ellsandell Posted May 13, 2017 Posted May 13, 2017 Some info on the Killswitch. This sinkholed domain has prevented further infections occurring and has already resulted in preventing over 100,000 potential infections. https://www.ncsc.gov.uk/blog-post/finding-kill-switch-stop-spread-ransomware-0 It looks like #WannaCry’s killswitch check (www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com) is not proxy aware: https://blog.didierstevens.com/2017/05/13/quickpost-wcry-killswitch-check-is-not-proxy-aware
ellsandell Posted May 13, 2017 Posted May 13, 2017 I can't see this mentioned, how exactly did this affect their phone systems? Are they windows based? DHCP Servers potentially affected - along with if Trusts are running something like UCCX, (Cisco Call Centre handling) for example, that has a dependency on logging into a web/ desktop agent.
FN-GM Posted May 13, 2017 Posted May 13, 2017 I can't see this mentioned, how exactly did this affect their phone systems? Are they windows based? I am wondering the same. It could also be an IP phone system and they have pulled the plug on the network to stop the spread? 1
mullet_man Posted May 13, 2017 Posted May 13, 2017 Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol [color="#FF0000"]-NoRestart[/color] Is there guide on how best to disable using sccm?
smarties11 Posted May 13, 2017 Posted May 13, 2017 https://blog.didierstevens.com/2017/05/13/quickpost-wcry-killswitch-check-is-not-proxy-aware Could always set the domain as a local exception in IE then create the domain as zone in your local DNS and point the www A record to a locally hosted IIS/Apache instance....
DrCheese Posted May 13, 2017 Posted May 13, 2017 Just startup script it Put a check file in place to top it running on every reboot (means any new machines will get it as well)
Jaan Posted May 13, 2017 Posted May 13, 2017 Anybody know which update is needed to fix this vulnerability? We have a WSUS server that we actively monitor to push updates. We are a w7 2012 and 2016 site. Would be great if i could look for a specific KB. Whats the best method to disable or remove smb1 as i believe this is where the issue is unless im wrong. Maybe the mods could have a section in security that has info on how to check if your vulnerable and how to fix if you are? hope i dont see a ransomware screen when i get to work come monday.
ellsandell Posted May 13, 2017 Posted May 13, 2017 Could always set the domain as a local exception in IE then create the domain as zone in your local DNS and point the www A record to a locally hosted IIS/Apache instance.... Bingo! Exactly that. Sophos / Avast and some other vendors have started blocking that URL which won't help things.
DrCheese Posted May 13, 2017 Posted May 13, 2017 Sophos / Avast and some other vendors have started blocking that URL which won't help things. Yea, that's pretty stupid as it'll cause the ransomware to encrypt files :/
localzuk Posted May 13, 2017 Posted May 13, 2017 Boggles the mind how companies can disable updates due to their being agreed limits on boot up/logon times. I think I found out why they did it - laziness. Windows Update, now it is re-enabled on the servers, is not working at all on the primary DC. A quick look through the historic logs, shows the same errors before it was disabled... So, yeah. Laziness.
FN-GM Posted May 13, 2017 Posted May 13, 2017 Is there guide on how best to disable using sccm? Stick the command in a powershell file. And make an application like the below https://community.spiceworks.com/topic/1369218-how-use-sccm-to-run-powershell-script-on-user-s-pc 1
mullet_man Posted May 13, 2017 Posted May 13, 2017 I think I found out why they did it - laziness. Windows Update, now it is re-enabled on the servers, is not working at all on the primary DC. A quick look through the historic logs, shows the same errors before it was disabled... So, yeah. Laziness. Laziness and complete stupidity by the sounds of it. Must have gone like this Tech A : "Windows update is creating lots of errors" Tech B : "just disable it and the errors will go away" Haha
mullet_man Posted May 13, 2017 Posted May 13, 2017 Stick the command in a powershell file. And make an application like the below https://community.spiceworks.com/topic/1369218-how-use-sccm-to-run-powershell-script-on-user-s-pc Perfect! Thanks. Will test over the rest of the weekend and deploy out ready for Monday.
googlemad Posted May 13, 2017 Posted May 13, 2017 Phones are mainly IP based and the community ones (GPs, dentists etc) all go back to the main site servers so once the link to those is chopped off bye bye phones. That and there are only so many 'lines' available which I imagine would have been overwhelmed at the time with people trying to find out information on their appointments and the like...
MrEprise Posted May 13, 2017 Posted May 13, 2017 (edited) I am wondering the same. It could also be an IP phone system and they have pulled the plug on the network to stop the spread? Could be worse if they were using something like Nortel's BCM 400 or 450 PBXs as the software on these run on top of Windows NT 4.0 Server! Edited May 13, 2017 by MrEprise
DrCheese Posted May 13, 2017 Posted May 13, 2017 Could be worse if they were using something like Nortel's BCM 400 or 450 PBXs as the software on these run on top of Windows NT 4.0 Server! *Looks at his Nortel BCM450* *Cries* Tho iirc ours runs the Linux version... (Yes trust me I'm fighting to replace it!!)
Asgard Posted May 13, 2017 Posted May 13, 2017 (edited) Does anyone have a warning email for staff I could steal please? @FN-GM University of Kent shared this about Phishing recently https://blogs.kent.ac.uk/isnews/you-cant-afford-not-to-read-this/ Edited May 13, 2017 by Asgard 1
timbo343 Posted May 13, 2017 Posted May 13, 2017 Ive been out the loop as ive been dealing with a friend's funeral, but how did this actually happen? It seems it targetted XP and 7, 8 machines. Sorry if this has been asked before.
FN-GM Posted May 13, 2017 Posted May 13, 2017 Ive been out the loop as ive been dealing with a friend's funeral, but how did this actually happen? It seems it targetted XP and 7, 8 machines. Sorry if this has been asked before. To sum it up 1. SMB 1 enabled (it is enabled in Windows by default) 2. The patches released in March not installed. If you're on XP you obviously wouldn't get these.
MrEprise Posted May 13, 2017 Posted May 13, 2017 *Looks at his Nortel BCM450* *Cries* Tho iirc ours runs the Linux version... (Yes trust me I'm fighting to replace it!!) Maybe it's just the 400 then. I recall 1 or 2 of their models did run that where as some of the others (like the BCM50 which we had for a while) were a bit better by running linux.
ellsandell Posted May 13, 2017 Posted May 13, 2017 Ive been out the loop as ive been dealing with a friend's funeral, but how did this actually happen? It seems it targetted XP and 7, 8 machines. Sorry if this has been asked before. Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate. Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes. Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes) Kill switch: If the website http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. SECURITY BULLETIN AND UPDATES HERE: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx Microsoft first patch for XP since 2014: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ Killswitch source: https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168
timbo343 Posted May 13, 2017 Posted May 13, 2017 To sum it up 1. SMB 1 enabled (it is enabled in Windows by default) 2. The patches released in March not installed. If you're on XP you obviously wouldn't get these. Cheers, but did it hit via email with an excel attachment, pdf or a URL or was it via a site someone had visited? I read ir was via an email but then read another article that said it hit via a hole in chrome.
Arthur Posted May 13, 2017 Posted May 13, 2017 how did this actually happen? It seems it targeted XP and 7, 8 machines. The Register has a good summary and Cisco's Talos blog has the technical details. www.theregister.co.uk/2017/05/13/wannacrypt_ransomware_worm http://blog.talosintelligence.com/2017/05/wannacry.html
Arthur Posted May 13, 2017 Posted May 13, 2017 (edited) I read it was via an email but then read another article that said it hit via a hole in chrome. Not sure. https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html Although ransomware on a public sector system isn’t even newsworthy, systems being hit simultaneously across the country is (contrary to popular belief, most NHS employees don’t open phishing emails which suggested that something to be this widespread it would have to be propagated using another method) Edited May 13, 2017 by Arthur 1
timbo343 Posted May 13, 2017 Posted May 13, 2017 Thanks everyone, looks like ill be updating the features list on all machines by running "Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force". Luckily our clients are windows 10 patched with April's CU, a few offsite staff laptops are on win7.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now