Article: WannaCry Ransomware – Info, Patches & tips to disable SMBv1

[ZeroHour]

You can view the page at http://edugeek.me/article/575

[timbo343]

Excellent, thank you @ZeroHour for putting this together, this will really help everyone out there on patching and preventing this worm from spreading.

 

Also, it might be worth mentioning, unblock the 2 unlock domains that are mention on the thread too.

[mikeprice]

Thanks @ZeroHour - much needed!

[Geoff]

@ZeroHour The patches page makes no mention of the win2k8r2 patches.

[Dos_Box]

@ZeroHour The patches page makes no mention of the win2k8r2 patches.

 

I believe you can find the link on this page Geoff: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

It lists all of them and the Server 2008R2 patches are here: Microsoft Update Catalog although I'd recommend reading the first article...erm...first.

[Alis_Klar]

Have found a really great blog from the authors of MetaSploit which gives some sensible advice and says not to go out and panic buy a snake oil solution

 

https://community.rapid7.com/community/services/blog/2016/07/01/prepare-yourself-for-ransomware-no-more-snake-oil-please

[azc]

It's worth installing the Anti-Ransomware File System Resource Manager Lists to your file servers.

 

https://fsrm.experiant.ca/

 

It's a Powershell script that:

 

* Installs FSRM if it's not already installed

* Downloads a list of ransomware file names

* Configures FSRM to block any files with these names and alert you immediately

 

It requires Powershell 4.0 to run, so an update will be required on Server 2008 but should run fine on 2012.

 

Don't forget to configure the FSRM alerts once it's installed. To update this information, in File Server Resource Manager, on the Action menu, click Configure Options, and then update the email addresses on the Email Notifications tab.

 

You might want to schedule the script to run every day, so that the latest lists are downloaded and installed automatically.

Edited May 16, 2017 by azc
added a sentence

[snagrat]

It's worth installing the Anti-Ransomware File System Resource Manager Lists to your file servers.

 

https://fsrm.experiant.ca/

 

It's a Powershell script that:

 

* Installs FSRM if it's not already installed

* Downloads a list of ransomware file names

* Configures FSRM to block any files with these names and alert you immediately

 

It requires Powershell 4.0 to run, so an update will be required on Server 2008 but should run fine on 2012.

 

Don't forget to configure the FSRM alerts once it's installed. To update this information, in File Server Resource Manager, on the Action menu, click Configure Options, and then update the email addresses on the Email Notifications tab.

 

You might want to schedule the script to run every day, so that the latest lists are downloaded and installed automatically.

 

This!

 

Doesn't work on 2016 but I've updated the script so it does.

 

Also emailing isn't great if you can't relay so I've created a Powershell to run based on event ID that sends an email

[Alis_Klar]

Have found a really great blog from the authors of MetaSploit which gives some sensible advice and says not to go out and panic buy a snake oil solution

 

https://community.rapid7.com/community/services/blog/2016/07/01/prepare-yourself-for-ransomware-no-more-snake-oil-please

[ZeroHour]

@ZeroHour The patches page makes no mention of the win2k8r2 patches.

Hi @Geoff,

Completely forgot about that edition but I am struggling to see patches for it. I am not sure but it may be possible the 2008 patches are just compatible with as R2 was more a feature pack back then if I recall.

@azc thats a nice sounding script, I will check it out.

Edited May 16, 2017 by ZeroHour

[azc]

This!

 

Doesn't work on 2016 but I've updated the script so it does.

 

Also emailing isn't great if you can't relay so I've created a Powershell to run based on event ID that sends an email

 

Have you done the needful so that your fixes are pushed up to their GitHub project?

 

- - - Updated - - -

 

There's a WannaCry Megathread over on Reddit at /r/SysAdmin -

[ZeroHour]

Article has been updated with WSUS KB numbers and a link to a tutorial for SCCM reports for WannaCry.

[mrwoberts]

Had a real problem with one of my servers today, after I made the recommended changes (MS article).

 

It came down to a dependency failure with the lanmanserver - it was still looking for mrxsmb10.

 

Here's what I had to run in order to get the server, and workstations, playing nicely again.

REG ADD HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters /v SMB1 /t REG_DWORD /d 0 /f
REG ADD HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters /v SMB1 /t REG_DWORD /d 0 /f

sc.exe config lanmanserver      depend= samss/srv2
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10  start= disabled
sc.exe config mrxsmb    start= auto
sc.exe config mrxsmb20  start= auto

sc.exe config srv       start= disabled
sc.exe config srv2      start= auto

net stop server
net stop mrxsmb10
net stop srv

net start mrxsmb20
net start srv2
net start server

Edited May 16, 2017 by mrwoberts
formatting and extra net commands

[ZeroHour]

Excellent, thank you @ZeroHour for putting this together, this will really help everyone out there on patching and preventing this worm from spreading.

 

Also, it might be worth mentioning, unblock the 2 unlock domains that are mention on the thread too.

@timbo343 it might be easier to make a dns entry on your dns server as I read it simply looks for the domain to exist but not necessarily work. A dns entry locally would trigger the same fix. Now if there was a way to monitor hits to that domain internally you would know if something was up as well.

[mjk]

Sorry for being a div but could somebody explain to me why the need to disable SMB1 please.

All I see is posts about how this screws up peoples networks, or do the patches provided by MS not fix the problem ?

Surely it's patch OR disable SMB1 ???

[Dos_Box]

Sorry for being a div but could somebody explain to me why the need to disable SMB1 please.

All I see is posts about how this screws up peoples networks, or do the patches provided by MS not fix the problem ?

Surely it's patch OR disable SMB1 ???

 

The quick and easy answer is because it is:

 

a. A very old protocol/service which has been superseded by SMBv2 and v3 and you don't need it any more (but just check that you really don't have some old legacy kit connected to your network that does first though)

 

and...

 

b. Compromised. Regardless of the fact that there is a patch (which was relevant to v1) it is safer (for now) to assume that it could potentially produce some other nasty surprises down the line. There are already reports that there may be variations of WannaCrypt emerging, all looking to spread via SMB v1

 

and...

 

c. Removing it prevents ANY chance of it spreading should it encounter your network

 

I think that just about covers it. It's all about prevention and damage limitation don'tcherknow.

Edited May 18, 2017 by Dos_Box

[mjk]

thanks, I'll go on the assumption that the patch is only a sticking plaster and will disable it.

[ZeroHour]

thanks, I'll go on the assumption that the patch is only a sticking plaster and will disable it.

 

Yeah SMBv1 was created around 1990. SMBv2 has better performance and unless you have a need for v1 (Windows XP, OSX Pre Mavericks) than you are better off turning it off.

[philipksmith]

This is all great advice - excellent article.

 

Any Smoothwall customer planning to disable SMB1 (and we recommend this) should ensure they update their system to our Inverness release first to ensure they continue to authenticate users.

 

If you do not update to Inverness your system will continue to filter effectively, but you might not be able to authenticate users since we would be unable to communicate with the domain controller.

 

Regards

 

Phil

[PotNoodleTech]

Just be aware that you may have some devices that are using SMB1 even though they're relatively modern (and shouldn't be!), my Synology NAS's were set to use SMB1 as default and the maximum SMB level allowed...... SMB......1. Great work Synology!

 

Changed in the settings to use SMB2 as default up to maximum of SMB3 and all is well now with the shares on that NAS.

 

So sometimes you won't find out something is using SMB1 until it disconnects! I would advise against doing a blanket SMB1 ban across the site, maybe start of doing it room by room and double check for issues.

[penfold]

It's worth installing the Anti-Ransomware File System Resource Manager Lists to your file servers.

 

https://fsrm.experiant.ca/

 

It's a Powershell script that:

 

* Installs FSRM if it's not already installed

* Downloads a list of ransomware file names

* Configures FSRM to block any files with these names and alert you immediately

 

It requires Powershell 4.0 to run, so an update will be required on Server 2008 but should run fine on 2012.

 

Don't forget to configure the FSRM alerts once it's installed. To update this information, in File Server Resource Manager, on the Action menu, click Configure Options, and then update the email addresses on the Email Notifications tab.

 

You might want to schedule the script to run every day, so that the latest lists are downloaded and installed automatically.

 

Just check your FileScreens before you do this as you could end up losing existing ones - Part of the script deletes the File Screen and then re-creates a new one. If you have additional file screens on the default shares they will be lost. I've just remembered that I had an media file block on one of my shares and that's gone.

[azc]

Just check your FileScreens before you do this as you could end up losing existing ones - Part of the script deletes the File Screen and then re-creates a new one. If you have additional file screens on the default shares they will be lost. I've just remembered that I had an media file block on one of my shares and that's gone.

 

You should report that to their issues tracker. https://github.com/nexxai/CryptoBlocker/issues

[penfold]

You should report that to their issues tracker. https://github.com/nexxai/CryptoBlocker/issues

 

Had to sign up but reported it as an issue now.

[timbo343]

Quick question about this...

 

Can we get away with having 2017-05 (kb4019264) installed and the SMB1 client still enabled on servers so we can perform backups to NASs that only support SMB1?

[Geoff]

Yes. That's possible, although not recommended.