Jump to content

NHS hit hard by ransomware / Wannacry Patching

just_david

By just_david
in Windows

 Share

Recommended Posts

timbo343

timbo343

Posted
Posted

What about apple devices? Do we need to do anything with ipads / android devices?

 

- - - Updated - - -

 

So does that mean I only need the following for my Windows 7 clients??

 

That's what i've been doing.

Lonix

Lonix

Posted
Posted
I think you've hit that nail on the head there. I worked in the NHS IT dept for a brief spell, it's a very tough environment in which to do a good job, a large assortment of applications and systems, users logging calls and then unavailable for days, buildings that don't lend themselves to good IT installations. My heart goes out to out IT colleagues there.

 

Not forgetting how schools benefit from Microsoft's generous discounts on operating systems means it's easier to stay up to date.

 

According to an NHS IT consultant on Twitter, it's all easy and there should be absolutely no problem with keeping IT updated with patches and OS's.

 

And no I don't agree with that consultant - words are always easy compared to actions (as many of us know working in Schools which are not 24/7).

TechMonkey

TechMonkey

Posted
Posted
According to an NHS IT consultant

 

My emphasis. I bet he or his company will be contacting every trust telling them how they would have prevented this all happening or for a low, low price or £999.99 they can come in and tell them where they are going wrong.

  • Thanks 1
psydii

psydii

Posted
Posted

Maintenance windows.

 

They manage to clean and repaint hospitals. They manage to change the furniture, add and remove medical equipment etc.

 

That hospitals are 24/7 is not an excuse for being 3 years late replacing kit that could stop a hospital in its tracks when it fails.

 

It is mismanagement by the individual trusts.

3s-gtech

3s-gtech

Posted
Posted
Maintenance windows

 

...for Windows maintenance?

 

Totally agree though. A computer is another tool in the hospital to be looked after and maintained, just like the medical equipment. If operations etc are being cancelled because of this, they're obviously pretty important to the way they operate.

PotNoodleTech

PotNoodleTech

Posted
Posted (edited)
Maintenance windows.

 

They manage to clean and repaint hospitals. They manage to change the furniture, add and remove medical equipment etc.

 

That hospitals are 24/7 is not an excuse for being 3 years late replacing kit that could stop a hospital in its tracks when it fails.

 

It is mismanagement by the individual trusts.

 

It's very easy to be judgemental. The sad thing is, it's mismanagement at a high enough of level where accountability gets very blurred. The IT department will likely end up being blamed.

 

We all know that in real life IT often gets deprioritised and that those priorities are often outside of control of the poor staff trying to keep everything updated. I had two network cabs to replace in the Easter holidays and I couldn't do either of them as they had revision sessions in every day of the holiday. Do I instruct them that they absolutely can not voluntarily come in and revise ready for their exams? Of course not, that is not the way schools work. On the other hand with no overtime allowed, what else am I to do?

 

Thats' right, postpone until half term! It's easy to see how in a hospital that kind of thing could happen over and over and over again.

 

I'm not making excuses but I see how it could happen. It's made even more complicated by the "right we have to replace 1000 PCs to get them on Win7, there isn't the funding for it, and we'd need to replace/rewrite a load of bespoke software to get it all to work on Windows 7. So that kind of project ends up being postponed, and postponed, again and again too.

 

What is the answer? 1. More Funding. 2. More Staffing. 3. A much more flexible working environment for IT Staff. All of which are usually totally beyond the control of the IT Departments.

Edited by PotNoodleTech
  • Thanks 1
Lonix

Lonix

Posted
Posted
My emphasis. I bet he or his company will be contacting every trust telling them how they would have prevented this all happening or for a low, low price or £999.99 they can come in and tell them where they are going wrong.

 

Oh I agree. Just like us we can say exactly what we should be doing to make the perfect IT system but lets face it realistically we've got budgets, time and availability of equipment to think about.

 

It's always easy to say the right words. I could right now go to the Head and say what we need to cut down problems to a small amount. The Head will tell me to go find the money my self.

Lonix

Lonix

Posted
Posted
It's very easy to be judgemental. The sad thing is, it's mismanagement at a high enough of level where accountability gets very blurred. The IT department will likely end up being blamed.

 

We all know that in real life IT often gets deprioritised and that those priorities are often outside of control of the poor staff trying to keep everything updated. I had two network cabs to replace in the Easter holidays and I couldn't do either of them as they had revision sessions in every day of the holiday. Do I instruct them that they absolutely can not voluntarily come in and revise ready for their exams? Of course not, that is not the way schools work. On the other hand with no overtime allowed, what else am I to do?

 

Thats' right, postpone until half term! It's easy to see how in a hospital that kind of thing could happen over and over and over again.

 

I'm not making excuses but I see how it could happen. It's made even more complicated by the "right we have to replace 1000 PCs to get them on Win7, there isn't the funding for it, and we'd need to replace/rewrite a load of bespoke software to get it all to work on Windows 7. So that kind of project ends up being postponed, and postponed, again and again too.

 

What is the answer? 1. More Funding. 2. More Staffing. 3. A much more flexible working environment for IT Staff. All of which are usually totally beyond the control of the IT Departments.

 

My sentiment exactly. As for painting and furniture, I've been hospitals where the chairs are tacky and the walls could do with more than a coat of paint. It's always easy to say "maintenance window". You mean when you're under staffed? Firefighting all day and no time to 'plan' for everything?

 

As many of us know centralised IT and staff cut backs allow us to do our daily job with maybe a bit of breathing room. Enough breathing room for everything? No. As you said this will be down to those at the top.

 

Thing is for keeping hospitals clean is what exactly? a 1000 page document stating it must be followed or face closure? I doubt very highly there's a 10 page document (let alone 1000) of keeping an IT system updated to avoid outbreaks like this. It will most like be a paragraph.

 

The word postponed is a prime example. How many of us have put serious server work on hold till half terms? How many of us could do all our work during normal working hours? Considering some hospitals are open 24/7...... How many arguments would we have with staff when we keep doing downtime during term time? there's no money for overtime pay, no money for shift working staff. How many HTs/SLTs will get on our backs because we keep doing it.

 

Do we honestly think every HT/SLT will listen to our advice on much needed server downtime? updates? Hell No.

Alis_Klar

Alis_Klar

Posted
Posted
I just put the following into a startup script and applied it to all my clients:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

Also deployed the March patch to all clients/servers.

 

Can you break down line by line what each line does? What OS will this script work on?

 

Addtionally does a WannaCry infected system encrypt files on all mapped drives or seek out UNC paths? So potentially even a fully patched Windows server hosting a fileshare could be encrypted if even one client PC is infected with a user logged in that has access to a file share?

Alis_Klar

Alis_Klar

Posted
Posted (edited)

I downloaded MetaSploit and did a scan for MS17-010 vulnerable machines on my LAN. The makers of MetaSploit have some good advice not to panic buy snake oil solutions in the wake of this outbreak.

 

https://community.rapid7.com/community/services/blog/2016/07/01/prepare-yourself-for-ransomware-no-more-snake-oil-please

 

Also found out recent Ricoh MFC will no longer scan to a smb folder once smb1 is disabled. Still saves to folder on test server with smb1 enabled however.

 

PaperCut 15.1 still syncs with AD on Win Server 2012 R2 DC with SMB1 disabled.

Edited by Alis_Klar
DJ-1701

DJ-1701

Posted
Posted (edited)
Can you break down line by line what each line does? What OS will this script work on?

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

 

Ensures only the Computer Browser, SMBv2 (and by extension v3 on those that support it), Network Store Interface Service are started as part of the Workstation Service.

 

 

sc.exe config mrxsmb10 start= disabled

 

Ensures the SMBv1 service is disabled from running.

 

 

These commands can be run on Windows Vista+

Edited by DJ-1701
  • Thanks 1
Garacesh

Garacesh

Posted
Posted

 

List of windows updates with the fix

 

For those that block Reddit at work:

Here are the KBs needed for MS17-010, and any that supersede them.

"->" denotes the update on the right supersedes the update on the left.

Windows 8.1

KB4012216->KB4015550->KB4019215

Windows 7

KB4012212

KB4012215->KB4015549->KB4019264

Vista

4012598

Windows 10

KB4012606->KB4019474

KB4013198->KB4019473

KB4013429->KB4019472

Server 2008

KB4012598->KB4018466

Server 2008 R2

KB4012212

KB4012215->KB4015549->KB4019264

Server 2012

KB4012217->KB4015551->KB4019216

Server 2012 R2

KB4012213

KB4012216->KB4015550->KB4019215

  • Thanks 4
DJ-1701

DJ-1701

Posted
Posted
Why is everyone rushing to disable smbv1?

Isnt applying ms17-010 patch the fix?

 

1) It's outdated and it appears Microsoft are looking to get rid of it anyway, at least in later versions of Windows 10.

2) Yes, but it's belt and braces, why have an outdated technology if you don't need it? Some may though.

Chuckster

Chuckster

Posted
Posted

How do you run the command below as a PowerShell startup script?

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart

 

I've put it as a startup in a GPO but it doesn't disable it.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...