Jump to content

NHS hit hard by ransomware / Wannacry Patching

just_david

By just_david
in Windows

 Share

Recommended Posts

clockend25

clockend25

Posted
Posted
I think you'll need the March update specifically. If I look in WSUS at the KB4012212 update for Windows 7 (the March update) it shows that we have no updates that supersede it.

[ATTACH=CONFIG]43199[/ATTACH]

 

Is that update only available for Windows 7/Server 2008?

jthompson

jthompson

Posted
Posted
I think, weirdly, we are generally better protected than the NHS now!

Maybe this is down to us having smaller-scale networks where changes are easier to implement and there are not so many stakeholders. Evenings, weekends and school holidays all allow for some server downtime, without upsetting Ambulance services, etc.

  • Thanks 1
Michael

Michael

Posted
Posted

If Microsoft developed a way for updates to be installed silently (without the need for an restart), I'm sure it would be more viable to keep updating it more frequently.

 

If you're a 24/7 operation, even on the likes of Christmas Day, people will still visit.

mullet_man

mullet_man

Posted
Posted
Anyone knows about SMB setting on buffalo terastation

 

I've got one and on it's firmware it mentions SMB but no version to choose.

 

My PC now has SMBv1 disabled and I can still access it so am guessing it's SMBv2.

jthompson

jthompson

Posted
Posted
Is that update only available for Windows 7/Server 2008?

 

We have Server 2008R2, Server 2012R2 and Windows 7 (and a Server 2003 that I patched manually this morning - oops). These are the the patches that we've got that address the MS17-010 bug (the SMB bug exploited by WannaCry).

 

KB4012212 (March, 2017 Security Only Quality Update for Windows 7 for x64-based Systems)

KB4012215 (March, 2017 Security Monthly Quality Rollup for Windows 7 for x64-based Systems)

KB4012215 (March, 2017 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems)

KB4012216 (March, 2017 Security Monthly Quality Rollup for Windows Server 2012 R2)

  • Thanks 2
eddyc

eddyc

Posted
Posted
I remember reading something saying that was a bug.

 

Thanks @Arthur.

 

Is there anyway to check or should I just go in to programs and features and ensure that it is unticked?

theo_logical

theo_logical

Posted
Posted
Maybe this is down to us having smaller-scale networks where changes are easier to implement and there are not so many stakeholders. Evenings, weekends and school holidays all allow for some server downtime, without upsetting Ambulance services, etc.

 

I think you've hit that nail on the head there. I worked in the NHS IT dept for a brief spell, it's a very tough environment in which to do a good job, a large assortment of applications and systems, users logging calls and then unavailable for days, buildings that don't lend themselves to good IT installations. My heart goes out to out IT colleagues there.

 

Not forgetting how schools benefit from Microsoft's generous discounts on operating systems means it's easier to stay up to date.

  • Thanks 1
Garacesh

Garacesh

Posted
Posted
If Microsoft developed a way for updates to be installed silently (without the need for an restart), I'm sure it would be more viable to keep updating it more frequently.

Can't replace a spark plug with the engine still running..

(Or maybe you can. I know nothing about cars. But you get the metaphor.)

jthompson

jthompson

Posted
Posted
I think you've hit that nail on the head there. I worked in the NHS IT dept for a brief spell, it's a very tough environment in which to do a good job, a large assortment of applications and systems, users logging calls and then unavailable for days, buildings that don't lend themselves to good IT installations. My heart goes out to out IT colleagues there.

 

Not forgetting how schools benefit from Microsoft's generous discounts on operating systems means it's easier to stay up to date.

 

Also, having children as users means that a lot of school admins are well-versed in locking things down to a degree that grown-up professionals would consider pretty cruel!

  • Thanks 1
Jobos

Jobos

Posted
Posted
I would disable it on your clients too. Also make sure that your clients have SMBv2 and v3 enabled too.

 

I've had to re-enable SMB1 as I was getting no end of problems as users could not logon, and those users who could logon because they had a local profile found their mapped drives had disappeared. It's odd as not all users were affected. Win 10 worked fine but I had mixed success with win 7. Some were ok (myself included) but others had problems even after enabling SMB2 on the servers so I'm guessing SMB2 cannot be enabled on the clients. Looking at my registry 

HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

SMB2 is nowhere to be seen. Does SMB2 get enabled by default on win7 machines?

Michael

Michael

Posted
Posted
Can't replace a spark plug with the engine still running..

(Or maybe you can. I know nothing about cars. But you get the metaphor.)

 

Must be perfectly do-able though...

browolf

browolf

Posted
Posted

I just calculated - the current value of the bitcoin wallets used by the ransomware is £39,628.

 

Doesn't seem that much for a "global cyber attack"!

PotNoodleTech

PotNoodleTech

Posted
Posted

Just removed the last Win2003 server that was clinging on to grim death from the system, this was the exact excuse I needed. "but look at NHS!!! do you want to be like NHS??!!!!"

 

Just noticed that my backup NAS disconnects if you disable SMP1 on my Veeam server. Gonna need to find a workaround to that!

 

FYI there are emergency updates available for WinXP and Win2003 - not sure how you get them my LEA just slapped me a link to a bunch of them on one of their servers. I think you need to be a full on .gov organisation to get access to the extended hotfix agreement on the old OS?

gh5000

gh5000

Posted
Posted
Just to advise people to check on backups after doing all this. Have had problems with QNAP with it having SMBv1 set as the highest protocol allowed and an update (presumably not the SMBv1) has caused some errors with Veeam running. Hopefully you all won't have a problem but good to check!
Michael

Michael

Posted
Posted

 

I'm extremely sceptical about only 12% of devices still require SMB1. In the context of an MFP, yes it's one device, but hundreds of people may use it. As I say, switching it off by default is probably a lot easier than removing it altogether. You can remove it in Windows 10/Server 2016 by turning the feature off as it currently stands via the GUI.

Michael

Michael

Posted
Posted
Just removed the last Win2003 server that was clinging on to grim death from the system, this was the exact excuse I needed. "but look at NHS!!! do you want to be like NHS??!!!!"

 

Just noticed that my backup NAS disconnects if you disable SMP1 on my Veeam server. Gonna need to find a workaround to that!

 

FYI there are emergency updates available for WinXP and Win2003 - not sure how you get them my LEA just slapped me a link to a bunch of them on one of their servers. I think you need to be a full on .gov organisation to get access to the extended hotfix agreement on the old OS?

 

The XP/2003/Vista updates are available for all to download.

DMcCoy

DMcCoy

Posted
Posted
As of last year (not using it here now) one of the major clinical systems was still using a FoxPro database, you had to have SMB v1.0 for that!

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...