Are You Aware of Cyber Danger? The Petya Virus

The kill switch for Petya, the second global cyberattack in the past month, is still being investigated. Beginning in Ukraine on 27 June, the attack affected more than two thousand computers in just 2 days.

In May 2017, Britain’s healthcare systemswere targeted, followed by many other countries, by wanna cry , a virus used in a cyberattack. In our previous article, we warned that further cyberattacks might follow. This attack infiltrated systems by disguising its virus as an innocent-looking email attachment. Once activated, it encrypted important files and demanded a ransom to an untraceable account in virtual currency - bitcoin . Reports stated that worldwide it affected 200.000 computers. Some companies accepted data loss, while others, such as a firm in South Korea, 1 million dollars agreed to pay approximately that amount.

Just as Wanna Cry Ended, the Petya Virus Appeared

Before even 1 month had passed, on 27.06.2017 another cyberattack successfully infiltrated through the same vulnerability in Microsoft Windows. According to researchers, this virus, called NotPetya / Petya , has already disrupted systems in many countries, particularly Ukraine, Russia and America. In Ukraine, systems in many institutions, including government departments, were locked, some metro services stopped, and even at the Chernobyl Nuclear Power Plant, computers stopped and leakage measurements are being made manually. The United States pharmaceutical company Merck , the French rail company SNCF, the Dutch delivery company TNT, the Danish transport company Moller-Maersk, the United States-based food company Mondelezand the United States law firm DLA Piper are affected by the Petya virus.

Screenshot of a computer infected with Petya whose files were encrypted

Common features of affected companies include not updating software and having continuously operating systems, such as airports.

Did the Petya Virus Hit Türkiye?

Türkiye was also affected by this global cyberattack, but only %1 of the attack affected our country. Some private banking systems are reported affected. The relatively limited impact is attributed to most companies using shared email systems being closed for the holiday. There are concerns that this figure may rise rapidly.

What Will Happen to Encrypted Files?

According to Kaspersky researchers, because this virus differs from the Petya ransomware that emerged in 2016, it is called NotPetya . Its software type is classified as a Wiper , meaning Cleaner , because encrypted files cannot be recovered. People paying a 300-dollar ransom to escape the virus will not recover files as expected. The virus’s central email address was closed, so the decryption key (private key) cannot be obtained and the 300-dollar payment will yield nothing.

As pharmaceutical company Merck’s Twitter statement indicates, the attack continues and no data recovery method has yet been found. Experts state that encrypted data are effectively gone because the “key” cannot be obtained.

The only solution is preventing the virus entering the system. Necessary steps include:

How Can We Protect Against Petya and Other Virus Attacks?

Situational awareness must first be high. A virus entering one computer on a shared network will spread to and lock all computers on that network. Not opening emails from unknown senders is a primary precaution. Set operating system updates to automatic to keep systems current. Antivirus programs, if used, must also be updated. To avoid the effects of a possible attack, at regular intervals, be sure to back up files .

Update Dated 01 July 2017

The Information and Communication Technologies Authority (BTK) published a warning, stating that Petya malware exploited a vulnerability in Microsoft Officethrough (CVE-2017-0199) to embed itself in office documents sent as attachments to fraudulent emails.

Merck stated on 30 June that it had made good progress against the attack and integrated a system to meet customer needs. The company added that United States government reports indicated the malware’s unique character sequence allowed it to infiltrate systems despite software updates.

Merck currently conducts over 3 thousand clinical trials worldwide, a substantial portion on cancer treatment. The attacks risk endangering the health of patients participating in these trials.

Microsoft stated that the vulnerability had been fixed and that customers using Windows 10 should not worry about viruses.

Computers have a disk-checking tool that takes approximately 1 hour depending on hard disk size, called CHKDSK . According to software experts, the virus creates a fake CHKDSK screen and spends 1 hour identifying other computers to which it can spread (see the figure above). Cutting power when this screen appears stops spread, limiting data loss to one computer.