CryptoLocker Prevention

[TechMonkey]

I've used this and it allows easy updating of the file groups

[fiza]

I've used this and it allows easy updating of the file groups

 

reddit blocked here

[TechMonkey]

Github?

 

Or Google Drive

[synaesthesia]

Just be wary of how you block the scripts, very easy to apply a blanket block before realising it might have some effects on scripts you use yourself, logon scripts, MDT deployment/task sequence scripts etc....

(guess who made that mistake? ) - many of these use Windows Script Host, .hta files etc.

[kennysarmy]

To me, the protection against cryptolocker and other malware/viruses is a lot bigger than just SRP's. Viruses and malware have multiple attack vectors, with browser plugins being one of the most targeted (cryptolockers main infection path is adobe flash exploitation). SRP's are good protection but there doesn't seem to be much other than them mentioned in this thread. Below is my checklist I have put together on some other protection methods in order of importance to provide defence in depth.

 

Backups	Make sure all backups are regularly done and have adequate retention age.
Educate Staff	Make sure all staff are cautious on opening email attachments and links, and know what to look for
Patch OS and Plugins	Make sure all windows and browser updates are applied and any plugins are installed sparingly, and updated Check any old versions have been removed Cleanup Script Below on error resume next dim WshShell dim RegKey dim ScriptVerKey Set WshShell = CreateObject("WScript.Shell") 'checks to see if registry key exists, if it does, the cleanup runs. RegKey = "HKLM\SOFTWARE\EDU\Cleanup" ScriptVerKey = WshShell.RegRead(RegKey & "JAVAOldVer") if ScriptVerKey <> "1" Then Cleanup() Else WScript.Quit End If Sub Cleanup() ' Uninstall REM Uninstall Java 8 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218051F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418051F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 45 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218045F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 45 - 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418045F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 31 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218031F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 31 - 32 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418031F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 25 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218025F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 25 - 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418025F0} /q",1,True ' Uninstall REM Java 7 Update 67 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F03217067FF} /q",1,True ' Uninstall REM Java 7 Update 60 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F03217060FF} /q",1,True ' Uninstall REM Java 7 Update 55 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217055FF} /q",1,True ' Uninstall REM Java 7 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217051FF} /q",1,True ' Uninstall REM Java 7 Update 45 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217045FF} /q",1,True ' Uninstall REM Java 7 Update 40 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217040FF} /q",1,True ' Uninstall REM Java 7 Update 40 – 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86417040FF} /q",1,True ' Uninstall REM Java 7 Update 25 – 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86417025FF} /q",1,True ' Uninstall REM Java SE Development Kit 7 Update 5 WshShell.Run "msiexec /x {32A3A4F4-B792-11D6-A78A-00B0D0170050} /q",1,True ' Uninstall REM Java SE Development Kit 7 Update 45 WshShell.Run "msiexec /x {32A3A4F4-B792-11D6-A78A-00B0D0170450} /q",1,True ' Uninstall REM Adobe Flash Player 11 Plugin WshShell.Run "msiExec.exe /X{9BFB1FAB-8FC4-4FAA-9B2D-2B121834B659} /q",1,True 'regkey below stops the script from running again WshShell.RegWrite "HKLM\Software\EDU", "Default" WshShell.RegWrite "HKLM\Software\EDU\Cleanup", "Default" WshShell.RegWrite "HKLM\Software\EDU\Cleanup\JAVAOldVer", 1, "REG_SZ" End Sub
AntiVirus	Make Sure Antivirus is up to date and active scanning enabled on all machines
UTM	Check Virus/Malware scanning is enabled for HTTP/HTTPS traffic as well as email. Enable Greylisting ( builds and uses a database of ’known-good’ SMTP hosts that resend messages after receiving a temporary error) Enable BATV (Bounce Address Tag Validation) signs the reverse path of outgoing email, so it is possible to detect and drop spam and virus backscatter) Enable SPF check querying allowed sending hosts for a domain from DNS.
User Privileges	Make sure all users have the bare minimum file permissions needed to perform their job. This will help reduce what can be infected
ACLS	Set ACL's on VLANS to reduce what can be accessed by each machine. This will help reduce infection rate
Enable Click to run for Internet Explorer	Create Registry Key through GPO Preferences under User config for both staff and students HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore\AllowedDomains\RandomSite
Enable Click to run for Chrome	GPO User Configuration\Administrative Templates\Google\Google Chrome\Content Settings\setting="Click to play"
Disable Macros in MS Office	Set the below for each office application in the users GPO User Configuration->Administrative Templates->Classic Administrative Templates(ADM)->Microsoft Excel 2010->Excel Options->Security->Trust Center->VBA Macro Notification Setting
Block Malicious filetypes on Email	Block Malicious file types being sent on Email including Zip's EXE's etc
Software Restriction Policy	Disallowed by default Whitelist the below C:\Program Files (X86) C:\Program Files C:\Windows C:\Program Data Network Shares
File Screening	Enable file screening for shared and home drives, blocking any malicious file extensions
USB Security	Check SRP's and AV protect against malicious USB's
BIOS Security	Checkboot from USB is disabled, all Bios updates have been done and password protected

 

Has anyone done this:

 

Enable Click to run for Chrome GPO User Configuration\Administrative Templates\Google\Google Chrome\Content Settings\setting="Click to play"

Disable Macros in MS Office Set the below for each office application in the users GPO

[DrCheese]

I've used this and it allows easy updating of the file groups

 

That's pretty cool, definately looking into this. It may be a bit agressive tho, i.e it takes the entire server off rather than just booting out the user that's running the encryption

 

Software Restriction Policy Disallowed by default

Whitelist the below

C:\Program Files (X86)

C:\Program Files

C:\Windows

C:\Program Data

Network Shares

 

Has anyone done this?/How safe is it?

[TechMonkey]

Only takes out the affected share. So if you have everything under one share then you may have more issues than if you have one for each use.

 

We had a possible attempt Monday and it took out one section of pupils and everyone else was fine.

[kennysarmy]

Has anyone done this:

 

Enable Click to run for Chrome GPO User Configuration\Administrative Templates\Google\Google Chrome\Content Settings\setting="Click to play"

Disable Macros in MS Office Set the below for each office application in the users GPO

 

I just wondered how disruptive it was for the end-users....

[mavhc]

Has anyone done this?/How safe is it?

 

No idea how safe it is, but not had any malware problems at all since I implemented it. A larger school with central logging might have more data.

 

It will break a few things, roll it out slowly. But it's not like ransomware will become a smaller problem in the future, it's almost a perfect idea.

[TechMonkey]

We run AppLocker and have effectively that setup with a few additions. In fact I think those are the default ready built options anyway. You will have an intial pain as those little programs in shared areas are discovered and you either add them in separately or gather them into a shared App drive. But it is totally worth it.

I'm pretty sure SRP can do the same as AppLocker and run in audit mode to start. That way you will have most programs listed and you can add them all in.

[Koldov]

Just be wary of how you block the scripts, very easy to apply a blanket block before realising it might have some effects on scripts you use yourself, logon scripts, MDT deployment/task sequence scripts etc....

(guess who made that mistake? ) - many of these use Windows Script Host, .hta files etc.

 

I've learnt that with disabling Windows Script Host! I'm pretty sure it plays havoc with the Meraki application!

 

On our teacher laptops, disabling Windows Script Host just causes it to stop and restart the service every second or so and never makes contact with the dashboard!

 

It also stops the fresh install of a new instance with various error messages (might stop other things installing too, but this is the first thing I've tried).

 

I have a post here (with no answers, but I live in hope...):

 

http://www.edugeek.net/forums/windows-7/178937-meraki-windows-7-laptops-trouble-installing-service-restarting-script-host.html

[AJWhite1970]

I've added the term "secure message" to my transport rules in Exchange this morning after this one got through to finance but thankfully as we don't use Barclays they didn't open it...

 

Dear Valued Customer,

 

You have received 2 new secure messages. *dodgy link here*

 

Barclays PLC.

[gshaw]

I've added the term "secure message" to my transport rules in Exchange this morning after this one got through to finance but thankfully as we don't use Barclays they didn't open it...

 

Dear Valued Customer,

 

You have received 2 new secure messages. *dodgy link here*

 

Barclays PLC.

May put that on ours too. Need to check what Office 365 Message Encryption adds to its subject lines to make sure we don't accidentally block those though.

[AJWhite1970]

Have also now added "Deactivation" to our list of rules after this one got through. Fortunately the link was blocked

 

Subject: Deactivate Notification

 

Dear User

 

We received a request on 09/ 02/ 2017 to Remove your email account. this processing will be carry out in 48 hours.

If you did not initiate the account deactivation process,

 

Please cancel the deactivation request **CANCEL NOW** To stop processing

 

Deactivate Notification:

We are writing to inform you that if don't upgrade now your Account will be shutdown in 12 hours receiving this message

[sonofsanta]

Further to this weekend's fun round the globe, here's a post on WannaCry including the extensions it uses.

 

Not gonna lie, was a little nervous coming in this morning just in case--it's still unconfirmed how it initially breaches a network, whether it is via the usual means of a macro Word document and then spreading via the SMB vulnerability from there, or whether it's just scanning the internet for vulnerable SMB ports and injecting itself. I've long lived in fear of ransomware learning how to be as virulent as other families of malware, and, well, dark days are here :/

 

EDIT: for reference, things I'm adding to my file server filters this morning:

!Please Read Me!.txt

*.wcry

*.wry

*.wcryt

!WannaDecryptor!.*

Edited May 15, 2017 by sonofsanta

[Out_of_Sync]

the link is broken

[sonofsanta]

the link is broken

 

Managed to paste in one of the filters as the URL by mistake >_< corrected now. Thanks!

[mavhc]

Turn off smb1 and install March 2017 updates, don't be like the NHS

[PotNoodleTech]

Turn off smb1 and install March 2017 updates, don't be like the NHS

 

It's not their fault, They can't install the March 2017 updates on Windows XP and Server 2003!!

[john]

It's not their fault, They can't install the March 2017 updates on Windows XP and Server 2003!!

 

If this hasn't been posted elsewhere in the various threads about this area already but MS made XP, 2003 and 8 patches available - https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ you just need to manually download them and install them to help protect against this bug.

[zag]

Anyone else think this is a fantastic way to wake people up about upgrading their systems?

[jthompson]

Further to this weekend's fun round the globe, here's a post on WannaCry including the extensions it uses.

 

Not gonna lie, was a little nervous coming in this morning just in case--it's still unconfirmed how it initially breaches a network, whether it is via the usual means of a macro Word document and then spreading via the SMB vulnerability from there, or whether it's just scanning the internet for vulnerable SMB ports and injecting itself. I've long lived in fear of ransomware learning how to be as virulent as other families of malware, and, well, dark days are here :/

 

EDIT: for reference, things I'm adding to my file server filters this morning:

 

Do we know what happens if this kind of malware can't write its encrypted files or readmes (e.g. *.wcry)? Does it skip the original and leave it in tact?

[caffrey]

If anyone needs it, I've used this script and it has the latest extensions

 

https://github.com/nexxai/CryptoBlocker

[ozydave]

Just been applying the script for FSRM to my servers. It just works

 

Cheers

[PotNoodleTech]

So that script above, do you install it on each server that is used as a file server?