Petya Ransomware Made Over with an EternalBlue Palette

Months after the hacker group calling itself the Shadow Brokers released it most significant dump of NSA secrets, the world is still feeling the effects of this leak. The April leak contained the EternalBlue vulnerability which involved the Microsoft file sharing protocol Microsoft Server Message Block 1.0. The protocol allows applications to read and write to files and request services that are on the same network.

The EternalBlue exploit first became infamous during the WannaCry ransomware outbreak in May of this year. The ransomware took advantage of Microsoft computers that had not yet had their operating system updated with the patch that plugged the EternalBlue hole and brought state institutions around the world such as the United Kingdom’s National Health Service, Spain’s Telefónica, as well major businesses such as FedEx and Deutsche Bahn to their knees. Fortunately, the ransomware had a number of fatal flaws, including a kill switch that was eventually discovered and used to hamper the virus’s spread.

Enter Petya (or NotPetya, or GoldenEye, or PetrWrap), which has actually been on the scene since early 2016 but received some upgrades to take advantage of the EternalBlue exploit this week. The malware has two parts: the first bit of code infects the master boot record and attempts to locate and encrypt the master file table (the database that contains records of each file and directory on an NTFS formatted disk), while the second encrypts the entire hard disk in the event that the first cannot locate the master file table. This worm is more sophisticated than the WannaCry virus and no method for removing it has been discovered yet; however, after the devastating effects of WannaCry, Petya is finding fewer targets to infect as most companies have since patched their Windows machines. Even so, Ukrainian power companies, airports, public transit, and their central bank have been affected, as well as Russian oil company Rosnoft, and institutions in India, Spain, France, the United Kingdom, and more.

No one but the individuals responsible for creating and spreading the WannaCry and Petya worms can be blamed for the chaos they have created but these events highlight some greater security questions. The EternalBlue exploit was leaked and made public by the Shadow Broker group but the knowledge was stolen from the NSA. Who is to blame? The hacker group that revealed to the general public a dangerous bug present in a majority of computers worldwide? Or the government agency that discovered the vulnerability and chose to exploit it for its own purposes instead of informing Microsoft in order to protect citizens?