NHS hit hard by ransomware / Wannacry Patching

[Geoff]

Thought I'd take your idea and run with it... https://www.howmuchhasbeensent.com/

 

It's been thrown together very quickly, already needs to be rewritten as version 2, but it should at least provide an overall figure and current currency conversion (no graphs yet - they're difficult to do). Please play nice with it everyone.

 

Very pretty, what is it written in?

[LeMarchand]

eh? @LeMarchand

 

Another moon - going by your Location statement should be near you.

[Stuajnht]

Very pretty, what is it written in?

 

The theme is from this website: https://startbootstrap.com/template-overviews/freelancer/ (I'm nowhere talented enough to make something look that nice). The back end is just plain old PHP.

[Arthur]

https://www.howmuchhasbeensent.com/

It looks like files won't get decrypted even if you pay.

 

https://twitter.com/threatintel/status/864504755506343936

 

[Arthur]

https://twitter.com/JustEatUK/status/864459149039595520

 

 

^ Considering what the British tabloid press did to MalwareTech, this is quite a nice gesture.

 

https://thenextweb.com/insider/2017/05/15/doxing-hero-stopped-wannacry-irresponsible-dumb/

 

Last Friday, the UK-based security researcher stopped the WannaCry ransomware in its tracks thanks to an ingenious bit of technological trickery, thus preventing more machines from getting infected. We owe him a massive debt of gratitude.

 

At the very least, we should respect his privacy. MalwareTech doesn’t give out his name on his Twitter page or blog. There are no headshots. It’s obvious that he just wants to be left alone to get on with what he enjoys – hacking , and figuring out how stuff works.

 

Enter the British tabloid press, which late last night doxxed the man behind MalwareTech for literally no apparent reason.

 

And I don’t use the term ‘doxxed’ lightly. They pored through his online footprint until they eventually had enough evidence to identify someone who literally didn’t want to be identified.

 

From what I can tell, the Daily Telegraph was the first publication to share his name, although other festering sphincters of bad journalism — namely The Sun, The Mirror, and The Daily Mail — weren’t far behind. I’m not going to link to their piece, because them.

 

The Telegraph talks a little bit about how he’s self-taught, and how he stopped WannaCry by figuring out it had a kill-switch.

 

But that as far as the technical side of the piece goes, because the rest is random factoids about MalwareTech uncovered through stalking other people’s Twitter and Instagram accounts.

[forkies]

Initial reports I saw said Telefonica was the first reported hit (can't find the sources now to link this) but it stated they run network equipment across Spain and some core NHS equipment. So I would assume if they got infected first, it could have spread on their infrastructure level to their customers? Apparently companies in Spain where hit the most to start with. Again I cannot remember where I saw this.

[ozydave]

Here's the next version to worry about Uiwix

https://heimdalsecurity.com/blog/security-alert-uiwix-ransomware/

[Manny-Tech]

I know of standard users that are being asked to perform patch updates for the NHS at local practices. They must be a right old mess.

[googlemad]

Our email has gone back online after a COBRA meeting internally decided 290 PCs out of roughly 3500 still needing updates or a reboot was minimal risk, had the boss in earlier as we had been asked for specific numbers as to how many Windows machines total, how many patched, how many unpatched which we eventually convinced them was an unrealistic request being that we would have old objects in AD, machines not connected to WSUS, embedded Windows etc.

 

Quite scary how you realise how you don't have the network as under control as you may think which is no fault of anybody in particular just how it is, in my last job in education I could pretty much name every single device connected to the network and where it was just from memory. A positive however in that I am very quickly learning what is what at my Trust as a result of all this and our boss is basically giving us free roam to get the updates on machines and if we have any suggestions for security to pass them on to him.

[Garacesh]

Quite scary how you realise how you don't have the network as under control as you may think which is no fault of anybody in particular just how it is, in my last job in education I could pretty much name every single device connected to the network and where it was just from memory.

 

You've got an ever-expanding network that requires 100% up-time, and that's probably had 99% up-time for the past half a decade, minimum (seriously, d'you ever see a PC get shut down at a hospital? One receptionist/triage/GP/doctor/whoever moves, another one takes their place seemingly immediately) so this kind of stuff is bound to happen. I'm more impressed that you were able to pull off explaining that to management and not getting a response amounting to "Well just do it anyway."

[mullet_man]

I've got one and on it's firmware it mentions SMB but no version to choose.

 

My PC now has SMBv1 disabled and I can still access it so am guessing it's SMBv2.

 

I tell a lie disabling SMBv1 has broken me being able to access our NAS box.

Edited May 17, 2017 by mullet_man

[Alis_Klar]

I tell a lie disabling SMBv1 has broken me being access to access our NAS box.

 

My QNAP was inaccessible with smb1 disabled but upgrading the firmware fixed it.

[3s-gtech]

Semi-recent models (post 2011) running Samba 3.6 onwards seem to be fine. If your NAS dates before that prepare to hack it or ditch it - I'm six down now (five other more recent ones have been fine). Not going to cost too much to sort as I can swap disks across.

[JJonas]

Not sure if this has already been posted, if it has sorry

 

https://blogs.technet.microsoft.com/staysafe/2017/05/17/disable-smb-v1-in-managed-environments-with-ad-group-policy/

[mullet_man]

My QNAP was inaccessible with smb1 disabled but upgrading the firmware fixed it.

 

It's on the latest firmware as far as I can see, it's not in use so doesn't really cause any issues I just use it to dump stuff on that I don't really need but keep a backup of just in case.

[Simcfc73]

I have a QNAP TS-469L running 4.1.4. I'm not on the latest as I had issues with the SMART reporting on my drives so left it at this. Its never had SMBv1 enabled on it and the only thing I found was after I removed it from my desktop I couldn't connect via the IP address.. using the FQDN works.

 

I'm the only one that uses it anyway so it was only me affected.

 

I know this worked prior to disabling v1.

[Bob_the_Goon]

@Arthur I have tested this with a test GPO however it doesn't appear to work. I have tried to ping bbc.co.uk and I still get a reply. Shouldn't this fail to send in the first place. I've blocked all outbound traffic for %SystemRoot%\System32\cmd.exe on all profiles (Domain, Private and Public). I can see the rule appear in the firewall. Is there a better test for me to try or should in theory this work?

[JRA]

Anyone actually used Microsoft's analyser linked a little way back?

 

https://www.microsoft.com/en-us/download/details.aspx?id=7558

 

Thanks for any info on it if so!

[Chuckster]

Not sure if this has already been posted, if it has sorry

 

https://blogs.technet.microsoft.com/staysafe/2017/05/17/disable-smb-v1-in-managed-environments-with-ad-group-policy/

 

Do you know if this applies to Windows 10, Server 2008 R2, 2012 R2 and 2016?

 

I'm assuming this works with Windows 7 fine.

[mrbios]

I just had an odd problem removing SMB1 off one server. Workstation service wouldn't start, complaining of a missing dependency. I had to manually remove mrxsmb10 from the lanmanworkstation dependson key and add in mrxsmb20 and restart. It didn't seem to complete the removal properly. This was on a 2012R2 server, all appears fine now though. Anyone else had that happen yet?

[Arthur]

Is there a better test for me to try or should in theory this work?

It should have worked. I'll do a bit more testing to find out what's going on.

[pcstru]

I've seen instructions on disabling SMB v1 etc and seen some people then experience problems. What I'm failing to find is a way to positively test that a server is or is not offering SMB v1. I don't mean check the registry etc, I mean something that will actually probe and tell me if the server accepts connections for the service or not.

 

Anyone?

[Arthur]

I've seen instructions on disabling SMB v1 etc and seen some people then experience problems. What I'm failing to find is a way to positively test that a server is or is not offering SMB v1. I don't mean check the registry etc, I mean something that will actually probe and tell me if the server accepts connections for the service or not.

Use Microsoft Message Analyzer.

 

Instructions: https://blogs.technet.microsoft.com/ralphkyttle/2017/05/13/smb1-audit-active-usage-using-message-analyzer/

[pcstru]

Use Microsoft Message Analyzer.

Thanks. I'm not sure that does quite what I want. It will allow me to see SMB v1 traffic and identify source/dest. I essentially want to generate traffic and thus have a positive check that a server is not responding with "SMB v1? Hell yes, let's go!".

[Bob_the_Goon]

It should have worked. I'll do a bit more testing to find out what's going on.

 

I tried the test mentioned in this url and the GPO appears to work which is great. For some reason ICMP must have been the wrong thing to test. Looks like that it's all sorted now! I just need to slowly roll this out slowly to make sure that it doesn't break anything.

 

Thanks @Arthur