment Share on other sites More sharing options...
