Category: Antivirus

Petya Ransomware

The WannaCry ransomware is not dead yet and another large-scale ransomware attack is making chaos worldwide, shutting down computers at corporates, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding $300 in bitcoins.

Researchers found a variant of the Petya ransomware called GoldenEye attacking systems around the world is spreading rapidly with the help of same Windows SMBv1 vulnerability.

Just like Petya, GoldenEye encrypts the entire hard disk drive and denies the user access to the computer. However, unlike Petya, there is no workaround to help victims retrieve the decryption keys from the computer.

Additionally, after the encryption process is complete, the ransomware has a specialized routine that forcefully crashes the computer to trigger a reboot that renders the computer unusable until the $300 ransom is paid.

Below given text displays on the screen:

GoldenEye Ransomware
                                                            Petya Ransomware

it is quite surprising that even after knowing about the WannaCry issue for quite a decent amount of time, big corporates and companies have not yet implemented proper security measures to defend against such threat.

Don’t Pay Ransom, You Wouldn’t Get Your Files Back 

Infected users are advised not to pay the ransom because hackers behind Petya ransomware can’t get your emails anymore.

Posteo, the German email provider, has suspended the email address i.e. wowsmith123456@posteo.net, which was behind used by the criminals to communicate with victims after getting the ransom to send the decryption keys.

How to Protect Yourself from Ransomware Attacks

What to do immediately? Go and apply those goddamn patches against EternalBlue (MS17-010) and disable the unsecured, 30-year-old SMBv1 file-sharing protocol on your Windows systems and servers.

Since GoldenEye Ransomware is also taking advantage of WMIC and PSEXEC tools to infect fully patched Windows computers, you are also advised to disable WMIC (Windows Management Instrumentation Command-line).

Kill Switch:

Researcher finds GoldenEye ransomware encrypt systems after rebooting the computer. So if your system is infected with Petya ransomware and it tries to restart, just do not power it back on.

“If machine reboots and you see this message, power off immediately! This is the encryption process. If you do not power on, files are fine.” ‏HackerFantastic tweeted. “Use a LiveCD or external machine to recover files”

Petya kill switch
                                                                                            Kill Switch

PT Security, a UK-based cyber security company and Amit Serper from Cybereason, have discovered a Kill-Switch for Petya ransomware. According to a tweet, the company has advised users to create a file i.e. “C:\Windows\perfc” to prevent ransomware infection.

Amit Serper

Create Perfc, Perfc.dat, Perfc.* in “C:\Windows” folder

Erhan

Regular Backup your Files:

To always have a tight grip on all your important documents and files, keep a good backup routine in place that makes their copies to an external storage device which is not always connected to your computer.

That way, if any ransomware infects you, it cannot encrypt your backups.

Moreover, make sure that you run a good and effective anti-virus security suite on your system, and keep it up-to-date. Most importantly, always browse the Internet safely.

One good thing,  this ransomware is spreading via local network and not so massive like WannaCry.

Source: Tthe Hackernewscnet,

WannaCry Ransomware

A massive ransomware campaign hit computer systems of hundreds of private companies and public organizations across the globe – which is believed to be the most massive ransomware delivery campaign to date.
The Ransomware in question has been identified as a variant of ransomware known as WannaCry (also known as ‘Wana Decrypt0r,’ ‘WannaCryptor’ or ‘WCRY’).

WannaCry1

What is WannaCry?

Generally, WannaCry comes in two parts. First, it’s an exploit whose purposes are infection and propagation. The second part is an encryptor that is downloaded to a computer after it has been infected.

The first part is the main difference between WannaCry and the majority of encryptors. To infect a computer with a common encryptor, a user has to make a mistake, for example by clicking a suspicious link, allowing Word to run a malicious macro, or downloading a suspicious attachment from an e-mail message. A system can be infected with WannaCry without the user doing anything.

WannaCry-infection-flow02The vulnerability used in this attack (code named EternalBlue) was among those leaked by the Shadow Brokers group. The vulnerability was exploited to drop a file on the vulnerable system, which would then be executed as a service. This would then drop the actual ransomware file onto the affected system, encrypting files with the .WNCRY extension. (A separate component file for displaying the ransom note would also be dropped.) Files with a total of 176 extensions, including those commonly used by Microsoft Office, databases, file archives, multimedia files, and various programming languages.

PropagationIf WannaCry/Wcry entered an organization’s network, it could spread within it very rapidly. Any machine or network that has exposed port 445 to the internet is at risk as well. EternalBlue exploit works over the Internet without requiring any user interaction.

How widespread is the damage?

The attack has been found in 150 countries, affecting 200,000 computers, according to Europol, the European law enforcement agency. FedEx, Nissan, and the United Kingdom’s National Health Service were among the victims.

What is the killswitch?

The worm-spreading part of the WannaCry – which is designed to infect other computers — has a special check at the beginning. It tries to connect to a hardcoded website on the Internet and if the connection FAILS, it continues with the attack. If the connection WORKS, it exits. Thus, by registering this domain and pointing it to a sinkhole server, a researcher from the U.K. successfully slowed the spread of the worm.

wannacry_cyberexpert_ap
British IT expert Marcus Hutchins who has been branded a hero for slowing down the WannaCry global cyber-attack sits in front of his workstation during an interview in Ilfracombe, England, Monday, May 15, 2017. ( Image source: AP)

On the one hand, it does stop further spread of the infection. However, only if the worm is able to connect to the Internet. Many corporate networks have firewalls blocking internet connections unless a proxy is used. For these, the worm will continue to spread in the local network. On the other hand, there is nothing stopping the attackers from releasing a new variant that does not implement a killswitch.

Killswitch Domain

The second domain was sinkholed by Matt Suiche of Comae Technologies, who reported stopping about 10,000 infections from spreading further:

We should thank below given people for saving millions of computers from getting hacked:

  • MalwareTech— very skilled 22-years-old malware hunter (Marcus Hutchins) who first discovered that here’s a kill-switch, which if used could stop ongoing ransomware attack.
  • Matthieu Suiche— security researcher who discovered the second kill-switch domain in a WannaCry variant and prevent nearly 10,000 computers from getting hacked.
  • Costin Raiu— security researcher from Kaspersky Lab, who first found out that there are more WannaCry variants in the wild, created by different hacking groups, with no kill-switch ability.

Not only this, Benjamin DelpyMohamed Saherx0rzMalwarebytesMalwareUnicorn, and many others.

Multiple security researchers have claimed that there are more samples of WannaCry out there, with different ‘kill-switch’ domains and without any kill-switch function, continuing to infect unpatched computers worldwide.

How to Protect Yourself from WannaCry Ransomware?

Here are some simple tips you should always follow because most computer viruses make their ways into your systems due to lack of simple security practices:

1. Always Install Security Updates

If you are using any version of Windows, except Windows 10, with SMB protocol enabled, make sure your computer should always receive updates automatically from the Microsoft, and it’s up-to-date always.

2. Patch SMB (Server Message Block) Vulnerability

Since WannaCry has been exploiting a critical SMB remote code execution vulnerability (CVE-2017-0148) for which Microsoft has already released a patch (MS17-010) in the month of March, you are advised to ensure your system has installed those patches.

Moreover, Microsoft has been very generous to its users in this difficult time that the company has even released the SMB patches (download from here) for its unsupported versions of Windows as well, including Windows XP, Vista, 8, Server 2003 and 2008.

Note: If you are using Windows 10, you are not vulnerable to SMB vulnerability.

3. Disable SMB

Even if you have installed the patches, you are advised to disable Server Message Block version 1 (SMBv1) protocol, which is enabled by default on Windows, to prevent against WannaCry ransomware attacks.

Here’s the list of simple steps you can follow to disable SMBv1:

  1. Go to Windows’ Control Panel and open ‘Programs.’
  2. Open ‘Features’ under Programs and click ‘Turn Windows Features on and off.’
  3. Now, scroll down to find ‘SMB 1.0/CIFS File Sharing Support’ and uncheck it.
  4. Then click OK, close the control Panel, and restart the computer.

4. Enable Firewall & Block SMB Ports

Always keep your firewall enabled, and if you need to keep SMBv1 enabled, then just modify your firewall configurations to block access to SMB ports over the Internet. The protocol operates on TCP ports 137, 139, and 445, and over UDP ports 137 and 138.

5. Use an Antivirus Program

An evergreen solution to prevent against most threats is to use a good antivirus software from a reputable vendor and always keep it up-to-date.

Almost all antivirus vendors have already added detection capability to block WannaCry, as well as to prevent the secret installations from malicious applications in the background.

6. Be Suspicious of Emails, Websites, and Apps

Unlike WannaCry, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

So, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source to safeguard against such ransomware infection.

Also, never download any app from third-party sources, and read reviews even before installing apps from official stores.

7. Regular Backup your Files:

To always have a tight grip on all your important documents and files, keep a good backup routine in place that makes their copies to an external storage device which is not always connected to your computer.

That way, if any ransomware infects you, it cannot encrypt your backups.

8. Keep Your Knowledge Up-to-Date

There’s not a single day that goes without any report on cyber-attacks and vulnerabilities in popular software and services, such as Android, iOS, Windows, Linux and Mac Computers as well.

So, it’s high time for users of any domain to follow day-to-day happening of the cyber world, which would not only help them to keep their knowledge up-to-date but also prevent against even sophisticated cyber-attacks.

What to do if WannaCry infects you?

Well, nothing.

If WannaCry ransomware has infected you, you can’t decrypt your files until you pay a ransom money to the hackers and get a secret key to unlock your file.

Never Pay the Ransom:

It’s up to the affected organizations and individuals to decide whether or not to pay the ransom, depending upon the importance of their files locked by the ransomware.

But before making any final decision, just keep in mind: there’s no guarantee that even after paying the ransom, you would regain control of your files.

Moreover, paying ransom also encourages cyber criminals to come up with similar threats and extort money from the larger audience.

So, sure shot advice to all users is — Don’t Pay the Ransom.

“Given the high profile of the original attack, it’s going to be no surprise at all to see copycat attacks from others, and perhaps other attempts to infect even more computers from the original WannaCry gang. The message is simple: Patch your computers, harden your defences, run a decent anti-virus, and – for goodness sake – ensure that you have secure backups.” Cyber security expert Graham Cluley told The Hacker News.

Source: thehackernews, indianexpresskaspersky,  securelisttrendmicro, Microsoft

Ransomware

Ransomware is a sophisticated piece of malware that blocks the victim’s access to his/her files.

There are two types of ransomware in circulation:

Encrypting ransomware, which incorporates advanced encryption algorithms. It’s designed to block system files and demand payment to provide the victim with the key that can decrypt the blocked content. Examples include CryptoLockerLockyCrytpoWall and more.

Locker ransomware, which locks the victim out of the operating system, making it impossible to access the desktop and any apps or files. The files are not encrypted in this case, but the attackers still ask for a ransom to unlock the infected computer.

Examples include the police-themed ransomware or Winlocker.

Ransomware Statistics 2016 [Infographic]

Ransomware-Statistics-2016

Source: armadacloud, Trendmicro

McAfee Agent cannot be removed while it is in managed mode

Problem: The following message displays when select Remove for the McAfee Agent through Add \ Remove Programs or Programs and Features on client computers:

McAfee Agent cannot be removed while it is in managed mode”



Solution:

The computer must be removed from Managed Mode

  1. Steps:
    1-
    Open Command Prompt
    2- Go to the folder” C:\Program Files (x86)\McAfee\Common Framework” on X64 systems,” C:\Program Files\McAfee\Common Framework” on X86 systems
    3- Type “frminst.exe /forceuninstall” and press enter.
    command without quotes


 source: McAfee

Share the Love, Not the Info (Love, Relationships & Technology)

Love, Relationships & Technology: 

A study by McAfee shows a number of adults sharing private details about their lives, including those of an intimate nature, such as nude photos and sexts—all of this on unsecured digital devices. In a McAfee survey, which asked more than 9,000 adults worldwide, between the ages of 18-54, about their private data sharing habits and online behavior when it comes to matters of the heart.

27% still don’t secure their mobile devices with a basic personal identification number (PIN) or passcode. And 38% have shared PIN or passcode with others. This puts you at risk for cyber stalking, identity theft and leakage of their intimate data.

Love, Relationships & Technology
Love, Relationships & Technology

Bad technology habits are on the rise worldwide, but people are still not taking the steps to protect their information from prying eyes and angry exes.

Think twice before sharing private data, including intimate texts, passwords, photos and more. If you‘re not careful about what you share, it could land in the wrong hands.

Keep Your Personal Info Safe by Following These Simple Tips:

Lock Your Lips. Do not share passwords with anyone.

Lock Your Devices. Use password protection on your phone and other mobile devices.

Love the Delete Button. Take the time to delete personal or intimate text messages, emails and photos on your phone.

Share the Love, Not the Info. Once you share private information with those you love, that data is out of your hands, and out of your control.

Men are more likely to protect their devices than women.

Avoid bad buzz and keep your private life private.

LRT2014_Infographic-Global-FNL

The Futures Company and MSI conducted surveys in the US, UK, Australia, 
Canada, Germany, France, Spain, Italy, The Netherlands, Japan, Mexico, 
China, India, Singapore and Brazil among 9,337 men and women, 
ages 18 to 54. The survey was conducted in December 2013 – January 2014.

 Source: McAfee

McAfee ePO not allowing administrator login after password change

In our organization, McAfee ePO server has been running fine until a couple of days ago. We’ve experienced a turnover in IT personnel and I have been changing different administrator names\passwords as part of security practice. After required changes done, restarted all the servers. Everything was fine except McAfee ePO web portal; I was not able to login.

It’s throwing below given errors:

DataChannel – Dependency scheduler had initialization error

LYNXSHLD1510 – dependency EPOCore had initialization error

AvertAlerts – Dependency scheduler had initialization error

Image- 1
Image- 1

All the errors were initialization errors.

SOLUTION:

Check the SQL DB connectivity with McAfee ePO; open your browser and type https://ServerName:8443/core/config

Log on with ePO credentials. (See Image-2)

epo-1
Image- 2

Type new user name and passwords, click “Test Connection”

Click Apply, if the test is successful.

Restart your ePO server, that’s it.

 Happy computing!!

Source: McAfee

McAfee ePO SQL credentials lost

McAfee ePO SQL credentials lost:

While I was searching for the solution what if I lost McAfee ePO admin password and there were no additional accounts configured, some of the blogs on the internet mentioned that go to https://ServerName:8443/core/config and reset the ‘Admin’ password. This is not the correct solution to reset the ‘Admin’ password.

https://ServerName:8443/core/config is useful to reset the SQL credentials for connecting McAfee ePO 4.x and 5.x to the database. 

Step- by-step procedure to reset the SQL credentials:

Open a web browser and go to https://localhost:8443/core/config-auth
(Where 8443 is the port for the console communication) (see
Image-1)

Image- 1
Image- 1

Log on with ePO credentials. ( See Image-2)

Image- 2
Image- 2

Type ‘sa’ in the User name field. Click on the change password.

For a minute minimize this window and go startà All Programs à MS SQL Server 2008R2 àclick on SQL Server Management Studio, below is shown window will appear ( see Image-3)

Authentication, select ‘Windows Authentication’, click Connect

Image-3
Image-3

Expand SecurityLogins and double-click the ‘sa’ account (or) right click on ‘sa’ click on ‘Properties (see Image-4)

Image-4
Image-4

Type and confirm a password in the General tab under Login name section. 

Click on ‘OK’

Open McAfee ePO web console window (see Image-2)

Type ‘sa’ in the User name field. Click on the change password.

Type the password for ‘sa’ account into the User password and Confirm password fields.

Click Test Connection.

Click Apply, if the test is successful.

Below is shown window will open (see Image-5), restart the McAfee ePO server.

Image- 5
Image- 5

That’s it.

 Happy computing!!

 IMPORTANT: Please follow the same sequence above mentioned. After changing the SQL password if you try to open the ePO web console https://ServerName:8443/core/config it won’t open at all. Even though if you lost the SQL password, still you can open the McAfee web console https://ServerName:8443/core/config, then follow the steps in same sequence.

Source: McAfee