Home Open Sauce Ransomware: Hackers try to sow doubts about nation-state theory

Author's Opinion

The views in this column are those of the author and do not necessarily reflect the views of iTWire.

Have your say and comment below.

Ransomware: Hackers try to sow doubts about nation-state theory

The people behind the last malware attack, which began in Europe and then spread to other regions, appear to be trying to play down the theory that the attack was masterminded by a nation state.

By making an offer via the Motherboard website, that they would decrypt files which were encrypted during an attack for 100 Bitcoin (US$250,000), the attackers have brought the narrative back to ransomware.

Security firms initially concluded that the malware used in the attack — which has been variously named Petya (nomenclature given to ransomware that already exists), NotPetya, ExPetr, Nyetya and GoldenEye — was ransomware.

They later said that it was a disk-wiper as in many cases it was wiping the master boot record of Windows computers making the machines unbootable.

But the attackers, who were contacted by Motherboard, have now attempted to create confusion by actually decrypting one file for the website, a 200k sample.

truth and lies

This, plus the 100 Bitcoin decryption offer, only means one thing: that the attackers are trying to shift the narrative from that of being a nation-state attack to one of being just run-of-the-mill ransomware, though on a much larger scale than usual.

The effort to create confusion in the minds of researchers was highlighted in this iTWire report about the findings by F-Secure.

One of its researchers, Andy Patel, was left scratching his head and asking: "At the end of the day, if someone wanted to build a 'wiper', why build an almost functional ransomware, save for a few bugs and a possibly misconfigured final package?"

Patel posed this query after he found that while the encryption-decryption code for the master boot record did not work, the code for carrying out the same function on system files was working.

Whether the attackers succeed in sowing doubt in people's minds about the nature of the attack — ransomware or a nation-state effort to destroy data — will depend on how many media outlets blindly repeat the story that was published by Motherboard without questioning the motives behind the attackers' move.

LEARN NBN TRICKS AND TRAPS WITH FREE NBN SURVIVAL GUIDE

Did you know: Key business communication services may not work on the NBN?

Would your office survive without a phone, fax or email?

Avoid disruption and despair for your business.

Learn the NBN tricks and traps with your FREE 10-page NBN Business Survival Guide

The NBN Business Survival Guide answers your key questions:

· When can I get NBN?
· Will my business phones work?
· Will fax & EFTPOS be affected?
· How much will NBN cost?
· When should I start preparing?

DOWNLOAD NOW!

Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.