CryptoLocker Prevention

[mavhc]

If you have Software Restriction Policy set up correctly, you could add both .JS and .JSE to the 'Designated File Types', which is what I've done just now.

 

Is there a more comprehensive list? I added .jar, but there must be loads

[Chuckster]

When enabled it adds all the default filetypes. In addition to this I have added .DLL, .SYS, .FON, .EFI as well as .JS and .JSE.

[smithson83]

Just a quick SRP Question...

 

Is there much difference over using "User Config" vs "Computer Config", when specifying SRP (other than the obvious one of it applying to users/computers in the applied to OU...?

 

Which are you guys using?

[Chuckster]

Using the User Config when specifying SRP, and the GPO is applied to the root OU of User Accounts.

[DCUK6]

Using both here, found that if i didnt then not everything gets blocked.

 

Computer is just set to default disabled with only the standard exceptions, nothing else.

 

The user is set to disabled as default but then has exceptions which gives access to areas.

Edited May 5, 2016 by DCUK6

[mavhc]

If you don't need different users to execute different programs, use computer config

[Duke5A]

The latest TeslaCrypt no longer uses an extension for encrypted files.

 

www.helpnetsecurity.com/2016/04/22/teslacrypt-new-versions-no-decryption

 

 

 

http://i.imgur.com/K6pBd4Y.jpg

 

 

I've seen Step 1 take the form of macros in Word and Excel files here in my own environment. Actually had users open the .doc and follow the instructions in it to run the download macro. Fortunately, Symantec caught the downloaded payload and stopped it. Here are some shots of it in action on a secured computer:

 

 

What I've done is downloaded the ADMX templates for Office and added them to the central store. This allowed me to disable macros for all users in my environment.

[Arthur]

I've seen Step 1 take the form of macros in Word and Excel files here in my own environment.

The payload depends on the ransomware and is constantly changing, although it's usually Office documents containing macros, .js files or this week .hta and .dot files (often inside .zip files)...

 

https://twitter.com/GossiTheDog/status/730094917364686848

https://twitter.com/GossiTheDog/status/730116326853890048

[mavhc]

Any that get around SRP yet?

[Duke5A]

The payload depends on the ransomware and is constantly changing, although it's usually Office documents containing macros, .js files or this week .hta and .dot files (often inside .zip files)...

 

https://twitter.com/GossiTheDog/status/730094917364686848

https://twitter.com/GossiTheDog/status/730116326853890048

 

Zip files in email get dumped via our spam filter. My above post was only referring to the macro attack vector. Disabling macros, or at least requiring them to be digitally signed before allowing them to run goes a long ways in mitigating ransomware.

[Arthur]

TeslaCrypt shuts down and releases master decryption key / TeslaDecoder (Direct Download Link)

 

In surprising end to TeslaCrypt, the developers shut down their ransomware and released the master decryption key. Over the past few weeks, an analyst for ESET had noticed that the developers of TeslaCrypt have been slowly closing their doors, while their previous distributors have been switching over to distributing the CryptXXX ransomware.

 

When the ESET researcher realized what was happening, he took a shot in the dark and used the support chat on the Tesla payment site to ask if they would release the master TeslaCrypt decryption key. To his surprise and pleasure, they agreed to do so and posted it on their now defunct payment site.

 

Now that the decryption key has been made publicly available, this allowed TeslaCrypt expert BloodDolly to update TeslaDecoder to version 1.0 so that it can decrypt version 3.0 and version 4.0 of TeslaCrypt encrypted files. This means that anyone who has TeslasCrypt encrypted files with the .xxx, .ttt, .micro, .mp3, or encrypted files without an extension can now decrypt their files for free!

[Arthur]

Zip files in email get dumped via our spam filter.

Do you remove other archive formats too? e.g. 7z, rar, arj, ace, etc. I have seen one or two e-mails with these attachments.

 

Disabling macros, or at least requiring them to be digitally signed before allowing them to run goes a long ways in mitigating ransomware.

Definitely!

 

Any that get around SRP yet?

That depends on how you have setup SRP.

[Arthur]

Latest Petya ransomware strain comes with a failsafe: Mischa

 

The Petya ransomware strain signaled a new escalation for crypto-malware when it surfaced in March. For the first time, ransomware went beyond encrypting files on local and shared drives and instead set its sights on locking up the Master File Table on compromised machines.

 

Petya did have its shortcomings and before long, researchers were able to develop a tool that recovered some files lost to infections.

 

The criminals behind Petya, meanwhile, have addressed another weakness where the malware would not execute if it were not granted administrative privileges in order to target the MFT. A new installer for Petya was found and disclosed on Thursday. It comes with a failsafe; if its installer is not granted the privileges it seeks, it instead installs another strain of ransomware known as Mischa.

 

The original Petya executable came with a manifest that requested administrator privileges, said researcher Lawrence Abrams of Bleeping Computer.

 

"This causes Windows to issue a UAC prompt and request these privileges before the code in the executable is actually run. If the victim has UAC disabled, the program will just automatically run with [admin privileges]", Abrams told Threatpost. "This also means that if the user said 'No' at the UAC prompt, the program would not run and thus not install Petya."

 

[penfold]

Yeah done that but it's not having it. Most of the time with these things if I leave it a while and return for a fresh look I'll find a resolution.

 

Did you ever get this resolved? We have been running this but without the automatic disabling of shares and I'm now looking at getting it all working. For some reason I can only get it to block shares on the local server. If I run the invoke-command manually it seems to work but as part of the trigger it doesn't seem to run.

[Areku]

We went one step further, and block unsolicited

doc, docx, dotm, docm, xls, xlsm, xlsx, as well as the usual file types.

 

We set up one of our transport rules to deal with the specifically, we added an exception for a list of trusted domains. (generic domains do not get added hotmail etc, i have a separate transport rule i can add the whole sender address to if needed)

We have the mail server refuse the email, with notice for the sender. They then usually phone the school (or the recipient they are trying to send to). and we add the domain to the exception list.

 

We implemented it in January, caused a few headaches for some members of SLT at the time. but they are now all aware of the change in procedure, so often i get pre-warning emails (ie, I'm dealing with X company, and this is their domain, cna you make sure they are unfiltered?). before any actual emails are sent.

 

I've even had a few external company "have a go" at me when they have realized we are refusing mails from them, but when discussing and explaining the current predominant attack vector on our networks, most people are understanding.

 

So yes, we are a school, that by default blocks DOC and XLS files

 

 

**edit**

 

Oh and it only effects external mails, does not effect our users. -- "Outside the Organization"

Edited May 25, 2016 by Areku

[penfold]

If I run part of the script manually logged on as the user who created the File.ini the script works (kills all shares on all servers), but when I run it with a different user I get an error :"ConvertTo-SecureString : Key not valid for use in specified state." From my understanding this is because the key generated is only accessible by the account that generated it meaning it fails to get credentials and can't authenticate against other servers (still kills local shares though). It seems to me that the powershell script isn't running using the correct credentials when being executed from the trigger from FSRM and that's why only the local shares are killing disconnected.

 

There is obviously something I've done wrong here but I can't spot it. What I've done is:

Logged on and created the file.ini using specific account and logged off. Everything else has been done with my user account

Created File Group, Created Template, Created Template and applied it to test folder. Logged onto client with test user and created blocked filename on the share. Result is email sent but only local shares are disabled.

 

The File Screen is applied across our File servers so as soon as any file type is detected it will knock out the local shares but I would still like to make it knock out all shares if I can. Any advice on where I am going wrong?

[Arthur]

Microsoft warns of worm ransomware, finds fix in Windows 10 upgrade

 

Microsoft is warning of a wormable ransomware that infects removable drives on versions of its operating system below Windows 10.

 

The ZCrypt scumware is distributed through old but effective methods of phishing emails, Word document macros, and fake Adobe Flash installers.

 

It drops a warning notice in a HTML file informing victims that their removeable device files are encrypted, and can be decrypted only after payment of $500 in Bitcoins.

 

ZCrypt runs on 64-bit Windows XP relics, and version 7 and 8 boxes that have resisted the Windows 10 upgrade blitzkrieg.

 

"We are alerting Windows users of a new type of ransomware that exhibits worm-like behaviour," Microsoft's security team says.

 

"This ransom leverages removable and network drives to propagate itself and affect more users."

 

Redmond recommends users protect themselves by first upgrading to Windows 10 and updating antivirus, backing up hard drive files, and using the Windows Edge browser.

 

Macros should also be banished, and pirate and porn sites avoided.

 

The malware throws a fake Windows alert suggesting a USB device has not been detected while the files are encrypted.

[Marshall_IT]

For those of you that block macros from running, how do you deal with SIMS.net reports that contain macros?

The documents open from a temp location that you cannot add as a trusted location.

[ITGuyWestMidlands]

You can use %username% alin a trusted location entry but there is a regedit required for it to render it to the users username. We push out the reg entry bu gpp. \\server\share\%username%\My Documents\tempSimsRpt\ is the temporary path for reports

[3s-gtech]

Capita released a patch for SIMS which means that its macros are now signed. If you block unsigned macros, and have deployed this patch, you should be able to tighten up security with GP.

[Marshall_IT]

Capita released a patch for SIMS which means that its macros are now signed. If you block unsigned macros, and have deployed this patch, you should be able to tighten up security with GP.

 

you don't happen to know if this was rolled into their main update or if you need to request this separately?

 

EDIT - nevermind, i've found it in SOLSUS3. - Patch 21751 (PRB13039) for anyone else looking for it.

Edited June 6, 2016 by Marshall_IT

[Marshall_IT]

You can use %username% alin a trusted location entry but there is a regedit required for it to render it to the users username. We push out the reg entry bu gpp. \\server\share\%username%\My Documents\tempSimsRpt\ is the temporary path for reports

 

you don't happen to have the reg entry to hand do you? i'm struggling to find exactly what i need to push out. thank you.

[ITGuyWestMidlands]

Actually, looking back it may have not been needed. It should expand automatically to the username. Give it a go

[Fazza]

We've just implemented Software Restriction Policy GPO and configured the following:

 

Set to Disallowed:

 

%appdata%*.exe

%appdata%*.bat

%appdata%*.ps1

%Application Data%*.exe

%Application Data%*.bat

%Application Data%*.ps1

%temp%*.exe

%temp%*.bat

%temp%*.ps1

%temp%*.zip*.exe

%temp%\7z\*.exe

%temp%\rar\*.exe

%temp%\wz\*.exe

%userprofile%*.bat

%userprofile%*.exe

%userprofile%*.ps1

 

We've just had out first issue come to light and we cant install FireFox on any of the computers as it uses the %TEMP% folder to install from!

[mavhc]

We've just had out first issue come to light and we cant install FireFox on any of the computers as it uses the %TEMP% folder to install from!

 

Please submit to http://www.edugeek.net/forums/windows/170245-list-things-break-when-using-srp.html

 

Solution is usually to copy the temp files to an authorised location