Cybereason security researcher Amit Serper has found a way to prevent the Petya ransomware from infecting computers, according to Bleeping Computer.
The ransomware has been wreaking havoc across the globe since yesterday, locking hard drive MFT and MBR sections and preventing computers from booting. Unless victims opted to pay a ransom (which is now pointless and not recommended), there was no way to recover their systems.
Initially, researchers believed this new ransomware was a new version of an older threat called Petya, but they later discovered that this was a new strain altogether, which borrowed some code from Petya, hence the reason why they recently started it calling it NotPetya.
Because of the ransomware’s global outreach, many researchers flocked to analyse it, hoping to find a loophole in its encryption or a killswitch domain that would stop it from spreading, similar to WannaCry.
While analysing the ransomware’s inner workings, Serper was the first to discover that NotPetya would search for a local file and would exit its encryption routine if that file already existed on disk.
Bleeping Computer report says the researcher’s initial findings have been later confirmed by other security researchers, such as PT Security, TrustedSec, and Emsisoft.
This means victims can create that file on their PCs, set it to read-only, and block the NotPetya ransomware from executing.
While this does prevent the ransomware from running, this method is more of a vaccination then a kill switch. This is because each computer user must independently create this file, compared to a “switch” that the ransomware developer could turn on to globally prevent all ransomware infections.
To vaccinate your computer so that you are unable to get infected with the current strain of NotPetya/Petya/Petna (yeah, this naming is annoying), simply create a file called perfc in the C:\Windows folder and make it read only. For those who want a quick and easy way to perform this task, owner of Bleeping Computer Lawrence Abrams has created a batch file that performs this step for you.
This batch file can be found at: https://download.bleepingcomputer.com/bats/nopetyavac.bat
Ransomware and the evolving threat landscape will be among the key topics discussed at Tahawul Tech’s upcoming CSO Perspectives Conference. For more details go to: http://www.tahawultech.com/events/cso-perspective-conference/
