NHS hit hard by ransomware / Wannacry Patching

[ollyyllo]

For you, you need to have SMB1 = 0 listed as a DWORD in the registry.

 

The command Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol stops the machine using the SMB1 client to connect to shares so if you have a NAS that only uses SMB1 for its folder share, the you won't be able to connect.

 

I need to know if we can have the client still enabled if we have the latest patches applied?

 

Thanks @timbo343

 

So does that mean I can run

 

Set-SmbServerConfiguration -EnableSMB1Protocol $false

 

On Windows 10 as suggested in the microsoft guidance here

 

even though it only specifies to do this for Windows 8 and Windows Server 2012?

[timbo343]

Thanks @timbo343

 

So does that mean I can run

 

Set-SmbServerConfiguration -EnableSMB1Protocol $false

 

On Windows 10 as suggested in the microsoft guidance here

 

even though it only specifies to do this for Windows 8 and Windows Server 2012?

 

Yep, i've just tested it on my Win10 machine - running Set-SmbServerConfiguration -EnableSMB1Protocol $false or Set-SmbServerConfiguration -EnableSMB1Protocol $true changes the value.

 

That's the equivalent to running the Reg Hack.

Edited May 18, 2017 by timbo343

[Garacesh]

Great Ormond Street children's hospital still offline after WannaCrypt omnishambles - The Register

Apparently, though not affected by the virus itself, Great Ormond Street hasn't reconnected their network to the outside world yet.

Also some hospitals still haven't managed to get rid just yet.

A staffer at the NHS national media team told us that two hospital trusts nationally (in Hertfordshire and Essex) are still affected by WannaCrypt, adding that this wasn't a definitive list. He went on to suggest that the the widely reported figure of 47 NHS Trusts nationally getting hit by WannaCrypt might be inaccurate. He wasn't able to offer a confirmed (official) figure, explaining that the full extent of the damage is still being assessed.

[3s-gtech]

buffalo terastations Ive not got a bad word to say against them, just that they don't support newer protocols.

 

You'll be one of the few - while mine have been pretty reliable really (the oldest are ten years+ and still working) they have got through some serious quantity of disks, the web interface was always rubbish, they drop off the domain if you have a powercut, and they're slow. I certainly won't be replacing them with more Buffalo stuff!

[PotNoodleTech]

You'll be one of the few - while mine have been pretty reliable really (the oldest are ten years+ and still working) they have got through some serious quantity of disks, the web interface was always rubbish, they drop off the domain if you have a powercut, and they're slow. I certainly won't be replacing them with more Buffalo stuff!

 

If the buffalo stuff was significantly cheaper than say Synology I'd understand but given it is on average approx. the same price - I have no idea why you would use it. The sinology stuff is absolutely outstanding in my opinion. Oh and supports SMB3

[3s-gtech]

Agreed. That's what I've ordered to replace my four Buffalos (my two Netgears are also fine, due to them actually releasing decent/recent firmware).

[3s-gtech]

Finally found a window to restart my file servers with SMB v1 disabled (clients have already been done) and all seems to be well (connections seem to be quicker too, but that may just be because system load is low now). Cheers for all the great advice in this thread.

[Stormborn15]

Finally found a window to restart my file servers with SMB v1 disabled (clients have already been done) and all seems to be well (connections seem to be quicker too, but that may just be because system load is low now). Cheers for all the great advice in this thread.

I've just removed the SMB1 feature from my DC's and Fileserver, fingers crossed for tomorrow !

[PotNoodleTech]

Mine are patched up but gonna remove SMB1 in half term. Yes this thread has been very useful - Edugeek rocks!!

[Garacesh]

Proposed PATCH Act forces US snoops to quit hoarding code exploits ? The Register

 

Two US senators have proposed a law limiting American intelligence agencies' secret stockpiles of vulnerabilities found in products.

 

The Protecting our Ability To Counter Hacking (PATCH) Act would set up a board chaired by an Department of Homeland Security (DHS) official to assess security flaws spies have found in code and hardware, and decide if manufacturers should be alerted to the bugs so they can be fixed for everyone.

I'll not hold my breath though.

[smurfomatic]

I want to know how much of the US Government's resources went into finding an acronym for the PATCH act...

[Stormborn15]

I've just removed the SMB1 feature from my DC's and Fileserver, fingers crossed for tomorrow !

 

Just had to put it back on on fileserver as scanning stopped working - HP printers...

[LeMarchand]

I want to know how much of the US Government's resources went into finding an acronym for the PATCH act...

 

Reminds me of:

 

[GrumbleDook]

I want to know how much of the US Government's resources went into finding an acronym for the PATCH act...

 

I remember PATCH from an NSA session about 10 years ago as an acronym ... Protect Against Terrorism and Covert Hackers

 

Possibly just a rework?

[LeMarchand]

I remember PATCH from an NSA session about 10 years ago as an acronym ... Protect Against Terrorism and Covert Hackers

 

Possibly just a rework?

 

Just like Supreme Headquarters, International Espionage, Law-Enforcement Division -> Strategic Homeland Intervention, Enforcement and Logistics Division. Hmmm...

[Bedders]

Taskforce Working Against Terrorism and Sybercriminals.

 

Wait, that's not right...

[Jobos]

I see SOLUS3 doesn't deploy the agent with SMB1 disabled but not a game changer in a small school as one could install the agent from a shared folder.

[MrKJLS]

I see SOLUS3 doesn't deploy the agent with SMB1 disabled but not a game changer in a small school as one could install the agent from a shared folder.

 

We disabled SMB1 across our network and now our SOLUS3 doesn't work either. We have nearly 800 PC's and that will be a massive PITA.

 

Can someone at Capita confirm this for us? @PhilNeal

Edited May 19, 2017 by MrKJLS

[DJ-1701]

I see SOLUS3 doesn't deploy the agent with SMB1 disabled but not a game changer in a small school as one could install the agent from a shared folder.

 

We disabled SMB1 across our network and now our SOLUS3 doesn't work either. We have nearly 800 PC's and that will be a massive PITA.

 

Can someone at Capita confirm this for us? @PhilNeal

 

Surely that can't be... I am sure I installed SIMS on a new Windows 10 Education laptop using Solus3 after disabling SMB1...

[timbo343]

Surely that can't be... I am sure I installed SIMS on a new Windows 10 Education laptop using Solus3 after disabling SMB1...

 

Depends what they mean by "it doesnt work"? I cannot see the Network when i ry to push SIMS out to machines - (Environment > Targets > Add > Tick SIMS > Choose Clients > Network Option - Nothing listed.

 

Its not just SIMS that cannot see the network, Impero is the same too when pushing out an MSI.

[MrKJLS]

Surely that can't be... I am sure I installed SIMS on a new Windows 10 Education laptop using Solus3 after disabling SMB1...

 

We uninstalled the Solus 3 Agent off my office computer (I have SMB1 disabled and Windows 10 installed) and we tried to reinstalled and it refused point blank to install it. The message in the SOLUS3 Console is "Access Denied to the remote machine".

 

We also rebuilt somebody PC and SOLUS3 gives us the same access denied error message.

[ITGURU]

I'm not sure why everyone is jumping in feet first disabling SMB1 without proper testing! If you have patched all your systems, have app rules an AV rules in place to prevent the file extensions, and registry entries being creating (as documented by McAfee) there should be no need to be disabling SMB1.

 

Doing it during term time...well how silly is that! At least wait until the holidays! It's no wonder things break! It's the reason I NEVER install SIMS updates as soon as they are released, OR windows updates. I wait at least a week before installing so everyone else has find the issues first!

[localzuk]

I'm not sure why everyone is jumping in feet first disabling SMB1 without proper testing! If you have patched all your systems, have app rules an AV rules in place to prevent the file extensions, and registry entries being creating (as documented by McAfee) there should be no need to be disabling SMB1.

Doing it during term time...well how silly is that! At least wait until the holidays! It's no wonder things break! It's the reason I NEVER install SIMS updates as soon as they are released, OR windows updates. I wait at least a week before installing so everyone else has find the issues first!

Its quite simple really - a giant malware outbreak that has wreaked havoc across the world. Disabling SMB1 is another arrow in the quiver of security. Normal security procedure when there is a threat is to clamp down on everything, and then re-open things once you're happy its safe - disruption or not.

[MrKJLS]

I'm not sure why everyone is jumping in feet first disabling SMB1 without proper testing! If you have patched all your systems, have app rules an AV rules in place to prevent the file extensions, and registry entries being creating (as documented by McAfee) there should be no need to be disabling SMB1.

 

Doing it during term time...well how silly is that! At least wait until the holidays! It's no wonder things break! It's the reason I NEVER install SIMS updates as soon as they are released, OR windows updates. I wait at least a week before installing so everyone else has find the issues first!

 

We don't install SIMS upgrades straight away. But I'd rather take the risk installing a patch or disabling a protocol to remove a secuirty hole.

[DJ-1701]

We uninstalled the Solus 3 Agent off my office computer (I have SMB1 disabled and Windows 10 installed) and we tried to reinstalled and it refused point blank to install it. The message in the SOLUS3 Console is "Access Denied to the remote machine".

 

That I could kind of understand, had fun with the Solus 3 Agent before.

 

We also rebuilt somebody PC and SOLUS3 gives us the same access denied error message.

 

That I can't... just installed Solus3 on a PC with SMB1 disabled on the server as well as the desktop. Fine from Start to Finish and the SOLUS3 Deployment Service states 'Update was successfully installed'.

 

So... working fine for me... Windows Server 2008 R2 Standard and Windows 10 Education 1703.