localzuk Posted May 15, 2017 Posted May 15, 2017 I'm extremely sceptical about only 12% of devices still require SMB1. In the context of an MFP, yes it's one device, but hundreds of people may use it. As I say, switching it off by default is probably a lot easier than removing it altogether. You can remove it in Windows 10/Server 2016 by turning the feature off as it currently stands via the GUI. Our MFPs don't use SMB1 - they've moved on to SMB2, as have a lot of newer models. So, 12% could well be right.
browolf Posted May 15, 2017 Posted May 15, 2017 You can track the number of payments made here: https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Live map of infections: https://intel.malwaretech.com/WannaCrypt.html There's 3 wallets attached to the ransomware. https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn 1
Michael Posted May 15, 2017 Posted May 15, 2017 I just calculated - the current value of the bitcoin wallets used by the ransomware is £39,628. Doesn't seem that much for a "global cyber attack"! And more to the point, authorities globally are probably waiting for it to be collected. Bitcoin transactions are traceable, but I agree, on a global scale it's a rubbish amount.
Garacesh Posted May 15, 2017 Posted May 15, 2017 I just calculated - the current value of the bitcoin wallets used by the ransomware is £39,628. Doesn't seem that much for a "global cyber attack"! Yeah, but consider the accidental get-out-of-jail-free-card. People were already paying before the kill-key was found. Without it, it would've been considerably more profitable.
jthompson Posted May 15, 2017 Posted May 15, 2017 FYI there are emergency updates available for WinXP and Win2003 - not sure how you get them my LEA just slapped me a link to a bunch of them on one of their servers. I think you need to be a full on .gov organisation to get access to the extended hotfix agreement on the old OS? All of the extra updates that MS have put out for XP, Vista, 8, 2003 and 2008 are publicly available here http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598. 1
Michael Posted May 15, 2017 Posted May 15, 2017 Our MFPs don't use SMB1 - they've moved on to SMB2, as have a lot of newer models. So, 12% could well be right. Well either way, I'd rather wait for Microsoft to make it 'the standard' and manufacturers will follow to match. If I do it the other way around, MFP manufacturers will probably tell me to switch it back on.
3s-gtech Posted May 15, 2017 Posted May 15, 2017 (edited) Anyone knows about SMB setting on buffalo terastation From my experience and testing, the only Buffalo NAS I have that doesn't support v2 is an original Terastation from 2005. My 2006 Terastation Pro supports v2, though v1 will still be active on the device. Further testing has shown all of my Buffalo NASs have reached the end. Not going to bother with them, time to invest in some new ones. I have had some luck today with updating firmware, and where updates haven't been available (such as on an older ReadyNAS Pro) I've been able to SSH in and manually adjust the SMB config to disable v1. Surprising what you can do with old hardware. Edited May 15, 2017 by 3s-gtech
theo_logical Posted May 15, 2017 Posted May 15, 2017 I just calculated - the current value of the bitcoin wallets used by the ransomware is £39,628. Doesn't seem that much for a "global cyber attack"! ... especially when you factor in that they probably have hit-squads from MI5/MI6, CIA, and MOSSAD on their tails.
browolf Posted May 15, 2017 Posted May 15, 2017 And more to the point, authorities globally are probably waiting for it to be collected. Bitcoin transactions are traceable, but I agree, on a global scale it's a rubbish amount. There ought to be a website that scrapes the bitcoin values off these 3 pages, adds them up, scrapes the bitcoin dollars/pounds conversion rate. Displays the total value on a page and a graph of value over time. That's a website that could attract a significant amount of traffic. I'd make it myself but I don't have time at the moment. Free idea to anyone who wants to.
pete Posted May 15, 2017 Posted May 15, 2017 Just to advise people to check on backups after doing all this. Have had problems with QNAP with it having SMBv1 set as the highest protocol allowed and an update (presumably not the SMBv1) has caused some errors with Veeam running. Hopefully you all won't have a problem but good to check! You may find you'll have to SSH into the QNAP and run "smb2enable".
Arthur Posted May 15, 2017 Posted May 15, 2017 I've ran this on a few 2012 R2 and 2016 boxes, given them a reboot and then running Get-SMBServerConfiguration in powershell still says its set to true. Am I missing something, I get a success message before I reboot. I've found the comment I was talking about earlier... https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/#div-comment-112765 Is there anyway to check or should I just go in to programs and features and ensure that it is unticked? Get-WindowsOptionalFeature -Online -FeatureName smb1protocol | Select State - - - Updated - - - @MYK-IT @AngryITGuy. I just checked my Smoothwall box (running Hearst) and we haven't had any issues today with users authenticating after disabling SMB1. I am using Negotiate Kerberos/NTLM for non-transparent authentication. 1
pcstru Posted May 15, 2017 Posted May 15, 2017 A comforting thought ... our Nuclear (Trident) Submarines run Windows XP. Just thought I'd share that.
MYK-IT Posted May 15, 2017 Posted May 15, 2017 Thanks @Arthur When I had disabled SMBv1 (and removed SMBv1 feature) from our DCs (2012 R2) that was when we had Smoothwall authentication problems, with the "Authentication Required" prompt appearing. At the same time, I did check Services > Authentication > Directories and our AD Domain did have a green tick under status; but when I checked under System > Diagnostics > Functionality test > Authentication it responded with an error under Trusted domains for Groups (Red Cross). I just re-enabled SMBv1 on the DCs just to get back running (short-term). Perhaps a restart of service? (or a reboot) of Smoothwall UTM would had resolved it, I am not sure. But I will give it another attempt as soon as I can. Thanks,
JordanT91 Posted May 15, 2017 Posted May 15, 2017 A comforting thought ... our Nuclear (Trident) Submarines run Windows XP. Just thought I'd share that. That's fine. It's actualy called Windows for Submarines, and I believe it's an ofshoot of Windows for Warships. It's honestly not an issue.
localzuk Posted May 15, 2017 Posted May 15, 2017 That's fine. It's actualy called Windows for Submarines, and I believe it's an ofshoot of Windows for Warships. It's honestly not an issue. Plus, I can't imagine they'd be internet connected or have USB ports for memory sticks on submarines!!
Popular Post caffrey Posted May 15, 2017 Popular Post Posted May 15, 2017 Does it still come with minesweeper installed ? (I'll get my coat) 7
theo_logical Posted May 15, 2017 Posted May 15, 2017 Am I correct in saying that in Office 365 at least there is no easy way to disable hyperlinks in all incoming emails? If there was a way that would make life a lot easier for us and stop most ransomware attack?
TechMonkey Posted May 15, 2017 Posted May 15, 2017 Am I correct in saying that in Office 365 at least there is no easy way to disable hyperlinks in all incoming emails? If there was a way that would make life a lot easier for us and stop most ransomware attack? In theory convert all incoming emails into Plain Text would do it. Not sure there is a way to do this in O365, plus users may get confused by all the emails they get in HTML!
Arthur Posted May 15, 2017 Posted May 15, 2017 Am I correct in saying that in Office 365 at least there is no easy way to disable hyperlinks in all incoming emails? If there was a way that would make life a lot easier for us and stop most ransomware attack? Microsoft's solution to that problem is Office 365 Advanced Threat Protection.
Arthur Posted May 15, 2017 Posted May 15, 2017 WannaCrypt Decrypter This POC can decrypt your files encrypted by WanaCry! malware ONLY if you got the RSA key!!!
southhamster Posted May 15, 2017 Posted May 15, 2017 Our MFPs don't use SMB1 - they've moved on to SMB2, as have a lot of newer models. So, 12% could well be right. Our Konica Minolta c554e are meant to use SMB2 but we can't get them working despite fiddling with settings. Our HP 277MFP is fine onSMB2.KM are sending an engineer out so suspect a firmware update is in order. Several odd drive mapping problems but a bit random with Win7
AngryITGuy Posted May 15, 2017 Posted May 15, 2017 Thanks @Arthur When I had disabled SMBv1 (and removed SMBv1 feature) from our DCs (2012 R2) that was when we had Smoothwall authentication problems, with the "Authentication Required" prompt appearing. At the same time, I did check Services > Authentication > Directories and our AD Domain did have a green tick under status; but when I checked under System > Diagnostics > Functionality test > Authentication it responded with an error under Trusted domains for Groups (Red Cross). I just re-enabled SMBv1 on the DCs just to get back running (short-term). Perhaps a restart of service? (or a reboot) of Smoothwall UTM would had resolved it, I am not sure. But I will give it another attempt as soon as I can. Thanks, We are using Glamis-3 on a S8 appliance with non-transparent NTLM authentication once SMB1 was disabled on the domain controllers it stopped working. And when I diagnosed the directory in SmoothWall there were red crosses against connection to domain controller, trusted domains and groups. Rebooting the appliance didn't fix the issue so we enabled SMB on the domain controllers to get this back working. 1
MYK-IT Posted May 15, 2017 Posted May 15, 2017 We are using Glamis-3 on a S8 appliance with non-transparent NTLM authentication once SMB1 was disabled on the domain controllers it stopped working. And when I diagnosed the directory in SmoothWall there were red crosses against connection to domain controller, trusted domains and groups. Rebooting the appliance didn't fix the issue so we enabled SMB on the domain controllers to get this back working. @AngryITGuy I have stayed late, just to try the same again; disabling SMBv1 on DCs to see that the Smoothwall AD Authentication fails yet again (cannot retrieve groups etc). This was also with changing non-transparent authentication policies to either NTLM or Negotiate Kerberos/NTLM; although I fully appreciate that Smoothwall is failing (with any AD authentication) before it even gets to this stage! Back to SMBv1 enabled (again) for now! Thanks.
Arthur Posted May 15, 2017 Posted May 15, 2017 This was also with changing non-transparent authentication policies to either NTLM or Negotiate Kerberos/NTLM Is your Smoothwall on Glamis too?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now