Tag Archives: EternalBlue

U.S. sanctions against Russian cybersecurity companies

Leave a reply

I never thought that I will write here about state sanctions. Usually I try to ignore political topics. But now it’s necessary. Yesterday OFAC introduced sanctions against 5 Russian companies.

Treasury Sanctions Russian Federal Security Service Enablers

I would like to mention 3 of them:

Continue reading →

Vulnerability Management vendors and massive Malware attacks (following the Bad Rabbit)

4 Replies

After the latest Bad Rabbit ransomware attack all Top VM vendors Qualys, Tenable, Rapid7 wrote blog posts on this topic on the same day. Two days later Tripwire also published own  review. Why do they care? They do not make antiviruses, endpoint protection or firewalls – the common tools against this kind of threats. So, what’s the point?

VM vendors BadRabbit

Well, they do it is obviously to promote their products and services. But how exactly?

Continue reading →

Petya the Great and why *they* don’t patch vulnerabilities

8 Replies

I really like this. Just imagine. Quiet, routine, everyday Vulnerability Management process in organizations: scanning-patching, scanning-patching, scanning-patching… And then. Suddenly! PEEETYYA!!!

And at very same moment everything changes. People from different companies start to communicate with each other actively, reverse this new malware, share the data, write and share tools for detection and recovery. Security professional is a friend, a brother and a source of useful information for security professional. Real movement! Real community! =)

Petya ransomware

For example, my friends from Vulners.com created pretty popular gist about Petya (petrWrap, notPetya, GoldenEye) and updated in real time for several hours.

Vulners Petya gist

My former colleagues from Positive Technologies released detailed technical review of this ransomware (in Russian) few hours since the outbreak started, at 01:00 am . They also found a local kill switch, and probably were the first one. Simultaneously with Amit Serper from Cybereason.

Continue reading →

WannaCry about Vulnerability Management

11 Replies

Nearly all mainstream media wrote today about massive ransomware attacks around the world: 16 medical institutions in UK, strong rumours that huge companies in Russia, and even Russian Ministry of Internal Affairs suffered a damage.

At this moment Kaspersky recorded more than 45,000 attacks in 74 countries around the world, but mostly in Russia. During the attack WannaCry malware encrypts data with the extension “.WCRY” added to the filename – that’s why it is called this way.

WannaCry CryptoLocker

What I like in this WannaCry story, that it’s actually all about Vulnerability Management.

Continue reading →