Wannacry Or Wannacrypt Ransomware: From the media reports and many blogs writing it has been reported that the critical ransomware namely wannacry or wannacrypt is fast spreading to millions of computers far and wide. It installs into a windows computer and then it automatically encrypts files of that operating system and then disallows the original user to open it and use it. It encrypts the file systems of infected computers. If there is a server message block within the windows computing system, it automatically takes advantage of it and then it stops those files from active working. This exploit is named ‘ETRNALBLUE’.
This ransomware is called wannacry or wannacrypt and it literally encrypts entire Windows drive and then slowly moves towards LAN connected to other computers. On some other mediums, this ransomware could spread through email attachment and while users download it and then open it, automatically the ransomware comes out from these attachments and spread into the entire drive of the Windows operating system and locked it down completely. Microsoft has released patches in its Microsoft Security Bulletin MS17-010 and users are advised to download these patches immediately so that they could secure their operating system.
This security update was published by Microsoft on March 14, 2017, and it is termed as extremely critical. These server-side remote execution script could allow the hacker to send a remote message through Microsoft server message block and could encrypt an entire system drive of Windows computer. This update is only available through Windows Update. There is certain kind of regulation in which Microsoft server message block receives messages and by exploitation such vulnerabilities hackers could gain execution code on the target computer. Then, the unauthenticated user sends some crafted packets to the server and then the entire server encrypted with it.
It goes on to show that there are certain vulnerabilities in defining these crafted requests and these security updates handle these security holes and patch operating system before the hacker could send the unauthenticated request to the server. Apart from installing these updates, system administrators with Windows 8.1 and Windows Server 2012 R2 and later could use following manual methods to secure client computer and servers.
Wannacry for client operating system:
Open Control Panel, then click on Programs, and then click on Turn Windows Features on or off and then clear the SMB1.0/CIFS File Sharing Support and then restart the system.
For the Server operating system:
Open Server Manager, then click on the Manager and then select Remove Roles and Features and in the Features windows clear the SMB1.0/CIFS File Sharing Support check box and then restart the system.
By these manual workaround methods what we do be that we disabled the SMBv1 protocol on the targeted system and thus ending all possibilities of the hacker to move into these servers without authentication.
WannaCry Ransomware what you need to know about:
After the ransomware got into the system, it shows the information that your files have been encrypted and of course, this has been done without your permission. It would ask for payment option so that you would be paying to decrypt all those files. Most documents, photos, videos and files are no longer accessible and this has been very difficult for most of the big organization having a larger scale of data around. It would tell you do not try to decrypt your files as you could not do as only you have to pay for decryption of files. It also guaranteed that you could decrypt all those files, but you do not have unlimited time for it.
It would also allow decrypting some of your files for free of cost to show that some of your files are in good state. In this way, this ransomware would completely overtake your organizational database. This ransomware also provides one text file which describes how to pay the money and procedure of it and after payment, it assures the organization to decrypt the entire server and database. It encrypts files in the extension of dot WCRY which is a new format and decryption of this format is not known. This malware target’s files with the commonly used office file extension, archive formats, media files formats, email file formats, database file formats, developer source code and project file formats, encryption keys, graphic designer files and virtual machine files.
This means it covers most of file system files on a Windows computer and for this, it is important to update security update and manual workaround which is mentioned above so that ultimately you could secure system completely. In its first attempt, the ransomware would write an execution file namely “tasksche.exe” in the system folder of the Windows operating system. In order to prevent such ransomware from spreading to the other system, it is advisable to download the Microsoft patch and it is also available in unsupported Windows systems. Microsoft is doing this in order to prevent the spreading of ransomware in unsupported Windows operating system.
WannaCry ransomware spreads aggressively across networks, holds files to ransom:
It is important to back up user data and critical system data so that in the case of attacks on the system a complete reinstallation of the operating system could be done and then the server could connect once again. Data could be retrieved through data back up locations. It is important to perform regular backing up of all important pieces of information so that in the case of such imminent attacks these could be easily retrieved. It is important to keep these backup data in an offline location and in a separate server that of the running server.
Wannacry Or Wannacrypt Ransomware: Create appropriate email spoofing mechanisms so that spam email prevention could be done easily. It is important to create and establish the sender policy framework, domain message authentication reporting and conference, domain key identified mail for your domain so that the exact sender of the domain could be recognized easily. Most of these ransomware comes to the user in the form of a spam message from unauthenticated sources and it is important to find and check those senders and receive messages only through proper authentication procedures.
Windows script or execution of power shell should be reduced to standard privileges so that it could not outreach administrative privileges. Do not open attachments, spam messages and messages received from unknown persons. Do not open unknown URLs and update windows regularly. Use the latest version of Powershell that uses enhanced logging and advanced security features. It is important to send all those log files of powerful shells as well as that of the client computer to centralize the system administrator so that ultimately it provides advanced security mechanisms for users to follow.
Implement stricter regulation of software restriction policy by whitelisting application so that no client could install other applications which might embed ransomware. The binaries path containing %APPData%, %TEMP% paths should be closed. Most of these ransomware reaches these paths as these paths are most of the time unnoticed and then executes from there. It is important to seriously implement whitelisting of the application so that endpoint works stations should remain critically secure. Deploy email filters and web filters and add security plugins to web browsers so that by mistakes and inadvertently any malware or any other ransomware should not be downloaded by force. It is important to scan all email attachments, drive-by downloads, on the host, on the server, on the internet protocol, at the mail gateway with reputed antivirus solutions.
From Norton:
Disable macros of any of office products and especially latest version of Microsoft office does provide hybrid macros which would disable the macros that come from outside automatically. Provide most of the critical settings of files in terms of least privilege settings, and restrict network share permissions and provide exact routes of the file to move and directories and sharing of those files by right networks. Maintain daily updates of antivirus of client and server system and update windows system regularly. Install free to use a host-level antiexploitation tool such as free from Microsoft namely enhanced mitigation experience toolkit to save system files.
Regular check whether any of back up of databases contain any encrypted files from unauthenticated sources such as from backdoor entry or from malicious scripts. Keep all of the third-party applications such as Microsoft Office, Adobe, and other updated. Restrict user permission so that they could not install any other application and software apart from your permit as the system administrator. Enable the personal firewall on the client system and hardware server firewall in work station. Use encrypted network connectivity so that traffic should be redirected to secure routes and all the packets of information send and receive should be scanned comprehensively.
Implement stricter external device policy so that each of USB drive recognition policies should be done with complete checks and balances to stop malware from reaching to computer or server through any of routes. It is important to carry out from time to time in the vulnerability assessment and penetration testing from time to time so that security audits of critical database server could be done in comprehensive manners. Use latest and modern data encryption technology such as data-at-rest and data-in-transit technologies so that each instance of data could be known completely without any difficulties.
