n this picture taken on March 5, 2015, employees work at the headquarters of Bitdefender, a leading Romanian cyber security company, in Bucharest, Romania. Romania, the eastern European country, known more for economic disarray than technological prowess. AP / OCTAV GANEA
Ukraine Police Say This is the Source of Tuesday’s Massive Cyber Attack
The lesson from Tuesday’s massive cyber attack, beware of updates from Ukrainian accounting apps that are orders of magnitude larger than normal.
A vulnerability within an obscure piece of Ukrainian accounting software is the root cause of the massive cyber attack that swept the globe Tuesday, according to the Ukrainian law enforcement. The attack hit Ukrainian utilities and airline services, U.S. based pharmaceutical company Merck, Russian oil giant Rosneft and even forced operators at the Chernobyl nuclear power plant to switch to manual radiation monitoring of the site.
The software is called Me.DOC, it’s basically an application for tax reporting and filing for companies that do business in Ukraine. At about 10:30 a.m. GMT Tuesday. MeDoc ran an automatic update on the software, a routine event. That connected every version of Me.Doc on every computer on which it had been installed (so long as it was online) to this address: 92.60.184.55.
That by itself is not unusual.
As the Ukrainian police’s cyber division explained in a Facebook post on Tuesday, updates from Me.doc are usually rather small, about 300 bytes. The update on Tuesday morning ran 333 kilobytes, orders of magnitude larger.
Once host computers download the update — becoming infected — the malware creates a new file called Rundll32.exe. Next it contacts a different network. It then starts running new commands, taking advantage of a particular Windows vulnerability, the same Microsoft vulnerability, called EternalBlue SMB, targeted by Wannacry. The National Security Agency detected the vulnerability and it was contained in a group of stolen documents that made their way onto the Web via a group called the Shadowbrokers. However, the NSA did disclose the vulnerability to Microsoft, which issued a patch, long before the Wannacry virus spread.
Defense One verified the Ukrainian police’s post with a second researcher who had direct knowledge of the attack and the malware in question.
Other cyber security researchers with Russia-based Kaspersky Labs also began pointing to Me.DOC on Tuesday as the likely point of spread.
At this point, no one has claimed responsibility for the attack and authorities have yet to make a hard determination about attribution. Actors backed by the Russian government have been targeting portions of Ukrainian infrastructure since 2015 when a massive attack by a group knocked out power to more than 225,000 people in Ukraine. Hackers pulled a similar stunt in December, a story first reported by Defense One. But Wannacry has been linked to actors outside of Russia, namely North Korea. It's a finding that some researchers dispute.