CryptoLocker Prevention

[DCUK6]

Some nice lists.

 

Going to be adding the few i missed.

 

I want to enable auto updates on student machine but i causes so many issues as they are impatient. Maybe il get wsus up and do a few each day.

 

 

And after all that however don't forget the air gapped backups. I've got a NAS that i backup to. Keep several aged backups on there and unplug it after the backup completes.

Scary stuff.

Edited September 25, 2015 by DCUK6

[Marshall_IT]

Regarding backup locations, Ina perfect world air gapped backups would be great, or still to tape would work.

 

F you've got d2d backup and don't want / cant remove it from the network after each backup would setting the backup system to use a completely separate account backing up to a location where only this account has permissions prevent cyrptolocker style viruses from infecting these backups?

[rrrrr]

Microsoft dpm stores the file backups on disk using a non standard file system on a drive with no drive letter assigned. There is noway of getting to the files without going through the console. It also does file versioning so keeps multiple restore points of the same file.

 

I cannot see anyway how it could touch these backups

[Marshall_IT]

Microsoft dpm stores the file backups on disk using a non standard file system on a drive with no drive letter assigned. There is noway of getting to the files without going through the console. It also does file versioning so keeps multiple restore points of the same file.

 

I cannot see anyway how it could touch these backups

 

Anyone able to get a similar setup with veeam?

[sonofsanta]

Ok, next question: how do I set the Interval Limit for the file screen (template) so that it fires every time a file is detected, instead of ignoring repeats for sixty minutes after an event? Can't spot the PowerShell command for it, can't see it in FSRM GUI, can't get filescrn on the command line to do anything.

[halbaradkenafin]

Ok, next question: how do I set the Interval Limit for the file screen (template) so that it fires every time a file is detected, instead of ignoring repeats for sixty minutes after an event? Can't spot the PowerShell command for it, can't see it in FSRM GUI, can't get filescrn on the command line to do anything.

 

You'll need to use New-FSRMAction to create a new action and then add it to a template using Set-FSRMFileScreenTemplate -Notification. Some helpful information Here got me in the right direction for this and I was able to run:

 

Get-FsrmFileScreenTemplate -Name "Cryptolocker checker" | select -ExpandProperty Notification

 

Which shows the actions linked and their default settings.

[sonofsanta]

You'll need to use New-FSRMAction to create a new action and then add it to a template using Set-FSRMFileScreenTemplate -Notification. Some helpful information Here got me in the right direction for this and I was able to run:

 

Get-FsrmFileScreenTemplate -Name "Cryptolocker checker" | select -ExpandProperty Notification

 

Which shows the actions linked and their default settings.

 

Cheers. Do I need to recreate the action entirely using New-FsrmAction or can I do something like

$Notification = New-FsrmAction -Type Command RunLimitInterval 0

and apply it to amend only that setting?

 

For future Google warriors: example 2 in this link is proving useful https://technet.microsoft.com/en-us/library/jj900585%28v=wps.630%29.aspx

[halbaradkenafin]

I'd imagine you have to recreate the action entirely, I haven't tried this yet myself though.

[sonofsanta]

Turns out you can simply update the existing File Screen Template:

 

$email = New-FsrmAction Email -MailTo "[source Io Owner Email]" -MailCC "[color=#ff0000][b][email protected][/b][/color]" -Subject "Possible CryptoLocker Infection!" -Body "User [source Io Owner] attempted to save [source File Path] to [File Screen Path] on the [server] server. This file matches the pattern for a CryptoLocker ransom file. The user will be disconnected from the file server immediately; the computer should be immediately unplugged and reimaged before the virus can spread and corrupt server data." -RunLimitInterval 0
$event = New-FsrmAction Event -EventType Information -Body "User [source Io Owner] attempted to save [source File Path] to [File Screen Path] on the [server] server. This file is in the [Violated File Group] file group, and may be indicative of a CryptoLocker infection." -RunLimitInterval 0
$command = New-FsrmAction Command -Command "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"-CommandParameters "-ExecutionPolicy Bypass -command &{[color=#ff0000][b]C:\Disconnect-SMBShares.ps1[/b][/color] -username '[source Io Owner]'}" -SecurityLevel LocalSystem -KillTimeOut 5 -RunLimitInterval 0
Set-FsrmFileScreenTemplate -Name "[color=#ff0000][b]CryptoLocker Files[/b][/color]" -Notification @($email, $event, $command) -Active -UpdateDerived

 

Check the bits in red to make sure they match your setup (and amend the email body etc. as you please) and run that lot on every file server you have. Command now fires every time an infection is picked up, not just the first time in an hour, which is quite important if multiple people open the same infected email in that space of time (as is likely!).

[DCUK6]

Litle bit of code for you that i just knocked up

 

set /p NumberOfFiles=Enter how many Sparse 1GB files

 

 

 

FOR /L %%i IN (1,1,%NumberOfFiles%) DO (

FSUtil File CreateNew temp%%i 1073741824

FSUtil Sparse SetFlag temp%%i

FSUtil Sparse SetRange temp%%i 0 1073741824

)

 

 

pause;

 

 

 

It will create empty files that only take up 4kb but as soon as the file is changed the size will increase to 100gb.

If you create enough of these in your share, if cryptolocker tries to hit it should suddenly expand all these files filling up your server share. Create the files in one of the first folders on each share.

 

Idea taken from a Channel9 vid.

 

exclude from the backups though as it will create new files at the full size.

 

Next improvment is to add a bit of text into each files.

Edited October 22, 2015 by DCUK6

[Arthur]

Idea taken from a Channel9 vid.

Great idea! I'm going to try this too.

 

Video for anyone who hasn't watched it...

 

https://channel9.msdn.com/events/Ignite/2015/BRK3323

[Pyroman]

I'm doing some testing & I've Had a funny issue with the SRP, it's blocked my Impero shortcut from working, I can use other shortcuts that point to programs in C:\program files (x86)\ but for some reason a shortcut to ImperoConsoleShortcut.exe gets blocked. If you go to c:\program files (x86)\Impero*\Impero*\Imperoconsoleshortcut.exe and run directly from there it runs fine :/

[Arthur]

Booming crypto ransomware industry employs new tricks to befuddle victims « Ars Technica

 

The recently released CryptoWall 4.0 now replaces names of encrypted files with pseudo-randomly generated letters and numbers, presumably to further befuddle victims who are suddenly unable to access their data. The new version appears to continue encrypting data with 2,048-bit RSA keys, which when implemented correctly are practically impossible to break.

[halbaradkenafin]

Yet more reason to have solid backups and test them regularly. Who cares if the files are named strangely if you just restore whole folders/shares.

[Pyroman]

I'm doing some testing & I've Had a funny issue with the SRP, it's blocked my Impero shortcut from working, I can use other shortcuts that point to programs in C:\program files (x86)\ but for some reason a shortcut to ImperoConsoleShortcut.exe gets blocked. If you go to c:\program files (x86)\Impero*\Impero*\Imperoconsoleshortcut.exe and run directly from there it runs fine :/

 

Ah! sort've sorted it, the icons come from a share but apparently get copied down to the local profile (roaming profiles) on startup and run from there. Blocking executables in %userprofile% broke it. Hmmmm....

[markwilfan]

@halbaradkenafin Just wanted to say thanks for the really comprehensive post on this and to all other contributors. Great PS script by the way, awesome idea.

 

We have implemented this using SRPs but whitelisting rather than blacklisting ie all disallowed apart from the obvious places for what it is worth. Just rolling it out steadily now to stop too much disruption.

[halbaradkenafin]

@halbaradkenafin Just wanted to say thanks for the really comprehensive post on this and to all other contributors. Great PS script by the way, awesome idea.

 

We have implemented this using SRPs but whitelisting rather than blacklisting ie all disallowed apart from the obvious places for what it is worth. Just rolling it out steadily now to stop too much disruption.

 

I swapped to a whitelist a month or so after that post, it's definitely the better solution. I tested it in an office or two and one of the ICT suites first (with staff agreeing to be testers) to ensure I'd got all the software.

[DCUK6]

Is there anyway to disable SMB access automatically. Looks like the script requires to manually run and enter the username

 

$ShareDescription -notcontains $_.Description -and $_.Name -ne "MTATempStore$"

What does this bit do and where does it get the parameters from?

Edited February 3, 2016 by DCUK6

[markwilfan]

Is there anyway to disable SMB access automatically. Looks like the script requires to manually run and enter the username

 

You set up a FSRM rule for the cryto locker traps and then get the disconnect script to run if they get tripped. Sounds like you have misread it

[halbaradkenafin]

$ShareDescription -notcontains $_.Description -and $_.Name -ne "MTATempStore$"

What does this bit do and where does it get the parameters from?

 

The $_ indicates that it's using variable earlier in the pipeline, usually as part of a for loop or a where fitler. Given the context (and without looking back over my code) I'd guess it's a where-object section which is filtering out anything called MTATempStore$ or that has a description which matches a list of allowed descriptions, they are probably shares which the user doesn't have access to anyway and so removing their access would either error or make no difference.

[sonofsanta]

And if you want to know why all of this is a good idea to implement: Lincolnshire County Council computer systems restored - BBC News

[smithson83]

And if you want to know why all of this is a good idea to implement: Lincolnshire County Council computer systems restored - BBC News

 

Turns out that was misrepresented by the BBC - Lincolnshire council IT ransomware flingers asked for ... £350

But still, the disruption is the killer

[sonofsanta]

Turns out that was misrepresented by the BBC - Lincolnshire council IT ransomware flingers asked for ... £350

But still, the disruption is the killer

 

Yeah, I think the "offline for a week and using pen & paper" may have cost them more in the scheme of things.

 

It may or may not be relevant that their IT is outsourced to Serco. Any conclusions there are your own to draw.

[smithson83]

You mean they outsourced their IT dept, and something went wrong... that can't be right... can it????

[Arthur]

And if you want to know why all of this is a good idea to implement: Lincolnshire County Council computer systems restored - BBC News

 

She added the council would be reviewing its security systems in light of the attack and ensuring their anti-virus software was the latest available.

 

^ Doesn't this imply their AV software was out-of-date?