looks like the world is being attacked by a very serious Ransomware virus.

so far UK, US, China, Russia, Spain and many more data's being hold to Ransom. its called WannaCry. and affects windows computers.

The infections seem to be deployed via a worm - a program that spreads by itself between computers.

Most other malicious programmes rely on humans to spread by tricking them into clicking on an attachment harbouring the attack code.

By contrast, once WannaCry is inside an organisation it will hunt down vulnerable machines and infect them too.

Some experts say the attack may have been built to exploit a weakness in Microsoft systems that had been identified by the NSA and given the name EternalBlue.

http://www.bbc.co.uk/news/technology-39901382

 

[Yepi69]

It's back, and this time it's much worse.

The Petya ransomware has been updated to use the same EternalBlue vulnerability as WannaCry, but with an added "feature": once it gets onto a vulnerable machine, it proceeds to use wmic and psexec to reuse authentication credentials to infect other machines on the network. This works even if the other machines have been patched.

As an added bonus, the Petya ransomware installs itself into the hard drive's MBR, then reboots into a fake CHKDSK process (which is actually encrypting the HDD). Once it's done, it prompts you to send $300 worth of Bitcoin in order to recover your files.

I wonder how it'll work with GPT.

 

[tunip3]

It's back, and this time it's much worse.

The Petya ransomware has been updated to use the same EternalBlue vulnerability as WannaCry, but with an added "feature": once it gets onto a vulnerable machine, it proceeds to use wmic and psexec to reuse authentication credentials to infect other machines on the network. This works even if the other machines have been patched.

As an added bonus, the Petya ransomware installs itself into the hard drive's MBR, then reboots into a fake CHKDSK process (which is actually encrypting the HDD). Once it's done, it prompts you to send $300 worth of Bitcoin in order to recover your files.

oh lord plus didnt an emergency patch for everything including xp

 

[samcambolt270]

so, what would we do to protect ourselves this time?

 

[dankzegriefer]

Does it affect Linux??!?! No? Windows peasants

I love Linux and prefer it over Windows, but I use windows as my daily driver.

Why?

Fucking driver support. Linux's driver support is shit.

--------------------- MERGED ---------------------------

so, what would we do to protect ourselves this time?

If you're updated and all PCs on your network are you're safe

 

[samcambolt270]

I love Linux and prefer it over Windows, but I use windows as my daily driver.

Why?

Fucking driver support. Linux's driver support is shit.

--------------------- MERGED ---------------------------


If you're updated and all PCs on your network are you're safe

ok, good.

 

[GerbilSoft]

I wonder how it'll work with GPT.

If you're using UEFI+GPT on the main boot disk, the MBR boot sector isn't actually used. UEFI boots the operating system kernel directly from the System partition.

That could be one way to prevent this malware from doing any damage, assuming it doesn't handle this case.

Note that Windows only supports booting from GPT disks if using UEFI, so if your main boot disk is GPT, you should be fine here.

EDIT: The Windows portion of the ransomware might overwrite the primary GPT, since that area is normally empty and is used by bootloaders on MBR/BIOS systems. However, the GPT is both checksummed and duplicated (a second copy is stored at the end of the disk), so this should be recoverable.

 

[Deleted User]

It's back, and this time it's much worse.

The Petya ransomware has been updated to use the same EternalBlue vulnerability as WannaCry, but with an added "feature": once it gets onto a vulnerable machine, it proceeds to use wmic and psexec to reuse authentication credentials to infect other machines on the network. This works even if the other machines have been patched.

As an added bonus, the Petya ransomware installs itself into the hard drive's MBR, then reboots into a fake CHKDSK process (which is actually encrypting the HDD). Once it's done, it prompts you to send $300 worth of Bitcoin in order to recover your files.

Now, this is gonna sound stupid and paranoid as shit, but I don't even wanna touch my Windows VMs now because I feel like I'll accidentally get infected and fuck up the two Windows computers in the house.

 

[Yepi69]

If you're using UEFI+GPT on the main boot disk, the MBR boot sector isn't actually used. UEFI boots the operating system kernel directly from the System partition.

That could be one way to prevent this malware from doing any damage, assuming it doesn't handle this case.

Note that Windows only supports booting from GPT disks if using UEFI, so if your main boot disk is GPT, you should be fine here.

Also turning on Secure Boot would be a good idea, in fact I'm gonna do that right now.
Had it disabled since Linux doesn't like it.

 

[Kioku]

Well.. This is great. Just another excuse for Linux users to bash everyone else. Zzzzzzzzzzzzzzzzzzzz

 

[GerbilSoft]

Well.. This is great. Just another excuse for Linux users to bash everyone else. Zzzzzzzzzzzzzzzzzzzz

What if we want to zsh or tcsh you instead?

 

[Kioku]

What if we want to zsh or tcsh you instead?

Took me a second, but I see what you did there... Oo

 

[EthanAddict]

I just use bash, nothing special, and zsh at installation

 

[DeoNaught]

View attachment 91617
Now, this is gonna sound stupid and paranoid as shit, but I don't even wanna touch my Windows VMs now because I feel like I'll accidentally get infected and fuck up the two Windows computers in the house.

Same, This is only windows correct?

Also Op should update first post

 

[omegasoul6]

Can't wait for all the "DAE think Windows sucks? xDDDD" posts.

 

[Gizametalman]

Oh boy, its time to watch porn in my phone instead.

No, seriously, is this an update?
If so I won't use the Internet for a long, long time.

 

[Deleted-355425]

LOL its affect the PC's at Chernobyl:

https://www.independent.co.uk/news/...clear-power-plant-danger-latest-a7810941.html

 

[EthanAddict]

That's why I use GANOO/LOOONIX

 

[Deleted-355425]

That's why I use GANOO/LOOONIX

Yeah you keep saying, you are not special... your mom lied to you.

 

[EthanAddict]

Yeah you keep saying, you are not special... your mom lied to you.

Yeah, I don't like to spend money on proprietary spyware, I prefer to spend money on guitar gear, at least I can practice something that will help me

 

[Deleted-355425]

Yeah, I don't like to spend money on proprietary spyware, I prefer to spend money on guitar gear, at least I can practice something that will help me

Cant argue with that.