NHS hit hard by ransomware / Wannacry Patching

[Geoff]

Okay I've just done this and the key doesn;t exist. What's the quickest non-powershall way to turn it off? Servers are fully updated though.

 

Sorry (Powershell):

 

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB2 -Type DWORD -Value 1 -Force

[Achandler]

I'll be honest, I went home Friday havign read how the ransonware was meant to have worked, and thought to myself. That security loophole won't be an issue for me.

 

I don't update my servers up to the latest patch always, I would say I am about 2 weeks behind though. I have a couple of non-critical (strong words, as it includes a server for students to play games on) that I use to test the latest patches on before deploying across the school.

 

It is all about managing risk I guess, and running servers with known exploits is never a good idea with that said, I can understand why in the NHS people might not have risked an update but still.

[MS2011]

I have ran this command and but few Server 2008 R2 standard does not exist SMB1

 

i have checked registry as well but couldn't find SMB1 in Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

[Arthur]

I have checked registry as well but couldn't find SMB1 in Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

The SMB1 value usually isn't there by default so you will need to create it manually or use the PowerShell command that @Geoff posted. i.e.

 

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force

[localzuk]

Erm. It appears our Sophos UTMs use SMB1 to authenticate. Somehow.

[GrumbleDook]

All I can say about all this is, I want to shoot the previous IT support for our other schools. What a bloomin' mess! Not only was Windows Update disabled via GPO in 2 schools, the actual service was disabled on the servers!! *RAGE*

 

And breathe ... and relax.

 

Ever had to turn updates off because an MS patch had been breaking machines? That could be the reason. Ever been distracted when you been on the way to turn something vital back on?

 

It happens ... it shouldn't, but it does.

It should have been spotted after a month (we all do a routine sampling of logs to catch this like this, don't we?) but it wasn't and that is the thing I would be equally annoyed with ...

 

Just be glad you caught it now.

[Michael]

I'm not entirely sure why disabling SMB1 is better than just applying the patch Microsoft have created? If Microsoft thought this was the best way forward, surely they themselves would have taken the decision to disable SMB1 via a patch?

 

Most schools will operate a managed firewall of some kind, so ports 445 and 139 will be blocked anyway, meaning the Ransomware cannot spread.

 

There are also other rumours flying around such as 'Windows 10's not affected' and that a security researcher has halted the spread by registering a domain. Both are untrue, as Microsoft did release a patch for Windows 10 in March, but if you deploy the May 2017 update it'll be included also. As is typical with a lot of malware, variants always appear, so the ultimate solution is simply to patch your systems accordingly.

 

In the context of Windows 7, you do need to apply the March 2017 Quality Update, as Windows 7 patches are not cumulative like Windows 10.

[JordanT91]

Right, I've checked SCCM this morning. In my Windows 7 updates group, I have 'MS17-006 March 2017 Security Monthly Quality Rollup KB4012215' and 'MS17-008 March 2017 Security Only Quality Update KB4012212'. Are these the important patches?

 

I keep seeing MS17-010 mentioned but I can't see it on my server at all.

[Arthur]

I see Sophos made a few changes to their website over the weekend!

 

Before: https://web.archive.org/web/20170102055713/www.sophos.com/en-us/lp/nhs.aspx

After: https://www.sophos.com/en-us/lp/nhs.aspx

 

 

Erm. It appears our Sophos UTMs use SMB1 to authenticate. Somehow.

Is it possible to change it to SMB2?

[Geoff]

You can run this powershell as admin (with the AD Powershell module installed, so on a DC) and it will scan your domain and tell you what state the machines are in:

 

https://github.com/kieranwalsh/PowerShell/blob/master/Get-WannaCryPatchState/Get-WannaCryPatchState.ps1

[cogrady84]

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

wack in a batch , gpo computer startup script

 

What command can I run on the client after deploying this to verify SMB1 is now disabled?

[caffrey]

Right, I've checked SCCM this morning. In my Windows 7 updates group, I have 'MS17-006 March 2017 Security Monthly Quality Rollup KB4012215' and 'MS17-008 March 2017 Security Only Quality Update KB4012212'. Are these the important patches?

 

I keep seeing MS17-010 mentioned but I can't see it on my server at all.

 

Yes,

 

the KB's are linked in the microsoft article https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

 

64bit Microsoft Update Catalog

[localzuk]

I'm not entirely sure why disabling SMB1 is better than just applying the patch Microsoft have created? If Microsoft thought this was the best way forward, surely they themselves would have taken the decision to disable SMB1 via a patch?

 

Microsoft's advice is to disable it. Doing it as a patch would be a change that could break a lot of things, so not something ideal for a patch - its something each organisation has to make a decision over.

Most schools will operate a managed firewall of some kind, so ports 445 and 139 will be blocked anyway, meaning the Ransomware cannot spread.

 

It only has to make its way on to a single machine behind your firewall and your firewall will be rendered useless.

[localzuk]

Is it possible to change it to SMB2?

 

Doesn't look like it at the moment - their knowledgebase has an article specifically covering the issue (pre-WannaCry) saying to enable SMB1 on Server 2012+. I have put a support request in regarding it, as it is a bit of an issue!

[gshaw]

I see Sophos made a few changes to their website over the weekend!

 

Before: https://web.archive.org/web/20170102055713/www.sophos.com/en-us/lp/nhs.aspx

After: https://www.sophos.com/en-us/lp/nhs.aspx

 

 

 

Is it possible to change it to SMB2?

 

Haha given it's poor detection rates and needing Intercept X to plug the gaps (at almost same cost as the AV solution itself) they've got some barefaced cheek coming out with those lines

[LeMarchand]

Anyone else had any emails from opportunistic suppliers touting for "Ransomware Protection Systems"?

[Michael]

I see Sophos made a few changes to their website over the weekend!

 

Before: https://web.archive.org/web/20170102055713/www.sophos.com/en-us/lp/nhs.aspx

After: https://www.sophos.com/en-us/lp/nhs.aspx

 

 

 

Is it possible to change it to SMB2?

 

Very mis-leading. Patching your Windows OS is the only 'proper' fix to this problem, rather than using any malware application to quarantine the threat. Hence this is why Microsoft took the decision to release a patch for Windows XP.

[Garacesh]

For anybody wondering, with minor alterations the techwhisperer script can be run manually on the machines, or over the network via Remote Powershell if you don't fancy shutting down your machines.

(Of course, this does require Remote Powershell to be enabled)

 

$Auth = Get-Credential
$ServerList = (Get-ADComputer -filter * | Where {$_.DistinguishedName -imatch "OU=[color="#FF0000"]SERVERS OU[/color]"})

ForEach ($Server in $ServerList) {
   Invoke-Command -ComputerName ($Server.DNSHostName) -Credential ($Auth) -ScriptBlock {

       Try {
         [string]$OperatingSystemVersion = (Get-WmiObject -Class Win32_OperatingSystem).Version
         switch -Regex ($OperatingSystemVersion) {
           '(^10\.0.*|^6\.3.*)'
             {
               # Windows 8.1 / Server 2012 R2 / Windows 10 / Server 2016
               # SMB1 Server Settings
               if ((Get-SmbServerConfiguration).EnableSMB1Protocol) {
                 Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
               }
               # SMB1 Client Settings
               if (((Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol).State) -match 'Enable(d|Pending)') {
                 Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
               }
             }
           '^6\.2.*'
             {
               # Windows 8 / Server 2012
               # SMB1 Server Settings
               if ((Get-SmbServerConfiguration).EnableSMB1Protocol) {
                 Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
               }
               # SMB1 Client Settings
               if ((sc.exe qc lanmanworkstation) -match 'MRxSmb10') {
                 Start-Process -FilePath "$env:windir\System32\sc.exe" -ArgumentList 'config lanmanworkstation depend= bowser/mrxsmb20/nsi' -WindowStyle Hidden
                 Start-Process -FilePath "$env:windir\System32\sc.exe" -ArgumentList 'config mrxsmb10 start= disabled' -WindowStyle Hidden
               }
             }
           '^6\.(0|1).*'
             {
               # Windows Vista / Server 2008 / Windows 7 / Server 2008R2
               # SMB1 Server Settings
               if (((Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"-Name SMB1 -ErrorAction SilentlyContinue).SMB1) -ne '0') {
                 Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name SMB1 -Type DWORD -Value 0 -Force -ErrorAction SilentlyContinue
               }
               # SMB1 Client Settings
               if ((sc.exe qc lanmanworkstation) -match 'MRxSmb10') {
                 Start-Process -FilePath "$env:windir\System32\sc.exe" -ArgumentList 'config lanmanworkstation depend= bowser/mrxsmb20/nsi' -WindowStyle Hidden
                 Start-Process -FilePath "$env:windir\System32\sc.exe" -ArgumentList 'config mrxsmb10 start= disabled' -WindowStyle Hidden
               }
             }
           default
             {
               Throw "Unsupported Operating System"
             }
         }

       Exit 0

       } Catch {
         $LastError = $Error | Select-Object -First 1 -ExpandProperty Exception | Select-Object -ExpandProperty Message
         Write-Warning -Message $LastError
         Exit 1
       }
   }
}
cmd /c PAUSE

 

This has probably been posted earlier too, but the thread's moving faster than I can keep up.

Edited May 15, 2017 by Garacesh

[Tesla]

Okay, I've been ill over the weekend so am a bit behind with the developments on this....

 

I have temporarily disabled SMB1 on the server, I have installed the patch that stops the vulnerability, but it wont run until the server is restarted.

 

Does the patch disable SMB1, or just it just close the vulnerability? We've already noticed an issue with disabling SMB1 (Admin Copier wont scan files to network drives)

[Stormborn15]

Hi Guys,

 

Thanks in advance for all the information that everyone has posted and with helping out everyone ( as well as securing your own systems in between!) I've just looked at one of our laptops and can't find the SMB feature in Programs/Features on the local machine to see if it is there. Is there another way to check this?

[Stormborn15]

Okay, I've been ill over the weekend so am a bit behind with the developments on this....

 

I have temporarily disabled SMB1 on the server, I have installed the patch that stops the vulnerability, but it wont run until the server is restarted.

 

Does the patch disable SMB1, or just it just close the vulnerability? We've already noticed an issue with disabling SMB1 (Admin Copier wont scan files to network drives)

Hi Tesla, does unticking the SMB1 feature need a server restart?

[Theory]

Does anybody have the Patch links? Apprentice in desperate need of assistance here! D:

[localzuk]

Anyone else had any emails from opportunistic suppliers touting for "Ransomware Protection Systems"?

Yup. Got a couple of emails trying to sell me anti-virus packages that would have "prevented this outbreak".

[Tesla]

Hi Tesla, does unticking the SMB1 feature need a server restart?

I did it via registry. It didn't need a restart.

 

I can't change any features because the server knows it needs a restart (from the installed update)

 

Look here

 

http://goo.gl/c6FLhi

Edited May 15, 2017 by Tesla

[Michael]

Microsoft's advice is to disable it. Doing it as a patch would be a change that could break a lot of things, so not something ideal for a patch - its something each organisation has to make a decision over.

 

It only has to make its way on to a single machine behind your firewall and your firewall will be rendered useless.

 

Where have Microsoft quoted this? (Disabling SMB1)?

 

And as others have found, disabling SMB1 has started to break other systems. Surely it's just as quick to deploy the latest May 2017 Win10 patch!? I've done exactly this to minimise disruption at multiple sites.