Security Advisories /
WannaCry Ransomware Attack
“WannaCry” ransomware encrypts non‐system files and presents user with instructions to pay for decryption.
Summary
On Friday morning, a widespread Ransomware attack began spreading across the globe. Going by the name “WannaCry” and some variations, this attack takes advantage of a vulnerability in the Server Message Block (SMB) in Microsoft’s Windows operations system. Once infected, the malicious software operated like typical ransomware and encrypted non‐system files and presented the user with instructions for decryption. It is highly suggested to not pay the ransom if your machine is infected.
Details
The vulnerability being exploited in this case was released by The Shadow Brokers on April 14, 2017 and is believed to be a tool used by the National Security Agency (NSA). Microsoft released a patch (MS17‐010) for this vulnerability a month before the disclosure, on March 14, 2017.
The vulnerability itself is with SMBv1 on all versions of the Windows Operating System since Windows NT. For the initial infection, an attacker must have access to TCP Port 445, either by open ports on a firewall or from a previously infected computer on the same network. Once infected, the malware checks for the existence of a ‘kill switch’ domain. If the domain does not exist, it continues execution. When executed the malware encrypts non‐system files, installs a persistent backdoor (called
DOUBLEPULSAR), presents payment instructions for the user and begins scanning internally and externally for more vulnerable systems. Infected systems should ensure the backdoor has been removed even if the files have been decrypted.
Security researchers quickly learned that the ‘kill switch’ domain was unregistered. When they registered the domain, and pointed it to a server that responds to requests, the malware stopped infecting new systems. This effectively stopped the spread of this strain of the virus. It is reasonable to expect a new strain to address this weakness and be released in the near future.
Risk Mitigation Steps Taken by ATS on Behalf of Customers
As part of our Managed Services offering, ATS keeps your servers and workstations up to date with Windows patches. The patch for this vulnerability, MS17‐010, was released on March 14th and was
installed on workstations almost immediately. Servers received the patch the following weekend as part of our regular patch policy.
For any clients that had previously request to be excluded from our regular patch policy, we pushed the relevant patches as an emergency policy over the weekend.
When Microsoft released the patch for the unsupported Server 2003 operating system, it was approved immediately and pushed out to any remaining Server 2003 servers we have in our monitoring system.
Additionally ‐ We are running reports every hour today and will manually install patches for any servers that may have been unavailable when patches were pushed. It is also suggested to ensure unused protocols, such as SMB, are blocked externally at the firewall. Allowing traffic from the ‘kill switch’ domain is suggested, however, to prevent any new infections.
Future Risk Mitigation
These types of attacks are on the rise. While this instance has been mostly resolved, it is a reminder that we can expect more, similar attacks in the future. Having automated patching for servers and workstations is critical to maintaining a secure environment.
Understanding current threats and the security posture of your organization is important and ATS can help by providing a Vulnerability Assessment and Penetration Test (VAPT). For more information, reach out to your ATS Account Manager or send an email to [email protected].
Working with ATS is a breath of fresh air. ATS takes our information security concerns seriously and advises us how to avoid potential pitfalls with both hardware and software. We are beyond thrilled with ATS and only wish we had selected them a year earlier.
Joseph A. Appelbaum
President & CEO, Potomac Companies, Inc.
ATS has been our trusted partner in recent upgrades we have made to our IT infrastructure and cyber security. Their account management, project management, and technical teams have all provided top-notch service, guiding us to make informed decisions, managing timelines for multiple projects, and most of all, listening to our needs and making recommendations based on our unique work environment. During the transitions, they have kept us operating smoothly and provided quick and helpful support through their Help Desk.
Amy Gavin
Nutrition.org
I just wanted to take a moment to reach out and thank you for the excellent service you and your team have provided with the hosted SIEM solution. AlienVault is great, but the real value comes from your partnership. The appliance would not do nearly as much for us without your monitoring and consulting services. You have always been on top of things and there for us whenever there is an incident. I feel confident in that our network is secure and I am able to report that our board and clients with full assurance.
Chris Hansford
EducationWeek.org