Incident: Title: Bad Rabbit Ransomware Attack Hits Russian and Ukrainian Systems

Published Date: 2017-10-25

Postmortem Analysis
Timeline 1. The software failure incident of the Bad Rabbit ransomware attack happened in October 2017 as reported in Article 64159.
System 1. Adobe Flash update 2. NotPetya outbreak 3. EternalBlue exploit 4. The Shadow Brokers hacking group 5. Security products (e.g., Kaspersky, Symantec) [64159]
Responsible Organization 1. The entity responsible for causing the software failure incident was a malicious actor or group behind the creation and distribution of the Bad Rabbit ransomware attack [64159].
Impacted Organization 1. Kiev’s metro system [64159] 2. Russian media organisation Interfax [64159] 3. Odessa airport [64159]
Software Causes 1. The software failure incident was caused by the Bad Rabbit ransomware attack, which encrypted data on infected machines and demanded a payment for the decryption key [64159].
Non-software Causes 1. The Bad Rabbit ransomware attack was primarily spread through a fake Adobe Flash update placed on hacked Russian media outlets, relying on old-fashioned trickery to convince users to open it themselves [64159]. 2. The attack did not use any software exploits to run, instead relying on user interaction to install the malware [64159].
Impacts 1. The Bad Rabbit ransomware attack encrypted data on infected machines, demanding a payment of 0.05 bitcoin for the decryption key, affecting organizations like Kiev’s metro system, Russian media organization Interfax, and Odessa airport [64159]. 2. The attack primarily hit Russian businesses and spread through Russia, Ukraine, Poland, and Bulgaria, causing disruptions in operations and forcing organizations like Interfax to resort to alternative communication methods like Facebook during the outage [64159]. 3. The malware's distribution method relied on tricking users into installing a fake Adobe Flash update, which did not use software exploits to run, potentially leading to a wider spread of the attack [64159]. 4. Unlike the NotPetya attack, Bad Rabbit did not appear to be a "wiper" malware, as it reportedly decrypted the hard drive upon entry of the correct password, distinguishing it from the destructive nature of NotPetya [64159]. 5. The incident highlighted the need for improved cybersecurity measures and the continuous evolution of attack methods, emphasizing the importance of understanding attackers' motivations to shape effective security strategies [64159].
Preventions 1. Implementing strong cybersecurity measures such as regular software updates and patches to address vulnerabilities that could be exploited by malware like Bad Rabbit [64159]. 2. Educating users about the dangers of opening suspicious email attachments or clicking on links from unknown sources to prevent the initial installation of malware [64159]. 3. Using robust antivirus software from reputable vendors that can detect and block known malware threats like Bad Rabbit [64159]. 4. Employing network monitoring tools to detect unusual network activity that could indicate a malware infection spreading within corporate networks [64159].
Fixes 1. Implementing security patches and updates to address vulnerabilities exploited by the malware [64159]. 2. Enhancing cybersecurity measures within organizations to prevent similar targeted attacks on corporate networks [64159]. 3. Developing and deploying effective antivirus software capable of detecting and blocking the malware [64159]. 4. Educating users on cybersecurity best practices to avoid falling for social engineering tactics used to distribute malware [64159].
References 1. Kaspersky researchers [64159] 2. Russian security firm Kaspersky [64159] 3. Forbes magazine [64159] 4. UK’s National Cyber Security Centre [64159] 5. Carl Leonard, a principal analyst at Forcepoint [64159]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: The article reports that the Bad Rabbit ransomware attack in Russia and Ukraine bore similarities to the NotPetya outbreak that occurred in June. Both incidents involved malware encrypting data on infected machines and demanding a ransom for decryption keys. Researchers at Kaspersky noted that the methods used in the Bad Rabbit attack were similar to those used during the NotPetya attack, suggesting a link between the two incidents. Additionally, the web servers used to distribute the initial software for Bad Rabbit were previously linked to NotPetya, indicating a connection between the two attacks [64159]. (b) The software failure incident having happened again at multiple_organization: The article mentions that the NotPetya attack primarily targeted Ukraine, while the Bad Rabbit attack primarily hit Russian businesses. Bad Rabbit was initially seeded through a fake Adobe Flash update placed on hacked Russian media outlets and spread through Russia, Ukraine, Poland, and Bulgaria. This indicates that the Bad Rabbit attack affected multiple organizations in different countries, unlike the more targeted NotPetya attack [64159].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the case of the Bad Rabbit ransomware attack mentioned in Article 64159. The malware was distributed through a fake Adobe Flash update placed on hacked Russian media outlets, indicating a flaw in the design of the software update process that allowed the malware to infiltrate systems [64159]. (b) The software failure incident related to the operation phase is evident in the way the Bad Rabbit malware spread. It did not use any software exploits to run but relied on tricking users into opening a fake Adobe Flash update themselves. This highlights a failure in the operation or misuse of the system, as users were convinced to take actions that led to the installation of the malware [64159].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the Bad Rabbit ransomware attack can be categorized as within_system. The malware encrypted data on infected machines and demanded a ransom for the decryption key, indicating that the failure originated from within the system itself [64159]. Additionally, the malware's code contained pop culture references and a list of common passwords, showcasing characteristics embedded within the software [64159]. (b) outside_system: The software failure incident can also be attributed to factors outside the system. The attack was initiated through a fake Adobe Flash update placed on hacked Russian media outlets, highlighting an external entry point for the malware [64159]. Furthermore, the distribution of the malware did not rely on software exploits but rather on user trickery, indicating an external factor influencing the spread of the attack [64159].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident related to non-human actions: - The Bad Rabbit malware incident was a targeted attack against corporate networks, similar to the NotPetya outbreak, suggesting a link between the two attacks [64159]. - The malware's code contained pop culture references and a list of common passwords, indicating the use of automated methods and techniques in the attack [64159]. - The malware was initially seeded through a fake Adobe Flash update placed on hacked Russian media outlets, spreading through trickery rather than software exploits [64159]. (b) The software failure incident related to human actions: - The fake Adobe Flash update used to distribute the malware relied on convincing users to open it themselves, indicating a level of social engineering involved in the attack [64159]. - The NotPetya outbreak was suspected to be a "wiper" malware designed for damage and destruction rather than revenue, suggesting malicious intent behind the attack [64159]. - Security analysts highlighted the evolving methods of attackers, including the need to understand human points in these attacks, indicating a human element in the development and execution of cyber threats [64159].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The article does not specifically mention any hardware-related contributing factors that led to the software failure incident. Therefore, it is unknown if hardware played a role in this incident. (b) The software failure incident related to software: - The software failure incident, in this case, is caused by the "Bad Rabbit" malware, which is a form of ransomware encrypting data on infected machines and demanding a ransom for decryption [64159]. - The malware's code contains pop culture references and uses methods similar to the NotPetya attack, suggesting a link between the two incidents [64159]. - The malware was initially seeded through a fake Adobe Flash update placed on hacked Russian media outlets, and it spreads through trickery rather than software exploits [64159]. - Unlike NotPetya, Bad Rabbit does decrypt the hard drive upon entry of the correct password, indicating a different behavior in terms of software functionality [64159].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the Bad Rabbit ransomware attack can be categorized as malicious. The incident involved a ransomware attack that encrypted data on infected machines and demanded a payment for the decryption key [64159]. The malware was designed to target corporate networks, similar to the NotPetya attack, and was distributed through fake Adobe Flash updates on hacked Russian media outlets [64159]. The attack was orchestrated with the intent to cause harm and generate revenue for the developers through ransom payments. (b) The software failure incident was not non-malicious as it was a deliberate attack aimed at infecting systems and extorting money from victims. The malware used various methods to spread and infect machines, indicating a malicious intent behind the incident [64159].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the Bad Rabbit ransomware attack appears to have been an intentional and targeted attack against corporate networks. The malware was designed to encrypt data on infected machines and demand a ransom for the decryption key. The attack was seeded through a fake Adobe Flash update placed on hacked Russian media outlets, indicating a deliberate effort to spread the malware. Additionally, the malware's code contained pop culture references and specific passwords to try while spreading, suggesting a level of planning and intent behind the attack [64159].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence can be seen in the case of the Bad Rabbit ransomware attack mentioned in Article 64159. The malware was designed to encrypt data on infected machines and demand a ransom for decryption. The malware's code included pop culture references and passwords commonly used by individuals, indicating a level of sophistication and planning by the attackers. Additionally, the attack was targeted against corporate networks, suggesting a deliberate and well-thought-out strategy by the perpetrators [64159]. (b) The software failure incident related to accidental factors can be observed in the distribution method of the Bad Rabbit ransomware attack. Unlike the NotPetya attack that used sophisticated software exploits, Bad Rabbit relied on tricking users into installing a fake Adobe Flash update. This method of distribution was more reliant on user interaction rather than exploiting software vulnerabilities, indicating a more accidental approach to spreading the malware [64159].
Duration temporary The software failure incident related to the Bad Rabbit ransomware attack mentioned in Article 64159 can be categorized as a temporary failure. This is evident from the fact that the Bad Rabbit malware reportedly decrypts the hard drive upon entry of the correct password, indicating that the data can be recovered and the system can be restored [64159]. Additionally, the malware does not appear to be a "wiper" like the NotPetya malware, which was designed to cause irreparable damage [64159].
Behaviour crash, omission, value, other (a) crash: The software failure incident related to the Bad Rabbit ransomware attack can be categorized as a crash. The malware encrypts data on infected machines, causing the system to lose its state and not perform its intended functions [64159]. (b) omission: The software failure incident can also be linked to omission as the malware omits to perform the intended functions by encrypting data and demanding a ransom for decryption, thereby hindering normal system operations [64159]. (c) timing: The timing of the software failure incident is not specifically mentioned in the articles. Therefore, it is unknown if the failure was due to the system performing its intended functions too late or too early. (d) value: The software failure incident can be associated with a failure in value as the system performs its intended functions incorrectly by encrypting data and demanding a ransom for decryption, causing harm to the affected organizations [64159]. (e) byzantine: The software failure incident does not exhibit characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The behavior of the malware is consistent in encrypting data and demanding a ransom [64159]. (f) other: The other behavior exhibited by the software failure incident is the use of pop culture references in the malware's code, such as names of dragons from Game of Thrones and passwords related to the movie "Hackers." This unique behavior adds a layer of complexity and creativity to the attack [64159].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving the Bad Rabbit ransomware attack resulted in the encryption of data on infected machines, demanding a payment of 0.05 bitcoin for the decryption key [64159]. This impacted various organizations such as Kiev’s metro system, Russian media organization Interfax, and Odessa airport, with Interfax being forced to publish to its Facebook page during the outage as its servers were taken offline for a number of hours [64159]. Additionally, the malware's code included pop culture references and a list of passwords it tried while spreading, indicating the potential loss or compromise of sensitive data [64159].
Domain information (a) The failed system in the reported software failure incident was intended to support the information industry. The malware attack affected various organizations involved in information dissemination and media services, such as Russian media organization Interfax [64159].

Sources

Back to List