Wiper (malware)

Malware designed to erase files on the host computer

In computer security, a wiper is a class of malware intended to erase (wipe, hence the name) the hard drive or other static memory of the computer it infects, maliciously deleting data and programs.

## Examples

[edit]

A piece of malware referred to as "Wiper" was allegedly used in attacks against Iranian oil companies. In 2012, the International Telecommunication Union supplied Kaspersky Lab with hard drives allegedly damaged by Wiper for analysis. While a sample of the alleged malware could not be found, Kaspersky discovered traces of a separate piece of malware known as Flame.[1][2][3]

The Shamoon malware contained a disk wiping mechanism; it was employed in 2012 and 2016 malware attacks targeting Saudi energy companies, and utilized a commercial direct drive access driver known as Rawdisk. The original variant overwrote files with portions of an image of a burning U.S. flag. The 2016 variant was nearly identical, except using an image of the body of Alan Kurdi instead.[4][5]

A wiping component was used as part of the malware employed by the Lazarus Group—a cybercrime group with alleged ties to North Korea, during the 2013 South Korea cyberattack, and the 2014 Sony Pictures hack.[6][7][8] The Sony hack also utilized RawDisk.[4]

In 2017, computers in several countries—most prominently Ukraine, were infected by NotPetya, which is a variant of the Petya ransomware that was a wiper in functional sense. The malware infects the master boot record with a payload that encrypts the internal file table of the NTFS file system. Although it still demanded a ransom, it was found that the code had been significantly modified so that the payload could not actually revert its changes, even if the ransom were successfully paid.[9][10]

Several variants of wiper malware were discovered during the 2022 Ukraine cyberattacks on computer systems associated with Ukraine. Named CaddyWiper, HermeticWiper, IsaacWiper, and FoxBlade by researchers, the programs showed little relation to each other, prompting speculation that they were created by different state-sponsored actors in Russia especially for this occasion.[11]

## Solution

[edit]

Reactive redundancy is a possible solution for data destruction protection. Researchers are able to create systems capable of analyzing write buffers before they reach a storage medium, determine if the write is destructive, and preserve the data under destruction.[12] Moreover regular backups (as long as stored on an external device) provide the ability to restore lost data.

## References

[edit]

1. ^ "Destructive Malware - Five Wipers in the Spotlight". Securelist. Retrieved 2017-07-03.
2. ^ Zetter, Kim. "Wiper Malware That Hit Iran Left Possible Clues of Its Origins". Wired.com. Retrieved 2017-07-03.
3. ^ Erdbrink, Thomas (23 April 2012). "Facing Cyberattack, Iranian Officials Disconnect Some Oil Terminals From Internet". The New York Times. Archived from the original on 31 May 2012. Retrieved 29 May 2012.
4. ^ a b "Shamoon wiper malware returns with a vengeance". Ars Technica. Retrieved 2017-07-03.
5. ^ Perlroth, Nicole (2012-08-24). "Among Digital Crumbs from Saudi Aramco Cyberattack, Image of Burning U.S. Flag". Bits. The New York Times. Retrieved 2017-07-03.
6. ^ "Inside the "wiper" malware that brought Sony Pictures to its knees [Update]". Ars Technica. Retrieved 2017-07-03.
7. ^ Palilery, Jose (December 24, 2014). "What caused Sony hack: What we know now". CNNMoney. Retrieved January 4, 2015.
8. ^ Zetter, Kim. "The Sony Hackers Were Causing Mayhem Years Before They Hit the Company". Wired. Retrieved 2017-07-03.
9. ^ "Tuesday's massive ransomware outbreak was, in fact, something much worse". Ars Technica. 28 June 2017. Retrieved 2017-06-28.
10. ^ "Cyber-attack was about data and not money, say experts". BBC News. 29 June 2017. Retrieved 29 June 2017.
11. ^ "Sicherheitsforscher finden neue Zerstörungs-Malware auf ukrainischen Computersystemen". standard.at. Retrieved 2022-03-15.
12. ^ Gutierrez, Christopher N.; Spafford, Eugene H.; Bagchi, Saurabh; Yurek, Thomas (2018-05-01). "Reactive redundancy for data destruction protection (R2D2)". Computers & Security. 74: 184–201\. doi:10.1016/j.cose.2017.12.012. ISSN 0167-4048.

* v
* t
* e

Information security

Related security categories|

* Computer security
* Automotive security
* Cybercrime
* Cybersex trafficking
* Computer fraud
* Cybergeddon
* Cyberterrorism
* Cyberwarfare
* Electronic warfare
* Information warfare
* Internet security
* Mobile security
* Network security
* Copy protection
* Digital rights management

vectorial version

Threats|

* Adware
* Advanced persistent threat
* Arbitrary code execution
* Backdoors
* Bombs
* Fork
* Logic
* Time
* Zip
* Hardware backdoors
* Code injection
* Crimeware
* Cross-site scripting
* Cross-site leaks
* DOM clobbering
* History sniffing
* Cryptojacking
* Botnets
* Data breach
* Drive-by download
* Browser Helper Objects
* Viruses
* Data scraping
* Denial-of-service attack
* Eavesdropping
* Email fraud
* Email spoofing
* Exploits
* Fraudulent dialers
* Hacktivism
* Infostealer
* Insecure direct object reference
* Keystroke loggers
* Malware
* Payload
* Phishing
* Voice
* Polymorphic engine
* Privilege escalation
* Ransomware
* Rootkits
* Scareware
* Shellcode
* Spamming
* Social engineering
* Spyware
* Software bugs
* Trojan horses
* Hardware Trojans
* Remote access trojans
* Vulnerability
* Web shells
* Wiper
* Worms
* SQL injection
* Rogue security software
* Zombie

Defenses|

* Application security
* Secure coding
* Secure by default
* Secure by design
* Misuse case
* Computer access control
* Authentication
* Multi-factor authentication
* Authorization
* Computer security software
* Antivirus software
* Security-focused operating system
* Data-centric security
* Software obfuscation
* Data masking
* Encryption
* Firewall
* Intrusion detection system
* Host-based intrusion detection system (HIDS)
* Anomaly detection
* Information security management
* Information risk management
* Security information and event management (SIEM)
* Runtime application self-protection
* Site isolation

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template