NHS hit hard by ransomware / Wannacry Patching

[Arthur]

Do you currently block Powershell and other certain files access to the internet? I would be interested in a copy of your group policy if you do.

These are the EXEs I have blocked so far through a Group Policy firewall rule.

 

--------------------------------------------------------------------------------
Outbound Rule       Path
--------------------------------------------------------------------------------
cmd.exe (x64)       %SystemRoot%\System32\cmd.exe
cmd.exe (x86)       %SystemRoot%\SysWOW64\cmd.exe
cscript (x64)       %SystemRoot%\System32\cscript.exe
cscript (x86)       %SystemRoot%\SysWOW64\cscript.exe
mshta (x64)         %SystemRoot%\System32\mshta.exe
mshta (x86)         %SystemRoot%\SysWOW64\mshta.exe
PowerShell (x64)    %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell (x86)    %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
wscript (x64)       %SystemRoot%\System32\wscript.exe
wscript (x64)       %SystemRoot%\SysWOW64\wscript.exe

 

Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Outbound Rules

New Outbound Rule Wizard > Next > Enter path to EXE > Next > Next > Next > Enter a name and description for the rule > Finish

 

Does this blocking break anything?

I haven't come across anything that has broken so far on our student and staff PCs since they never download anything from the Internet through the EXEs above, but your environment may be different so it would be a good idea to test first.

 

Here are a couple of examples of things that will stop working...

 

Invoke-WebRequest -Uri "https://awscdn.cdngeek.com/image/lgo/s/edit_blue_1.svg" -OutFile .\edit_blue_1.svg

 

Install-Module -Name Carbon

Edited May 13, 2017 by Arthur

[snagrat]

I assume the Powershell scripts we use to license users in O365 will stop working?

[Arthur]

I assume the Powershell scripts we use to license users in O365 will stop working?

Yeah. You can exclude your PC (and any others that need to run Internet-based scripts) from the GPO though.

[flyinghaggis]

It does seem odd that so many NHS trusts were affected simultaneously. Are they​ linked in some way that allowed the worm to spread over SMB or was it just an attachment/etc spreading via compromised email accounts?

 

It's horrible to think that someone would Intentionally target uk hospitals

Edited May 13, 2017 by flyinghaggis

[DrCheese]

Yea, they have this between them

https://en.wikipedia.org/wiki/N3_(NHS)

 

I'm going to guess some lax firewalling between trusts is to blame

[mullet_man]

Stick the command in a powershell file. And make an application like the below

 

https://community.spiceworks.com/topic/1369218-how-use-sccm-to-run-powershell-script-on-user-s-pc

 

This looks perfect actually.

 

https://www.techwhisperer.ca/2017/03/04/disable-smb1-with-powershell-and-sccm/

[flyinghaggis]

Yea, they have this between them

https://en.wikipedia.org/wiki/N3_(NHS)

 

I'm going to guess some lax firewalling between trusts is to blame

 

That would make sense. I was thinking there must be some kind of link between their sites which exposed them over SMB/etc before they were all affected at the same time.

Edited May 13, 2017 by flyinghaggis

[snagrat]

Anyone know a quick command or way of checking if SMBv1 is enabled. Can't find much.

 

Would be good to check if my scripts are running correctly

[DJ-1701]

Anyone know a quick command or way of checking if SMBv1 is enabled. Can't find much.

 

Would be good to check if my scripts are running correctly

 

Get-SmbServerConfiguration

 

It should tell you if EnableSMB1Protocol is set to True or False.

[Simcfc73]

Anyone know a quick command or way of checking if SMBv1 is enabled. Can't find much.

 

Would be good to check if my scripts are running correctly

 

Get-SMBServerConfiguration in powershell

[FN-GM]

Get-SmbServerConfiguration

 

It should tell you if EnableSMB1Protocol is set to True or False.

 

Get-SMBServerConfiguration in powershell

 

I have been using this and it has been returning nothing.

[Jaan]

Not sure how to check all servers automatically..... but here is where you remove it...server manager features;

 

were a 2012 r2 2016 and win7 site... so i guess we'll be fine to remove this....can anybody confirm that?

 

 

Looking for a GPO to apply server\client wide

Edited May 13, 2017 by Jaan

[DJ-1701]

I have been using this and it has been returning nothing.

 

Strange... this is what I am getting...

 

[JonThompson]

Just seen an article on the BBC tv news about this, and in the background was a PC running XP! And this was an IT services office!

[DJ-1701]

I have been using this and it has been returning nothing.

 

Strange... this is what I am getting...

 

[ATTACH=CONFIG]43191[/ATTACH]

 

It may be that this command only works in Windows 8+, the following should also tell you if it's set to be on or off.

 

(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters").SMB1[/Code]

Typical binary value, should be 0 for off.

Edited May 13, 2017 by DJ-1701

[FN-GM]

It may be that this command only works in Windows 8+, the following should also tell you if it's set to be on or off.

 

(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters").SMB1[/Code]

Typical binary value, should be 0 for off.

I was running it on Server 2016. Will give it a try again tomorrow.

[tj2419]

Not sure how to check all servers automatically..... but here is where you remove it...server manager features;

 

were a 2012 r2 2016 and win7 site... so i guess we'll be fine to remove this....can anybody confirm that?

 

[ATTACH=CONFIG]43190[/ATTACH]

 

Looking for a GPO to apply server\client wide

 

When I check our server this option is ticked but greyed out so I can't untick it. Anyone know why that would be and how to get round it? We're a CC4 network if that makes any difference.

[Arthur]

It may be that this command only works in Windows 8+, the following should also tell you if it's set to be on or off.

 

(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters").SMB1[/Code]

Typical binary value, should be 0 for off.
 
I thought that registry value was only for legacy Windows 7 and 2008 R2 systems because you can’t remove SMB1 (only disable it)?
 
[b]More details[/b]: https://aka.ms/stopusingsmb1
 
[size=1][b]SMB1 Server[/b][/size]
[code]$key = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

if ((Get-ItemProperty -Path $key).SMB1 -eq $null) {
   Write-Output 'Disabling SMB1 server'
   Set-ItemProperty -Path $key SMB1 -Type DWORD -Value 0 -Force
}
else {
   Write-Output 'SMB1 server already disabled'
}

 

SMB1 Client

$smb1 = Get-Service -Name LanManWorkstation -RequiredServices | Where { $_.Name -eq 'MrxSmb10' }

if ($smb1 -eq $null) {
Write-Output 'SMB1 client already disabled'
}
else {
Write-Output 'Disabling SMB1 client'
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled
}

 

On Windows 8.1/10 you would run:

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart

 

... and on Windows Server 2012 R2/2016 you would run:

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart; Remove-WindowsFeature FS-SMB1

[Arthur]

When I check our server this option is ticked but greyed out so I can't untick it. Anyone know why that would be and how to get round it?

Remove it through PowerShell. I couldn't remove it through the GUI on our servers either.

[Arthur]

Been at it all day, loosing the will to live!

I know how you feel. I think I have completely annihilated SMB1 on my network now!!!

 

[Arthur]

While we're at it, is it worth disabling SMB1 on non-Windows devices too. e.g. NASs?

 

[snagrat]

Is it possible to run a GPO startup script without having a separate file?

 

I want to create a GPO that can be easily moved between different domains and customers but most would involve inserting the path to the file for the startup script.

 

I have tried adding the Powershell exe location in the script name and then adding the "Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol" in the parameter path but that doesn't seem to work

 

Anyone know if it is possible to do?

[rednight]

Anybody know which update is needed to fix this vulnerability? We have a WSUS server that we actively monitor to push updates. We are a w7 2012 and 2016 site. Would be great if i could look for a specific KB.

 

Whats the best method to disable or remove smb1 as i believe this is where the issue is unless im wrong.

 

Maybe the mods could have a section in security that has info on how to check if your vulnerable and how to fix if you are?

 

hope i dont see a ransomware screen when i get to work come monday.

 

Is there a quick check-list posted anywhere that I could use to make sure I have covered all bases?

 

So far I have:

 

1. Checked that the March update is applied to servers

2. Performed an additional full backup on the server to an external hard drive and locked it in the safe (just as a precaution for Monday!)

3. Checked our cloud backup is working

 

I intend to go back in today to:

 

1. Disable SMBv1 on servers (using Server Manager)

2. Learn how to use PowerShell to disable SMB on Windows 7 clients - would anyone be able to help me with this please - I've never used PowerShell before (?!) :-)

3. Check main Windows 7 machines in office to ensure all Windows Updates applied (pretty sure they are, but going to check anyway!)

4. Check teacher laptops tomorrow for Windows Updates (I do this as part of their annual MOT - so have already checked most of them)

5. Do I need to apply the Extra.DAT issued by Mcafee on Friday evening - or has detection now been built into the Daily DAT?

6. Is it worth enabling the Mcafee VirusScan Access Protection Rules to block the creation of the registry keys/files that Wannacrypt creates? (Although as this would only prevent infection from that particular variant I am not sure it's worth doing. As I guess as soon as another variant which creates different reg keys/file names arrives - the rule would be useless!)

 

7. Is there anything else I should do?!

 

That's Sunday taken care of then!!

[DJ-1701]

I thought that registry value was only for legacy Windows 7 and 2008 R2 systems because you can’t remove SMB1 (only disable it)?

 

Well, the value will be set to 0 if you are disabling the feature using Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

 

Basically I am following information gleamed from https://support.microsoft.com/en-gb/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012 and doing a belt and braces approach.

 

I'm going to execute a starup script as follows in the GPO Startup script section with the following for all the workstations, which should cover disabling and uninstalling if able based on Windows version:

 

If ((Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters").SMB1 -ne 0)
{
   If ((([environment]::OSVersion.Version).Major + ("." + ([environment]::OSVersion.Version).Minor)) -lt 6.2)
   {
       Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
       sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
       sc.exe config mrxsmb10 start= disabled
   }
   Else
   {
       Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
       sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
       sc.exe config mrxsmb10 start= disabled
       Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart
   }
}

 

Of course, the Windows Server 2012+ will require the following command to be run instead of Disable-WindowsOptionalFeature.

Remove-WindowsFeature FS-SMB1

Though as I said, this is script will be for workstations.

[Arthur]

Is it possible to run a GPO startup script without having a separate file?

The following will run a PowerShell command directly without a script. You could give this a try?

 

Powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart"

Edited May 14, 2017 by Arthur