NHS hit hard by ransomware / Wannacry Patching

[MYK-IT]

Is your Smoothwall on Glamis too?

 

Yes, Glamis-3 although I am waiting for the chance (and time!) to transfer over to a S8 UTM appliance (so we can upgrade to Inverness etc.)

(I cannot do that at present on the existing appliance due to file-system used; so we have to rebuild either way!)

[Edu-IT]

Microsoft's solution to that problem is Office 365 Advanced Threat Protection.

 

What's the cost of this to Education, roughly, anyone know?

[googlemad]

Our Trust has amazingly not had anything infected, other members of the IT team were in over the weekend patching and rebooting servers, today has mainly been 'hunt down the XP installs and get the patch on them', I know my boss spent half the day upgrading a XP SP2 (!) to SP3 for a start. No email access be it internal Exchange, NHS.net, Gmail until later in the week though which will be another test I guess, also VPN access is offline still which isn't ideal being that it is my first week doing on call but never mind, I can have a nice steady walk into work should any issues arise

 

I know York has been hit pretty hard, won't go into too many details but I cringed at some of the stuff I heard today. Feel sorry for the IT guys having to deal with it all, it is that bad they've even had to borrow a couple of our staff to start getting things up and running again.

[AngryITGuy]

What's the cost of this to Education, roughly, anyone know?

 

The link posted by @Arthur suggests it's £1.50 per user.

[MrKJLS]

Does anyone have a warning email for staff I could steal please?

This is the one we sent out to staff today if you want it/still need it.

 

 

Good Morning,

This is email is to ask staff to remain vigilant about opening emails from unknown senders and opening attached documents from unknown senders. These attachments may contain a computer virus called Ransomware. It is likely that we are going to see more cases of these ransomware cyber-attacks over the coming days as well. The virus will infect Windows-based computers.

You may have heard of Ransomware at the end of last week as this is what the NHS and several other businesses and governments were infected with. In total 61 NHS trusts were heavily disrupted by ransomware cyber-attacks over the weekend.

Ransomware is a computer virus that will encrypt all your files not only on your computer, it also has the ability to spread throughout the network and will ask for a payment to de-encrypt the files. Usually the payment is asked in bitcoins. If you do not pay the fee, you will not get the files back.

To help avoid being infected with the ransomware virus, you can check the following things:

- Check the sender name. In many cases, they will have completely random names but there are chances that email may have come from yourself or someone you know. You should be aware that a colleague would not send you an email like that.

- Check the link before clicking on it. In outlook, you can hover your mouse over a link to see where you are going to visit if you click the link.

 

For more information on the recent CryptoLocker, cyberattacks please visit: Microsoft warns ransomware cyber-attack is a wake-up call - BBC News

If you see any suspicious emails please contact us at [email protected]

 

[kearton]

Can any Sophos UTM users please vote here: - Remove UTM SSO reliance on insecure SMB 1.0 ? Sophos Ideas

 

Sophos are escalating it based on Microsoft's advice but some votes might help...

Voted.

[Bob_the_Goon]

The link posted by @Arthur suggests it's £1.50 per user.

 

I've taken a look at the available subscriptions in our admin portal and it appears to be £1.06 a month for this.

[Chuckster]

Disabling SMB1 stops you from browsing for computers/servers with shares using Windows Explorer. Also, GPP will no longer map drives using DFSR method, i.e.\\FQDN\Namespace\Sharename$

 

So how do you get around that?

[Zoom7000]

Maybe a silly question, but I'm presuming that disabling SMB will break the ability to browse network shares from Apple Macs?

[AngryITGuy]

Maybe a silly question, but I'm presuming that disabling SMB will break the ability to browse network shares from Apple Macs?

 

I could be wrong but I'm sure Macs use the newer SMB3 and most of the advice here has been to disable SMB1.

 

We had some lessons in our Mac Suite today and no one mentioned any issues with mapped shares.

[DJ-1701]

Maybe a silly question, but I'm presuming that disabling SMB will break the ability to browse network shares from Apple Macs?

 

I could be wrong but I'm sure Macs use the newer SMB3 and most of the advice here has been to disable SMB1.

 

We had some lessons in our Mac Suite today and no one mentioned any issues with mapped shares.

 

Depends on your OS... there have been more discussions about this here... http://www.edugeek.net/forums/mac/184249-smb-10-7-5-a.html

[ZeroHour]

We have attempted to collate a lot of what has been said here in an article: EduGeek.net - WannaCry Ransomware – Info, Patches & tips to disable SMBv1

No doubt it will have mistakes and need improvement so please let us know and we will edit it asap but it should hopefully summarise some of what has been said here.

 

Thank you all for the trove of tips and tricks to disabling SMBv1 and other info.

[localzuk]

Caleb Barlow from IBM Security posted on his Twitter feed that an analysis of the 1.06 billion spam emails caught in their traps since 1st March give no indication that WannaCry occurred via spam/phishing.

[caffrey]

Interesting, so looks like it was spread via SMB and open ports

 

My smoothwall looks fine with authentication - SMBv1 off on the DC's using NTLM terminal services compatibility mode for Authentication

[mikeprice]

I mentioned this before (but it is probably lost in the amount of message) but at my OHs trust they have been getting loads of people ring up 'from IT' asking for access to the computer

so the email/phishing stuff could be wrong

[sippo]

Maybe a stooopid question, but how do I find out if SMB1 is enabled on Windows 7 clients?

 

Also, is it best to disable on all servers?

 

PS. Back from the pub now

[TechMonkey]

Disabling SMB1 stops you from browsing for computers/servers with shares using Windows Explorer. Also, GPP will no longer map drives using DFSR method, i.e.\\FQDN\Namespace\Sharename$

 

So how do you get around that?

 

There must be something else wrong or SMB was disabled completely. Explorer shouldn't be affected by disabling just SMBv1.

[Garacesh]

Maybe a stooopid question, but how do I find out if SMB1 is enabled on Windows 7 clients?

 

If you know specifically that the machine is Windows 7 (client edition, not server edition), then powershell should cover it:

              {
               # Windows Vista / Server 2008 / Windows 7 / Server 2008R2
               # SMB1 Client Settings
               if ((sc.exe qc lanmanworkstation) -match 'MRxSmb10') {
                 Start-Process -FilePath "$env:windir\System32\sc.exe" -ArgumentList 'config lanmanworkstation depend= bowser/mrxsmb20/nsi' -WindowStyle Hidden
                 Start-Process -FilePath "$env:windir\System32\sc.exe" -ArgumentList 'config mrxsmb10 start= disabled' -WindowStyle Hidden
               }
             }

Edited May 16, 2017 by Garacesh

[snagrat]

I disabled SMB1 on my Win10 machine and access to network shares on 2008R2 and 2012R2 were lost.

 

I hadn't disabled the server side yet, do I have to do that as well to force everything to use at least SMB2?

[TwistedHelixis]

So lets say I want do disable SMBv1 on windows 7 clients and deploy the fix using GPO, which of the following would I use in a startup script or do both work or should both be used together?????

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServ er\Parameters" SMB1 -Type DWORD -Value 0 -Force

 

Also do I need to enable v2 +v3 or should they already be enabled?

[timbo343]

So lets say I want do disable SMBv1 on windows 7 clients and deploy the fix using GPO, which of the following would I use in a startup script or do both work or should both be used together?????

 

 

 

 

 

Also do I need to enable v2 +v3 or should they already be enabled?

 

I would also add:

 

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB2 -Type DWORD -Value 1 -Force

[3s-gtech]

There must be something else wrong or SMB was disabled completely. Explorer shouldn't be affected by disabling just SMBv1.

 

Yeah, that sounds mighty odd. I can access DFS-R shares from a client with v1 disabled (though the server still has v1 enabled). Pushed out a script to disable v1 on all clients this morning, not had any complaints yet.

[Arthur]

I've taken a look at the available subscriptions in our admin portal and it appears to be £1.06 a month for this.

What's the cost of this to Education, roughly, anyone know?

I was quoted a price of £0.82 per user per month when I last checked with our EES reseller. For 100 FTEs this comes to £984 per year.

 

OVS-ES Office 365 Exchange ATPOpenFaculty Shared Server All Language OLV Level E Per User Monthly Subscription *Price per Month* (Additional Product Licence) - Academic - Volume Licence (Electronic Delivery) 

P/N: W77-00001

[cogrady84]

I just put the following into a startup script and applied it to all my clients:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

Also deployed the March patch to all clients/servers.

[TwistedHelixis]

I would also add:

 

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanSer ver\Parameters" SMB2 -Type DWORD -Value 1 -Force

 

So does that mean I only need the following for my Windows 7 clients??

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanSer v er\Parameters" SMB1 -Type DWORD -Value 0 -Force

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanSer ver\Parameters" SMB2 -Type DWORD -Value 1 -Force