Category: Antivirus

WannaCry Ransomware

A massive ransomware campaign hit computer systems of hundreds of private companies and public organizations across the globe – which is believed to be the most massive ransomware delivery campaign to date.
The Ransomware in question has been identified as a variant of ransomware known as WannaCry (also known as ‘Wana Decrypt0r,’ ‘WannaCryptor’ or ‘WCRY’).

WannaCry1

What is WannaCry?

Generally, WannaCry comes in two parts. First, it’s an exploit whose purposes are infection and propagation. The second part is an encryptor that is downloaded to a computer after it has been infected.

The first part is the main difference between WannaCry and the majority of encryptors. To infect a computer with a common encryptor, a user has to make a mistake, for example by clicking a suspicious link, allowing Word to run a malicious macro, or downloading a suspicious attachment from an e-mail message. A system can be infected with WannaCry without the user doing anything.

WannaCry-infection-flow02The vulnerability used in this attack (code named EternalBlue) was among those leaked by the Shadow Brokers group. The vulnerability was exploited to drop a file on the vulnerable system, which would then be executed as a service. This would then drop the actual ransomware file onto the affected system, encrypting files with the .WNCRY extension. (A separate component file for displaying the ransom note would also be dropped.) Files with a total of 176 extensions, including those commonly used by Microsoft Office, databases, file archives, multimedia files, and various programming languages.

PropagationIf WannaCry/Wcry entered an organization’s network, it could spread within it very rapidly. Any machine or network that has exposed port 445 to the internet is at risk as well. EternalBlue exploit works over the Internet without requiring any user interaction.

How widespread is the damage?

The attack has been found in 150 countries, affecting 200,000 computers, according to Europol, the European law enforcement agency. FedEx, Nissan, and the United Kingdom’s National Health Service were among the victims.

What is the killswitch?

The worm-spreading part of the WannaCry – which is designed to infect other computers — has a special check at the beginning. It tries to connect to a hardcoded website on the Internet and if the connection FAILS, it continues with the attack. If the connection WORKS, it exits. Thus, by registering this domain and pointing it to a sinkhole server, a researcher from the U.K. successfully slowed the spread of the worm.

wannacry_cyberexpert_ap
British IT expert Marcus Hutchins who has been branded a hero for slowing down the WannaCry global cyber-attack sits in front of his workstation during an interview in Ilfracombe, England, Monday, May 15, 2017. ( Image source: AP)

On the one hand, it does stop further spread of the infection. However, only if the worm is able to connect to the Internet. Many corporate networks have firewalls blocking internet connections unless a proxy is used. For these, the worm will continue to spread in the local network. On the other hand, there is nothing stopping the attackers from releasing a new variant that does not implement a killswitch.

Killswitch Domain

The second domain was sinkholed by Matt Suiche of Comae Technologies, who reported stopping about 10,000 infections from spreading further:

We should thank below given people for saving millions of computers from getting hacked:

  • MalwareTech— very skilled 22-years-old malware hunter (Marcus Hutchins) who first discovered that here’s a kill-switch, which if used could stop ongoing ransomware attack.
  • Matthieu Suiche— security researcher who discovered the second kill-switch domain in a WannaCry variant and prevent nearly 10,000 computers from getting hacked.
  • Costin Raiu— security researcher from Kaspersky Lab, who first found out that there are more WannaCry variants in the wild, created by different hacking groups, with no kill-switch ability.

Not only this, Benjamin DelpyMohamed Saherx0rzMalwarebytesMalwareUnicorn, and many others.

Multiple security researchers have claimed that there are more samples of WannaCry out there, with different ‘kill-switch’ domains and without any kill-switch function, continuing to infect unpatched computers worldwide.

How to Protect Yourself from WannaCry Ransomware?

Here are some simple tips you should always follow because most computer viruses make their ways into your systems due to lack of simple security practices:

1. Always Install Security Updates

If you are using any version of Windows, except Windows 10, with SMB protocol enabled, make sure your computer should always receive updates automatically from the Microsoft, and it’s up-to-date always.

2. Patch SMB (Server Message Block) Vulnerability

Since WannaCry has been exploiting a critical SMB remote code execution vulnerability (CVE-2017-0148) for which Microsoft has already released a patch (MS17-010) in the month of March, you are advised to ensure your system has installed those patches.

Moreover, Microsoft has been very generous to its users in this difficult time that the company has even released the SMB patches (download from here) for its unsupported versions of Windows as well, including Windows XP, Vista, 8, Server 2003 and 2008.

Note: If you are using Windows 10, you are not vulnerable to SMB vulnerability.

3. Disable SMB

Even if you have installed the patches, you are advised to disable Server Message Block version 1 (SMBv1) protocol, which is enabled by default on Windows, to prevent against WannaCry ransomware attacks.

Here’s the list of simple steps you can follow to disable SMBv1:

  1. Go to Windows’ Control Panel and open ‘Programs.’
  2. Open ‘Features’ under Programs and click ‘Turn Windows Features on and off.’
  3. Now, scroll down to find ‘SMB 1.0/CIFS File Sharing Support’ and uncheck it.
  4. Then click OK, close the control Panel, and restart the computer.

4. Enable Firewall & Block SMB Ports

Always keep your firewall enabled, and if you need to keep SMBv1 enabled, then just modify your firewall configurations to block access to SMB ports over the Internet. The protocol operates on TCP ports 137, 139, and 445, and over UDP ports 137 and 138.

5. Use an Antivirus Program

An evergreen solution to prevent against most threats is to use a good antivirus software from a reputable vendor and always keep it up-to-date.

Almost all antivirus vendors have already added detection capability to block WannaCry, as well as to prevent the secret installations from malicious applications in the background.

6. Be Suspicious of Emails, Websites, and Apps

Unlike WannaCry, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

So, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source to safeguard against such ransomware infection.

Also, never download any app from third-party sources, and read reviews even before installing apps from official stores.

7. Regular Backup your Files:

To always have a tight grip on all your important documents and files, keep a good backup routine in place that makes their copies to an external storage device which is not always connected to your computer.

That way, if any ransomware infects you, it cannot encrypt your backups.

8. Keep Your Knowledge Up-to-Date

There’s not a single day that goes without any report on cyber-attacks and vulnerabilities in popular software and services, such as Android, iOS, Windows, Linux and Mac Computers as well.

So, it’s high time for users of any domain to follow day-to-day happening of the cyber world, which would not only help them to keep their knowledge up-to-date but also prevent against even sophisticated cyber-attacks.

What to do if WannaCry infects you?

Well, nothing.

If WannaCry ransomware has infected you, you can’t decrypt your files until you pay a ransom money to the hackers and get a secret key to unlock your file.

Never Pay the Ransom:

It’s up to the affected organizations and individuals to decide whether or not to pay the ransom, depending upon the importance of their files locked by the ransomware.

But before making any final decision, just keep in mind: there’s no guarantee that even after paying the ransom, you would regain control of your files.

Moreover, paying ransom also encourages cyber criminals to come up with similar threats and extort money from the larger audience.

So, sure shot advice to all users is — Don’t Pay the Ransom.

“Given the high profile of the original attack, it’s going to be no surprise at all to see copycat attacks from others, and perhaps other attempts to infect even more computers from the original WannaCry gang. The message is simple: Patch your computers, harden your defences, run a decent anti-virus, and – for goodness sake – ensure that you have secure backups.” Cyber security expert Graham Cluley told The Hacker News.

Source: thehackernews, indianexpresskaspersky,  securelisttrendmicro, Microsoft

Ransomware

Ransomware is a sophisticated piece of malware that blocks the victim’s access to his/her files.

There are two types of ransomware in circulation:

Encrypting ransomware, which incorporates advanced encryption algorithms. It’s designed to block system files and demand payment to provide the victim with the key that can decrypt the blocked content. Examples include CryptoLockerLockyCrytpoWall and more.

Locker ransomware, which locks the victim out of the operating system, making it impossible to access the desktop and any apps or files. The files are not encrypted in this case, but the attackers still ask for a ransom to unlock the infected computer.

Examples include the police-themed ransomware or Winlocker.

Ransomware Statistics 2016 [Infographic]

Ransomware-Statistics-2016

Source: armadacloud, Trendmicro

McAfee Agent cannot be removed while it is in managed mode

Problem: The following message displays when select Remove for the McAfee Agent through Add \ Remove Programs or Programs and Features on client computers:

McAfee Agent cannot be removed while it is in managed mode”



Solution:

The computer must be removed from Managed Mode

  1. Steps:
    1-
    Open Command Prompt
    2- Go to the folder” C:\Program Files (x86)\McAfee\Common Framework” on X64 systems,” C:\Program Files\McAfee\Common Framework” on X86 systems
    3- Type “frminst.exe /forceuninstall” and press enter.
    command without quotes


 source: McAfee

Share the Love, Not the Info (Love, Relationships & Technology)

Love, Relationships & Technology: 

A study by McAfee shows a number of adults sharing private details about their lives, including those of an intimate nature, such as nude photos and sexts—all of this on unsecured digital devices. In a McAfee survey, which asked more than 9,000 adults worldwide, between the ages of 18-54, about their private data sharing habits and online behavior when it comes to matters of the heart.

27% still don’t secure their mobile devices with a basic personal identification number (PIN) or passcode. And 38% have shared PIN or passcode with others. This puts you at risk for cyber stalking, identity theft and leakage of their intimate data.

Love, Relationships & Technology
Love, Relationships & Technology

Bad technology habits are on the rise worldwide, but people are still not taking the steps to protect their information from prying eyes and angry exes.

Think twice before sharing private data, including intimate texts, passwords, photos and more. If you‘re not careful about what you share, it could land in the wrong hands.

Keep Your Personal Info Safe by Following These Simple Tips:

Lock Your Lips. Do not share passwords with anyone.

Lock Your Devices. Use password protection on your phone and other mobile devices.

Love the Delete Button. Take the time to delete personal or intimate text messages, emails and photos on your phone.

Share the Love, Not the Info. Once you share private information with those you love, that data is out of your hands, and out of your control.

Men are more likely to protect their devices than women.

Avoid bad buzz and keep your private life private.

LRT2014_Infographic-Global-FNL

The Futures Company and MSI conducted surveys in the US, UK, Australia, 
Canada, Germany, France, Spain, Italy, The Netherlands, Japan, Mexico, 
China, India, Singapore and Brazil among 9,337 men and women, 
ages 18 to 54. The survey was conducted in December 2013 – January 2014.

 Source: McAfee

McAfee ePO not allowing administrator login after password change

In our organization, McAfee ePO server has been running fine until a couple of days ago. We’ve experienced a turnover in IT personnel and I have been changing different administrator names\passwords as part of security practice. After required changes done, restarted all the servers. Everything was fine except McAfee ePO web portal; I was not able to login.

It’s throwing below given errors:

DataChannel – Dependency scheduler had initialization error

LYNXSHLD1510 – dependency EPOCore had initialization error

AvertAlerts – Dependency scheduler had initialization error

Image- 1
Image- 1

All the errors were initialization errors.

SOLUTION:

Check the SQL DB connectivity with McAfee ePO; open your browser and type https://ServerName:8443/core/config

Log on with ePO credentials. (See Image-2)

epo-1
Image- 2

Type new user name and passwords, click “Test Connection”

Click Apply, if the test is successful.

Restart your ePO server, that’s it.

 Happy computing!!

Source: McAfee

McAfee ePO SQL credentials lost

McAfee ePO SQL credentials lost:

While I was searching for the solution what if I lost McAfee ePO admin password and there were no additional accounts configured, some of the blogs on the internet mentioned that go to https://ServerName:8443/core/config and reset the ‘Admin’ password. This is not the correct solution to reset the ‘Admin’ password.

https://ServerName:8443/core/config is useful to reset the SQL credentials for connecting McAfee ePO 4.x and 5.x to the database. 

Step- by-step procedure to reset the SQL credentials:

Open a web browser and go to https://localhost:8443/core/config-auth
(Where 8443 is the port for the console communication) (see
Image-1)

Image- 1
Image- 1

Log on with ePO credentials. ( See Image-2)

Image- 2
Image- 2

Type ‘sa’ in the User name field. Click on the change password.

For a minute minimize this window and go startà All Programs à MS SQL Server 2008R2 àclick on SQL Server Management Studio, below is shown window will appear ( see Image-3)

Authentication, select ‘Windows Authentication’, click Connect

Image-3
Image-3

Expand SecurityLogins and double-click the ‘sa’ account (or) right click on ‘sa’ click on ‘Properties (see Image-4)

Image-4
Image-4

Type and confirm a password in the General tab under Login name section. 

Click on ‘OK’

Open McAfee ePO web console window (see Image-2)

Type ‘sa’ in the User name field. Click on the change password.

Type the password for ‘sa’ account into the User password and Confirm password fields.

Click Test Connection.

Click Apply, if the test is successful.

Below is shown window will open (see Image-5), restart the McAfee ePO server.

Image- 5
Image- 5

That’s it.

 Happy computing!!

 IMPORTANT: Please follow the same sequence above mentioned. After changing the SQL password if you try to open the ePO web console https://ServerName:8443/core/config it won’t open at all. Even though if you lost the SQL password, still you can open the McAfee web console https://ServerName:8443/core/config, then follow the steps in same sequence.

Source: McAfee

McAfee ePO Admin password lost

McAfee ePO Admin password lost:  

Some time ago I started attending trainings and discussions with industry experts, on McAfee ePO and started learning many things from them. During these sessions I came across some issues with McAfee 4.x and 5.x installation. I have uploaded solutions to some of these issues on my blog, please refer the following link:

https://lakkireddymadhu.wordpress.com/2014/01/16/mcafee-epo-installation-errors/

          One fine morning all of sudden I got a doubt, what if I lost McAfee ePO admin password and there were no additional accounts configured. I opened my laptop and started Googling for the solution. There were more blogs describing this issue, but none had a satisfied solution. After a rigorous search on the Internet, I found two good and easy solutions.

Solution–1: 

We believe that only one account, i.e. Admin account, is configured in McAfee ePO. But by default one more account exists in the McAfee ePO User Management, named system. This account is disabled by default. User ‘system’ account has administrative rights (see the Image-1).

Image- 1
Image- 1

This user (system) is by default non-editable through the web console (see the Image2)

Image- 2
Image- 2

We have to enable the user ‘system’ through MS SQL.

Go to start –> All Programs –> MS SQL Server 2008R2 –> click on SQL Server Management Studio, expand Databases -> expand ePO Database –> expand Tables –>go to dbo.OrionUsers –> right click on dbo.OrionUsers –>click on Edit Top 200 Rows.One window will open on the right side (see the Image-3)

Image- 3
Image- 3

Under the OrionUsers Table –>following changes will need to be done for the user ‘System’

Under Disabled –> default setting will be True, change it to False  (click enter)

Under Interactive –>default setting will be False, change it to True  (click enter)

Minimize the SQL window and Open the McAfee ePO web console and type username: system, Password:system

It will allow you to login. Click on MenuàUnder User Management –>click on Users –>Admin –>Rightside down click on Actions –>click on Edit (see the Image-4& Image -5)

Image- 4
Image- 4
Image- 5
Image- 5

Click on Change Authentication or Credential

Type Password and confirm Password and save (see the Image-6)

Image- 6
Image- 6

Log off and Login with Admin credentials. That’s it.

Now Open SQL and make the same changes in OrionUsers Table (Exactly as shown in the Image-7)

Image- 7
Image- 7

Under Disabled –>change it to True  (click enter)

Under Interactive –> change it to False  (click enter)

Solution–2:

In solution 1, enabling of the user system’ account through MS SQL resets Admin the Password.

In Solution -2, we will create a new account with Administrative rights using MS SQL and through new account  will reset the Admin password.

Go to start –> All Programs –> MS SQL Server 2008R2 –>click on SQL Server Management Studio, expand Databases –> Click on ePO Database –> open a New Query, run the following query and execute

INSERT INTO [dbo].[OrionUsers]

(Name, AuthURI, Admin, Disabled, Visible, Interactive, Removable, Editable)
VALUES (‘epoadmin‘,’auth:pwd?pwd=7LTSeirrzM8EjqttaozV4cSiPGQWi8w3′,1,0,1,1,1,1)

It will create a new user epoadmin, with the password: epoadmin

Open the McAfee ePO web console with username and password epoadmin

It will allow you to login.Click on Menu –>Under User Management –>click on Users –> Admin –> Rightside down click on Actions –> click on Edit and reset the Admin Password

Log off and Login with Admin credentials. That’s it.

NOTE: Use the above solutions when you don’t have any other option. Be sure you have got the required skills to modify SQL serverYou can break your ePO server if you don’t know what you are doing. Don’t   hold me responsible for your actions; think before you act and always make sure you have a backup 🙂

IMPORTANT: McAfee recommends that you implement account and password management policies such as:

  • Maintaining a backup administrator account
  • Creating individual accounts for each administrator
  • Adhering to corporate requirements for accounts and passwords

Happy computing!!

Source: thegid, cupfighter, McAfee