Major Issues with the Ransom Testcrypt. encryption Virus :-(

[deano3693]

This is a great article on detecting Crytolocker/ransomware early - https://community.spiceworks.com/how_to/100368-cryptolocker-canary-detect-it-early

 

It is definately doing the rounds in schools at the moment though. I am aware of three schools in Hertfordshire who have been hit in the last month.

[Geoff]

If you have any weakness in security you can bet ransomware will find it. The perpetrators are more motivated than ever due to the amount of money it makes them and the subsequent resources they can bring to bare with that money.

 

CryptoWall Ransomware raised $325 Million in Revenue for Its Developer

[Arthur]

These are the locations/files I've prevented .exe files from running (via group policy). Are there any others I should add to this?

 

%localAppData%\*.exe

%localAppData%\*\*.exe

%localAppData%\Temp\*.zip\*.exe

%localAppData%\Temp\7z*\*.exe

%localAppData%\Temp\Rar*\*.exe

%localAppData%\Temp\wz*\*.exe

You are missing lots of locations.

 

www.edugeek.net/forums/how-do-you-do/159149-cryptolocker-prevention-4.html#post1440802

 

@Geoff's idea of whitelisting instead of blacklisting is a better approach IMO.

 

IIRC, with your current rules all the ransomware would need to do is run from a deeper sub-folder e.g. %localAppData%\1\2\3\4\{6461F6EB-F75E-45AC-97FF-886D198DBED4}.exe

Edited March 31, 2016 by Arthur

[smithson83]

Would anyone care to share a list of their generic whitelisted locations?

 

EDIT: ie, one they would consider mandatory for a working system

[Geoff]

%ProgramFiles%

%SystemRoot%

 

You may need to include (I hate this one, looking at you Java).

 

%ProgramData%

 

Then the rest will depend on your network setup. So include any mapped drives or UNC paths that are relevant.

Edited March 31, 2016 by Geoff

[mavhc]

https://mssec.wordpress.com/2015/10/22/applocker-bypass-checker/ this tests all folders for executability, run as standard user

Protecting Windows Networks – AppLocker | DFIR blog general advice

 

Remove admin rights from everyone, and apply the exe restrictions to administrators as well. Just have to move files you want to run to a specified location first.

 

Also remove write access to shared folders people don't need write access to.

 

Basically I whitelist read-only shares for network installed programs, program files, windows (and then block certain dirs in windows), and python. Of course if you wrote malware in python, you win. Probably best to block .py and .pyc files for people who don't need to run them, sigh.

 

Also need to MITM TLS for everyone so the AV on your router can check stuff before it even gets to you

[smithson83]

Cheers for the start @Geoff

 

I trailed setting SRP to "Basic Access" as default with a few (inc above) set as "Unrestricted", but strange things stop working, like IE, just flashes up and closes. Am I missing something obvious

[Geoff]

You will have to check the event log and see what is being blocked. Sysinternals Process Explorer can also help you debug. Edited April 1, 2016 by Geoff

[mavhc]

I've not used Basic Access, got Disallowed as default

 

Under additional rules:

c:\windows, program files, program files x86 unrestricted

\\school.local\appshare

and then some hashes for minecraft jars

 

After that run that test script, you'll find some folders in c:\windows that users can write to, so add disallow rules for those.

[smithson83]

another moment, sorry, forgot to specify both x64 and x86 Prog Files dirs.

 

I was tempted to jump straight to Disallowed, but I'm going to slowly turn the screws

[mavhc]

I was surprised how little broke, either that or no one tells me anything. 2 things I noticed: DisplayLink driver installer, and a Sysinternals program that copied to temp to split into 32 and 64bit versions, just copied out of temp again.

[smithson83]

OK, stupid question No.2...

 

How do you guys deal with SIMs updates, I had to disable the policy this morning to get clients to installs the updates properly.

I have set the Drive letter and UNC path to unrestricted, is theres anything else (other than ProgFiles and ProgData) I should be allowing for this to work properly.

 

Just waiting for another machine to wake up so I can test Hashes for SOLOUS, SIMSLoad etc

 

EDIT: Just set %temp% to unrestricted, then the updates install, this obv isn't a good idea, must be missing something...

Edited April 4, 2016 by smithson83

[MYK-IT]

Upcoming SOPHOS webinar, 'How to stay protected against ransomware' Thursday 14th April 2016 (16:00 BST)

[karldenton]

Upcoming SOPHOS webinar, 'How to stay protected against ransomware' Thursday 14th April 2016 (16:00 BST)

 

Thanks. I've just registered for this and spoke to sophos. When you register its actually 3pm UK time.

[smithson83]

Stupid Question No.3

 

Is there much difference over using "User Config" vs "Computer Config", when specifying SRP (other than the obvious one of it applying to users/computers in the applied to OU...?