Ransomware back in the news

[Nigel-YZ1]

Possibly. I wouldn't be confident until the whole thing is unravelled and analysed with confidence. Rumours of trojans also contained within it, for example.

Signatures are out for AV and NIPS, and of course the patch has been around for ages, so if you get hit now your CIO needs to be answering the tough questions.

Some more info:
https://www.symantec.com/connect/blogs/petya-ransomware-outbreak-here-s-what-you-need-know?om_ext_cid=biz_social_NAM_twitter_Asset Type - Blog,Petya

I'm definitely not confident.
While some are crowing about repeats of Wannacry and laughing about lessons not learned, a small minority are seeing that this one doesn't move via SMB, it's being moved by PSExec and WMIC.

 

[jefmcg]

I lock my bike and am happy I've done something to secure it. I'll question if the lock or chain are still strong enough periodically, and check them for signs of tampering. There seems to be no forward progress in making the lamp post to which I've chained it more resilient to being sawn through.

So, you feel that you are responsible for securing your bike. Why then do you regard the suggestion that people should secure their PCs as victim blaming?

 

[numbnuts]

Found this on the BBC website, don't know if it's any good

https://www.bleepingcomputer.com/ne...found-for-petya-notpetya-ransomware-outbreak/


Download here -
https://download.bleepingcomputer.com/bats/nopetyavac.bat

 

[Nigel-YZ1]

So, you feel that you are responsible for securing your bike. Why then do you regard the suggestion that people should secure their PCs as victim blaming?

So, you feel that someone who has their bike stolen despite it being secured is not a victim?

 

[Nigel-YZ1]

Found this on the BBC website, don't know if it's any good

https://www.bleepingcomputer.com/ne...found-for-petya-notpetya-ransomware-outbreak/


Download here -
https://download.bleepingcomputer.com/bats/nopetyavac.bat

It is good. I found it last night and took the advice for my servers, after finding talk on Twitter from security researchers that patched computers and Windows 10 were being infected.

 

[Tin Pot]

I'm definitely not confident.
While some are crowing about repeats of Wannacry and laughing about lessons not learned, a small minority are seeing that this one doesn't move via SMB, it's being moved by PSExec and WMIC.

Not true, if Rapid7 are to be believed.

We've confirmed that this ransomworm achieves its initial infection via a malicious document attached to a phishing email, requiring a victim to download and open it (update: see the 16:50 text below). After that, it does indeed use the EternalBlue and DoublePulsar exploits to spread laterally. Unlike WannaCry, though, it is currently using these mechanisms to spread only on internal networks.

https://community.rapid7.com/community/infosec/blog/2017/06/27/petya-ransomware-explained

 

[Nigel-YZ1]

Not true, if Rapid7 are to be believed.
https://community.rapid7.com/community/infosec/blog/2017/06/27/petya-ransomware-explained

Maybe both true?

https://blogs.technet.microsoft.com...-old-techniques-petya-adds-worm-capabilities/

The authors are hedging their bets and going for multiple spreading techniques.
It's all part of the dance that I was witnessing last night. All the time I was sat there wanting to know the initial attack vector, and all I was reading was about the effects after someone already had it.
MS are saying infected software update, but I also read about Word macros being used too.
In the end I dialed in and shut down our backup NAS just in case, and sent an email to my users. They're a great bunch for questioning suspect stuff.

 

[Tin Pot]

Maybe both true?

https://blogs.technet.microsoft.com...-old-techniques-petya-adds-worm-capabilities/

The authors are hedging their bets and going for multiple spreading techniques.
It's all part of the dance that I was witnessing last night. All the time I was sat there wanting to know the initial attack vector, and all I was reading was about the effects after someone already had it.
MS are saying infected software update, but I also read about Word macros being used too.
In the end I dialed in and shut down our backup NAS just in case, and sent an email to my users. They're a great bunch for questioning suspect stuff.

Smart move - you have off lines too? Sometimes hard to justify in our cloud obsessed world.

I was only challenging you on that it does indeed spread over SMB - we already agree other vectors are also in use.

I'm challenging security companies for better response tools, email continues to be a problem after an outbreak is determined as removing emails that haven't been opened can be an arduous task.

Worm style vectors are old hat fixed by security basics; NAC, segregation, least privilege, etc.

 

[Tin Pot]

More on vectors, tax software source...

http://www.bbc.co.uk/news/technology-40428967

 

[Nigel-YZ1]

Smart move - you have off lines too? Sometimes hard to justify in our cloud obsessed world.

I was only challenging you on that it does indeed spread over SMB - we already agree other vectors are also in use.

I'm challenging security companies for better response tools, email continues to be a problem after an outbreak is determined as removing emails that haven't been opened can be an arduous task.

Worm style vectors are old hat fixed by security basics; NAC, segregation, least privilege, etc.

Yes, the NAS is the main bulk target and is on line but locked down to domain admin only, that takes a weekly backup of the servers and a nightly from selected workstations using Veeam Endpoint backup. It's a Synology which cuts down the OS risk. I rotate USB drives on the production server, with only one connected at a time.

I've got email going through SpamStopsHere before it hits Office 365. They're 99.9% successful at stopping the crap. Probably a dozen got through in the last 1.5 years, and all of them were links to compromised URLs or fake DropBox. Anything with an attachment goes to my Postmaster account for approval.

I agree that some means of freezing emails for examination would be an extra step.
I think it's about time Outlook had the ability to block anything clickable in an email outside of Junk. It's only been asked for constantly for 20+ years.

I implemented software whitelisting and a domain local admin separated from the domain admin last week.

And I'm still clutching my teddy expecting something else to go wrong!!

 

[Tin Pot]

Yes, the NAS is the main bulk target and is on line but locked down to domain admin only, that takes a weekly backup of the servers and a nightly from selected workstations using Veeam Endpoint backup. It's a Synology which cuts down the OS risk. I rotate USB drives on the production server, with only one connected at a time.

I've got email going through SpamStopsHere before it hits Office 365. They're 99.9% successful at stopping the crap. Probably a dozen got through in the last 1.5 years, and all of them were links to compromised URLs or fake DropBox. Anything with an attachment goes to my Postmaster account for approval.

I agree that some means of freezing emails for examination would be an extra step.
I think it's about time Outlook had the ability to block anything clickable in an email outside of Junk. It's only been asked for constantly for 20+ years.

I implemented software whitelisting and a domain local admin separated from the domain admin last week.

And I'm still clutching my teddy expecting something else to go wrong!!

This is the life you chose! Bon chance.

 

[Inertia]

Ouch

The virus that began spreading through European computers yesterday informed users that they could unlock their machines by paying a $300 ransom. But it looks like the bug’s creators had no intention of restoring the machines at all. In fact, a new analysis reveals they couldn’t; the bug was designed to wipe computers outright

Petya virus is something worse than ransomware, new analysis shows - The Verge
https://apple.news/Ati9qPAHSTFq_Mc6PdG84Qw

 

[fossyant]

The company my missus works for was affected last time, or their cloud host was. I believe the host had to pay to get their servers unlocked. Stopped business for a few days (all their work/systems are cloud based).