Ukraine Police Say This is the Source of Tuesday’s Massive Cyberattack
Razvan Muresan, a Bitdefender public relations specialist is backdropped by a screenshot of the message displayed on computers affected by the latest cyberattack, in Bucharest, Romania, Wednesday, June 28, 2017. Vadim Ghirda/AP
The lesson from Tuesday’s massive cyberattack, beware of updates from Ukrainian accounting apps that are orders of magnitude larger than normal.
A vulnerability within an obscure piece of Ukrainian accounting software is the root cause of the massive cyberattack that swept the globe Tuesday, according to the Ukrainian law enforcement. The attack hit Ukrainian utilities and airline services, U.S. based pharmaceutical company Merck, Russian oil giant Rosneft and even forced operators at the Chernobyl nuclear power plant to switch to manual radiation monitoring of the site.
The software is called Me.DOC, it’s basically an application for tax reporting and filing for companies that do business in Ukraine. At about 10:30 a.m. GMT Tuesday. MeDoc ran an automatic update on the software, a routine event. That connected every version of Me.Doc on every computer on which it had been installed (so long as it was online) to this address: 92.60.184.55.
That by itself is not unusual.
As the Ukrainian police’s cyber division explained in a Facebook post on Tuesday, updates from Me.DOC are usually rather small, about 300 bytes. The update on Tuesday morning ran 333 kilobytes, orders of magnitude larger.
Once host computers download the update—becoming infected—the malware creates a new file called Rundll32.exe. Next it contacts a different network. It then starts running new commands, taking advantage of a particular Windows vulnerability, the same Microsoft vulnerability targeted by Wannacry.
Defense One verified the Ukrainian police’s post with a second researcher who had direct knowledge of the attack and the malware in question.
Other cybersecurity researchers with Russia-based Kaspersky Labs also began pointing to Me.DOC on Tuesday as the likely point of spread.
At this point, no one has claimed responsibility for the attack and authorities have yet to make a hard determination about attribution. Actors backed by the Russian government have been targeting portions of Ukrainian infrastructure since 2015 when a massive attack by a group knocked out power to more than 225,000 people in Ukraine. Hackers pulled a similar stunt in December, a story first reported by Defense One.