Bad Rabbit - New Ransomware Outbreak - 24/10/17

[Dos_Box]

This will be one to watch tomorrow - 'Bad Rabbit' ransomware strikes Ukraine and Russia - BBC News

 

Meanwhile, US officials said they had "received multiple reports of Bad Rabbit ransomware infections in many countries around the world".

 

No news of the attack vector yet, so keep your eyes open people.

Edited October 24, 2017 by Dos_Box

[timbo343]

Just read about this too, yep weill be one to look out for.

 

Here's sophos' take on it too https://nakedsecurity.sophos.com/2017/10/24/bad-rabbit-ransomware-outbreak/amp/

Edited October 24, 2017 by timbo343

[timbo343]

Possible vaccine found??

[free780]

Looks like the exe is actually signed.

[NB9457]

Is anyone using Cybereason RansomFree? Would this pick up on it do you think?

 

Edit: After reading Cybereason's website, The twitter link above is somebody who works for Cybereason

Edited October 25, 2017 by NB9457

[Arthur]

Windows Defender, Kaspersky and ESET all detected BadRabbit before most other anti-virus software did.

 

https://twitter.com/GossiTheDog/status/922849061606215680

 

 

https://twitter.com/GossiTheDog/status/922852052342132738

 

[Arthur]

No news of the attack vector yet

ESET have a great analysis...

 

https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/

[hardtailstar]

@DanTheLacky

[ADMaster]

Time to call in Elmer and Daffy, its WABBIT season.

 

I have automated the vaccine with group policy.

 

1. create the files on a network share, I just made a sub folder in netlogon called badrabbit.

2. use gpp file copy to put the files in %windir%

3. use group policy file permissions to clear all permissions from the files we have just added.

 

I've taken a screen shot of each step.

 

GPResults for file security

 

GPResults for GPP file copy

 

Configuring file permissions in Windows Settings > Security Settings > File System

 

Configuring GPP file copy in Preferences > Windows Settings > Files

 

The end Result

[ReadTheNetwork]

Hey all,

 

Thanks to #Amit Serper​ here's a fix for today's issue:

Create two files and remove inheritance from them

C:\Windows\infpub.dat

C:\Windows\cscc.dat

 

https://gist.github.com/Belorum/7b57e925a0bcc6ed6a72b6af07006ace

[elsiegee40]

Threads merged

[gshaw]

Time to call in Elmer and Daffy, its WABBIT season.

 

I have automated the vaccine with group policy.

 

1. create the files on a network share, I just made a sub folder in netlogon called badrabbit.

2. use gpp file copy to put the files in %windir%

3. use group policy file permissions to clear all permissions from the files we have just added.

 

I've taken a screen shot of each step.

 

GPResults for file security

[ATTACH=CONFIG]45937[/ATTACH]

 

GPResults for GPP file copy

[ATTACH=CONFIG]45938[/ATTACH]

 

Configuring file permissions in Windows Settings > Security Settings > File System

[ATTACH=CONFIG]45939[/ATTACH]

 

Configuring GPP file copy in Preferences > Windows Settings > Files

[ATTACH=CONFIG]45940[/ATTACH]

 

The end Result

[ATTACH=CONFIG]45941[/ATTACH]

Yup I did the same yesterday, nice guide with the file permissions too

[elsiegee40]

Mr gee40’s employer has taken a hit in their Eastern bloc offices. Luckily it hasn’t got outside there... so far