Dan Daggett sgviking

NotPetya: Ransomware Or a Cyber Attack in Disguise Panel

Talking notes from recent BrightTALK panel I was invited to participate in.

Aftermath/Lessons learned

NotPetya took advantage of weakness in security architecture. The type of weaknesses that security professionals know about but often are not empowered to change or are simply too busy to change. Lesley Carhart wrote a great blog article "Why NotPetya Kept Me Awake (& You Should Worry Too)”

From that article:

git clone https://github.com/andrew-d/static-binaries
cd static-binaries/nmap
docker build -t staticnmap .
docker run -v $(pwd):/output staticnmap  # take a nap
cd linux/x86_64
./nmap 127.0.0.1

	#!/usr/bin/env python3

	import argparse
	import json
	import requests
	import os


	VERSION = '1.1.0'
	API_KEY = ''

	#!/usr/bin/env python3

	import argparse
	import configparser
	import json
	import subprocess
	import sys
	import os
	import requests

	#!/usr/bin/env python3

	import csv
	import sys
	import os
	import argparse


	def csv_dictionary(filename):
	clusters = []

	#!/usr/bin/env python

	# 0B E5
	# 4D E2
	quack = b""
	with open('newflag', 'rb') as f:
	while True:
	oldpos = f.tell()
	byte = f.read(1)
	newpos = f.tell()

	#!/usr/bin/env bash

	# Usage: ./fm.sh 98.3

	rtl_fm -M fm -s 200k -A fast -r 48k -f $1M \| play -r 48k -t raw -e s -b 16 -c 1 -V1 -

	#!/usr/bin/env bash

	rtl_fm -M fm -f 163.228M -s 22050 -g 100 -l 310 \| multimon-ng -t raw -a POCSAG1200 -f alpha /dev/stdin

	#!/usr/bin/env bash

	rtl_fm -M fm -f 460.557M -f 460.432M -f 453.588M -f 460.188M -s 12k -g 50 -l 70 \| play -r 12k -t raw -e s -b 16 -c 1 -V1 -

	<?php
	passthru("cat flag.php");
	?>