Petya: What the UofT Community Should Know About the Ongoing Malware Epidemic

Alex Dean Cybulski Blog, Good to know alerts from U of T

A massive malware outbreak known as Petya is currently infecting computer systems in numerous countries across the world.

Petya targets un-patched Microsoft Windows computers and then locks (encrypts) the machine’s contents from the user – pending the payment of a ransom. At present, the e-mail address used to pay the ransom is disabled making it impossible to pay the criminals running this software in exchange for encrypted data. While it is never recommended that users pay a criminal to recover their files, this means that files encrypted by this malware are permanently irretrievable. Recent evidence even suggests that the malware was never designed to allow users to recover their files.

Petya propagates by identifying and infecting other machines on a network, including those which are patched against the SMB vulnerability, making it critical that all systems be patched and up to date.

What U of T is doing:

Defenses are in place at multiple network locations/gateways to block incoming attacks.

The information security team is constantly scanning the university networks to identify unpatched equipment, primarily using outdated and unsupported operating systems such as Windows XP, and to notify appropriate administrators about the need to patch the devices.

What you should do:

  • Keep your devices up-to-date. Install security updates and patches, particularly those identified as being “critical.” Consider ALL your devices, not just machines used at work.
  • Maintain backups. The existence and integrity of data and system backups is critical to protecting your data and maintaining availability in case of a compromised device. If you are unsure as to whether your devices are backed up, check with your local IT team.

For additional information and support, please contact your local IT team. Additional resources are available from the information security department and at the security awareness site.

Featured image: “Petya Hungers”, is a derivative of “City-eating Kaiju” by Unosombrero, used under CC BY. “City-eating Kaiju” is licensed under CC BY by Alex Dean Cybulski.