Ransomware / wannacry


K

Klumpen

Forum Addict!
Joined
Nov 19, 2011
Messages
8,577
You might have heard about "wannacry" but if not:
www.bbc.com/news/technology-39901382
https://www.lifehacker.com.au/2017/05/wannacry-ransomware-explained-by-an-aussie-security-expert/

In short, it uses a security hole from WinXP to Win8.1 to gain access, encrypts several files and then gives you a ransom notice with a timer you'll have to pay in order to have them decrypted again.
Whoever didn't update his Windows in the last two months is vulnerable.

Apparently, they even made a security patch for WinXP because it is so severe:
https://answers.microsoft.com/en-us...476d840cb?tab=question&status=AllReplies#tabs
 
Sounds familiar. Love how NSA tools got leaked and helped make this crap. Funny how I understood everything. Heck I think I recognize some of the tools from people writing thier own.
 
The hole was also in win10 before the lizard crew dropped the NSA tools (for a fee) and microsoft learned about the hole and patched it in March. Apparently versions of Enterprise Win 10 let you hold off critical updates for this long, so reportedly some users got bit by this on win 10 as well.

I'm actually quite impressed one bit of code can run on all those different OSes.
 
Been doing a bit of reading around concerning how this has impacted upon the NHS (National Health Service) in the UK.

It's a complete debacle, from what I understand a lot of NHS PC's are still running Windows XP, and it's pot luck as to whether those with more a up to date OS have the latest security updates from Microsoft installed. There are of course a lot of complications relating to IT updates with compatibility of custom software etc. but I fail to see how this could not have been easily prevented (in the NHS) by virtualisation / running things in legacy mode.

It seems to me that the top IT team at the NHS are a bunch of incompetent morons who'd rather piss billions up the wall on unnecessary projects rather than concentrate on the absolute basics.
 
Re: the NHS

They claimed today that after news about the number of unsupported XP installations broke late last year they've been working to upgrade everything, and now they're down to about 5% of machines. I'd guess some of the remaining 5% are in borderline embedded situations like running scanners and things, and changing the computer probably involves contracts and other agencies. Course, now, they should sue any companies that put them in such a situation by not upgrading embedded components and patching holes in network facing equipment, but they'll probably say it should never have been put on a machine that's accessible (even indirectly) from the internet. I'm guessing asking the NHS to air gap any systems in clinical settings is going to be a tough ask though.

I mean sure, it's a cock up that it took the press to get them upgrading, especially after all the news that XP support was ending, but it's a big system staffed mainly with people who aren't computer specialists, and use of computers has largely grown ad-hoc over the years to a certain extent, I suspect. Even if the head of computers says everything must be upgraded, that's still got to roll out to each trust, then to each hospital and GPs, then to each department, and to each machine. At some point you're bound to find someone who doesn't understand the significance, or just doesn't care.

I'd expect this event to have provided something a shock to the system which ought to result in better management of all of their machines though. It's probably not as grim as I'm painting it, because I've heard backup coverage is quite good, at least from a couple of end user reports.
 
TeDaDeS said:
In the Netherlands a parking company had this stuff on the payment machines, so you could not pay and leave the parking garage.
Click to expand...
That is kinda awesome. (Sucks for those that are trapped, though, but still...)
 
TeDaDeS said:
In the Netherlands a parking company had this stuff on the payment machines, so you could not pay and leave the parking garage.
Click to expand...
I imagine in this situation people would be allowed to leave without paying. They can't really hold you hostage...
 
As I'm still using XP in some machines (because buying a €5000 unmodifiable programmer is not feasible when my heavily-modded Willem made for €5 works perfectly), I only wonder how this thing happened on such a large scale?
The infection vector was a hole in SMB protocol. So all computers behind NAT are relatively safe, if ports for SMB are not forwarded. After incident with Win98's SMB password (which could be cracked letter-by-letter in... 5 seconds?) and later one, when simple query made consecutively hanged computers, I don't even think about putting SMB-enabled computer "to the world". So what administrators expected by putting machines with SMB into public IPs? "This is a hospital, we definitely won't get lots of connections all time and machines won't be frozen by someone's scanning script"? Making embedded systems not directly reachable is a base for their security.

And I know why there was so small amount of infections in Poland - we still have local networks behind NATs popular while separate IPs are few times more expensive.
 
I can't understand all the fuss about this thing (on TV/Magazines they are massively telling it's an attack from Pyongyang, or from Russia, or from China, to conquest the world... o_O WTF !!)... you still have to install it by hand, and if for some reason a PC has an SMB service directly accessible from the internet, the user/sysadmin in question should have some lessons about security...
 
PCXT said:
And I know why there was so small amount of infections in Poland - we still have local networks behind NATs popular while separate IPs are few times more expensive.
Click to expand...
Being behind a NAT will stop the SMB exploit from working, but it can bypass NATs if it can get an email inside the network, it's usual you can find all of the machines on a floor or in a home sharing a relatively open network.

I wonder if secondarily in the case of Poland, a language barrier was in effect making the emails stand out more.
 
Yes, it has to rely on dumb people blindly double clicking on attachments, if it has to go via email. I'd argue that's more the fault of the OS that makes the mechanism for launching a program the same as the mechanism for loading a JPEG into an image viewer.
 
Id10t/pebcak/user error... replace user and try again

Sent from my SAMSUNG-SM-G900A using Tapatalk
 
You must log in or register to reply here.
Back
Top