DSM is working to protect customers from the WannaCry ransomware attack. We continue to receive many questions about how this attack happened, what we must do to defend our organisations, and, of course, what’s next?
This article is designed to answer those questions.
A fast-spreading piece of ransomware called Wanna (also known as WannaCry, WCry, WanaCrypt, WanaCrypt0r and Wana DeCrypt0r) held computer systems hostage around the globe. The National Health Service hospitals (NHS) was hit hard, with its phone lines and IT systems being held hostage. From there, the attack spilled across the globe.
It encrypted victim’s files and changed the extensions to: .wnry, .wcry, .wncry and .wncrypt. It then presented a window to the user with a ransom demand:
Analysis seems to confirm that the attack was launched using suspected NSA code leaked by a group of hackers known as the Shadow Brokers. It uses a variant of the ShadowBrokers’ APT EternalBlue Exploit (CC-1353). It also uses strong encryption on files such as documents, images, and videos.
This was different from past ransomware attacks. Why?
There were some unique aspects to the WannaCry attack. Typical ransomware infections happen after the victim clicks on a malicious email attachment or link. In this attack the malware was able to exploit a remote code execution (RCE) vulnerability that allowed it to infect unpatched machines without users having to do anything.
Because of that, this was able to spread in the same rapid fashion as the worm outbreaks common a decade ago, such as Slammer and Conficker.
Specifically, WannaCry exploited a Windows vulnerability Microsoft released a patch for in March. That flaw was in the Windows Server Message Block (SMB) service, which Windows computers use to share files and printers across local networks. Microsoft addressed the issue in its MS17-010 bulletin.
Organisations running older, no-longer-supporter versions of Windows were particularly hard hit. In fact, Microsoft took the highly unusual step of making a security update for platforms in custom support (such as Windows XP) available to everyone. The software giant said in a statement:
We know some of our customers are running versions of Windows that no longer receive mainstream support. That means those customers will not have received the Security Update released in March. Given the potential impact to customers and their businesses, we made the decision to make the Security Update for platforms in custom support only, Windows XP, Windows 8, and Windows Server 2003, broadly available for download here.
Is this over?
Unlikely. With the code behind the attack in the wild, we should expect copycats to cook up their own campaigns in the coming days to capitalise on the money-making opportunity in front of them. We also expect aftershocks as employees at affected company’s return to work and fire up their computers.
Is there anything I need to do?
You’ll want to ensure all of your Windows environments have been updated as described in Microsoft Security Bulletin MS17-010 – Critical. Microsoft is providing Customer Guidance for WannaCrypt attacks. As noted above, Microsoft has made the decision to make the Security Update for platforms in custom support only — Windows XP, Windows 8, and Windows Server 2003 — broadly available for download:
|Windows Server 2003 SP2 x64||Windows Server 2003 SP2 x86|
|Windows 8 x64||Windows 8 x86|
|Windows XP SP2 x64||Windows XP SP3 x86||Windows XP Embedded SP3 x86|
As we always say, patching is critical!
For more information on how to protect your company please do not hesitate to contact DSM Group.