NotPetya and WannaCry Call for a Joint Response from International Community
By NATO CCD COE Researchers
June 30, 2017
The global outbreak of NotPetya malware on 27 June 2017 hitting multiple organisations in Ukraine, Europe, US and possibly Russia can most likely be attributed to a state actor, concluded a group of NATO CCD COE researchers Bernhards Blumbergs, Tomáš Minárik, LTC Kris van der Meij and Lauri Lindström. Analysis of both recent large-scale campaigns WannaCry and NotPetya raises questions about possible response options of affected states and the international community.
According to Bernhards Blumbergs, researcher at the NATO CCD COE Technology Branch, NotPetya authors have acknowledged the drawbacks and mistakes of recent WannaCry ransomware. “In the case of NotPetya, significant improvements have been made to create a new breed of ultimate threat. Among all new features, the malware has been more professionally developed in contrast with sloppy WannaCry, and instead of scanning the whole Internet it is more targeted and searches for new hosts to infect deeper on local computer networks once initial breach has occurred,” said Blumbergs.
NotPetya malware was spread via drive-by exploit kits, e-mails with malicious attachments, embedded URI links, and compromised software update services (i.e. MeDoc accounting software update) to gain initial access to the host. Once the foothold has been established, the malware will extract plain-text credentials from the computer memory, use PsExec and WMIC tools for remote command execution, and employ leaked NSA exploits from Shadow Brokers, such as ETERNALBLUE exploit (MS17-010), to spread to other hosts on local network and escalate privileges. While Microsoft has released emergency patches for its operating systems, starting with Windows XP, unfortunately they have not been applied everywhere.
After seizing full control over its victim, NotPetya will trigger a reboot. Upon computer restart, encryption of file allocation tables is being carried out resembling a regular MS Windows utility performing system integrity checks. Malware will then request 300 USD worth of Bitcoins to provide a decryption key. Primary defence is ensured by having updated and patched systems, and browsing the Internet or working with e-mails with reasonable caution. However, in case of suspected infection, if computer unexpectedly reboots, it is suggested to unplug it from power or remove its battery and seek expert help to recover files from hard drive.
According to Tallinn Manual Countermeasures Require Attribution
In the case of the current campaign, international law analysis is similar to WannaCry campaign, with the caveat that accurate attribution is much more difficult. Nevertheless, NotPetya was probably launched by a state actor or a non-state actor with support or approval from a state. Other options are unlikely. The operation was not too complex, but still complex and expensive enough to have been prepared and executed by unaffiliated hackers for the sake of practice. Cyber criminals are not behind this either, as the method for collecting the ransom was so poorly designed that the ransom would probably not even cover the cost of the operation.
NATO’s Secretary General reaffirmed on 28 June that a cyber operation with consequences comparable to an armed attack can trigger Article 5 of the North Atlantic Treaty and responses might be with military means. However, there are no reports of such effects, so according to Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, self-defence or collective defence of victim states are not available options.
“If the operation could be linked to an ongoing international armed conflict, then law of armed conflict would apply, at least to the extent that injury or physical damage was caused by it, and with respect to possible direct participation in hostilities by civilian hackers, but so far there are reports of neither,” said Tomáš Minárik, researcher at NATO CCD COE Law Branch.
“There is a lack of a clear coercive element with respect to any government in the campaign, so prohibited intervention does not come into play. As important government systems have been targeted, then in case the operation is attributed to a state this could count as a violation of sovereignty. Consequently, this could be an internationally wrongful act, which might give the targeted states several options to respond with countermeasures,“ adds Minárik. A countermeasure is a state response that would otherwise be unlawful but for the fact that the state is responding to an internationally wrongful act attributable to another state. A countermeasure could be, for example, a cyber operation sabotaging the offending state’s government IT systems, but it does not necessarily have to be conducted by cyber means. In any case, the effects of a countermeasure must not amount to a use of force or affect third countries.
EU drafted this month a framework for a joint EU diplomatic response to malicious cyber activities which will make full use of measures within the Common Foreign and Security Policy.
Recent Campaigns Call for a Joint Response
As the extortion of money seems to be just a negligently prepared cover according to various news then the question about the motivation behind NotPetya attack should be looked from other perspectives. Even though the same vulnerability was used by WannaCry, the actors behind these two similar attacks are likely not the same. In both cases a possible financial gain for attackers has been more than modest. However, an effect was achieved, a large-scale successful disruptive attack almost globally, is almost identical in both cases.
“NotPetya is a sign that after WannaCry, yet another actor has exploited vulnerability exposed by the Shadow Brokers. Furthermore, it seems likely that the more sophisticated and expensive NotPetya campaign is a declaration of power - demonstration of the acquired disruptive capability and readiness to use it,” concluded Lauri Lindström, researcher at NATO CCD COE Strategy Branch.
We should also keep in mind that ransomware type of malware is highly visible for the end user while most of the other type of malicious software tries to remain as invisible as possible. NotPetya-like visible campaigns are great reminder that there is probably invisible malicious software operating in our networks that we know nothing about and there are no "silver bullets" - even big organizations can, and will, be hit when targeted.
WannaCry and NotPetya raise again the question about the possible response options of the international community. The number of affected countries shows that attackers are not intimidated by a possible global level investigation in response to their attacks. This might be an opportunity for victim nations to demonstrate the contrary by launching a special joint investigation.
Significant Facts on NotPetya Campaign
This brief reflects the independent views of NATO CCD COE researchers. This brief does not necessarily reflect the policy or the opinion of the NATO Cooperative Cyber Defence Centre of Excellence (the Centre), Sponsoring Nations and Contributing Participants of the Centre or NATO. The Centre may not be held responsible for any loss or harm arising from the use of information contained in this publication and is not responsible for the content of the external sources, including external websites referenced in this publication.
For further insight, please also learn about the analysis of WannaCry campaign by CCDCOE researchers.