Tag: ransomware

How to Stay Protected Against Ransomware

July 10, 2017 · Leave a comment ·

To prevent a ransomware attack, experts say IT and information security leaders should do the following:

You can’t protect what you don’t know exists:

Developing an inventory of your assets is crucial. Keep clear inventories of all of your digital assets and their locations, so cyber criminals do not attack a system you are unaware of.

Be in a position to answer the questions instantly like:

How many PCs from a particular manufacturer do you have in your environment?
Which desktops/laptops are running an operating system that its vendor recently stopped supporting?
Which IT assets have a particular piece of software installed?

2. Keep all software up to date, including operating systems and applications:

Updates are important. They are available for both our operating system and individual software programs. Performing these updates will deliver a multitude of revisions to your computer, such as adding new features, removing outdated features, updating drivers, delivering bug fixes, and most importantly, fixing security holes that have been discovered.

3. Use A Supported Operating System:

Just because your old computer is still running doesn’t mean that you’re going to continue to receive updates. Both Apple and Microsoft stop providing updates for older operating systems. For example, Microsoft no longer provides updates for Windows XP, and Apple does not provide updates for early versions of OS X.

If the creator is no longer providing updates for a particular operating system, then that operating system becomes more dangerous every day you continue to use it. If a new vulnerability emerges, an update to remove the vulnerability may never be released. Virus writers know this and use it to their advantage, often preying on computers that are not just behind on a few updates, but computers still running an unsupported operating system.

Therefore, it is important that you are running a maintained operating system, one that is still receiving updates.

4. Use an Antivirus Program:

An evergreen solution to prevent against most threats is to use a good antivirus software from a reputable vendor and always keep it up-to-date.

5. Regular Backup your Files:

Back up all information every day, including information on employee devices, so you can restore encrypted data if attacked. Better safe than sorry.

3-2-1 Backup strategy is good.

3-2-1 strategy means having at least

3 copies of your data

2 local copies on different storage types

1 backup off-site.

6. Segment the company network:

Don’t place all data on one file share accessed by everyone in the company. Separate functional areas with a firewall, e.g., the client and server networks, so systems and services can only be accessed if really necessary.

"Good network segmentation is not going to make it impossible to 
compromise your network, but it does make it more difficult."

        ~ Mat Gangwer, security operations leader, Rook Security Inc.

7. Train and re-train employees in your business:

Your users can be your weakest link if you don’t train them how to avoid booby-trapped documents and malicious emails. As ransomware is commonly introduced through email attachments and links, arming employees with the knowledge they need to practice secure email and browsing habits can prevent many ransomware attacks from succeeding.

Train employees on how to recognize phishing attacks as well as best practices such as not opening attachments or links in emails from unknown senders, checking link URLs, and never clicking pop-up windows.

Training should be ongoing rather than a single session to ensure that employees keep up with new threats and maintain secure habits.

8. Develop a communication strategy to inform employees if a virus reaches the company network:

The speedy dissemination of information is vital in stopping an attack or the continuance of an attack. It is vital that all users on the network be made aware of an attack or attempted attack to ensure the vigilance of other users on your network. It is likely that other users have also received similar phishing emails and your quick response may prevent further damage.

9. Instruct information security teams to perform penetration testing to find any vulnerabilities:

The Penetration tests must be carried out periodically either by Third party organization specialized in Security Testing or by the specialized internal resource. Periodic assessment of its information assets, network equipment, and applications should be conducted and fixed all gaps found during the assessment.

10. Keep Your Knowledge Up-to-Date:

There’s not a single day that goes without any report on cyber-attacks and vulnerabilities in popular software and services, such as Android, iOS, Windows, Linux, and Mac Computers as well.

So, it’s high time for users of any domain to follow day-to-day happening of the cyber world, which would not only help them to keep their knowledge up-to-date but also prevent against even sophisticated cyber-attacks.

Mitigating an attack:

If your company is hacked with ransomware, you can explore the free ransomware response kit for a suite of tools that can help. Experts also recommend the following to moderate an attack:

Remove the infected machines from the network, so the ransomware does not use the machine to spread throughout your network.

Launched less than a year ago, the No More Ransom (NMR) project has started as a joint initiative by Europol, the Dutch National Police, Intel Security, and Kaspersky Lab, No More Ransom is an anti-ransomware cross-industry initiative to help ransomware victims recover their data without having to pay ransom to cyber criminals.

The online website not just educates computer users to protect themselves from ransomware, but also provides a collection of free decryption tools.

The platform is now available in 14 languages and hosts 40 free decryption tools, supplied by a range of member organizations, which can be used by users to decrypt their files which have been locked up by given strains of ransomware.

Boston-based cyber security firm Cybereason has released RansomFree — a real-time ransomware detection and response software that can spot most strains of Ransomware before it starts encrypting files and alert the user to take action.
RansomFree is a free standalone product and is compatible with PCs running Windows 7, 8 and 10, as well as Windows Server 2010 R2 and 2008 R2.

Source: The Hacker News, Tech Republic, security.illinois.edu, digital guardian.com, Sophos, It.ie, Cybereason

WannaCry Ransomware

May 17, 2017 · Leave a comment ·

A massive ransomware campaign hit computer systems of hundreds of private companies and public organizations across the globe – which is believed to be the most massive ransomware delivery campaign to date.
The Ransomware in question has been identified as a variant of ransomware known as WannaCry (also known as ‘Wana Decrypt0r,’ ‘WannaCryptor’ or ‘WCRY’).

WannaCry1

What is WannaCry?

Generally, WannaCry comes in two parts. First, it’s an exploit whose purposes are infection and propagation. The second part is an encryptor that is downloaded to a computer after it has been infected.

The first part is the main difference between WannaCry and the majority of encryptors. To infect a computer with a common encryptor, a user has to make a mistake, for example by clicking a suspicious link, allowing Word to run a malicious macro, or downloading a suspicious attachment from an e-mail message. A system can be infected with WannaCry without the user doing anything.

WannaCry-infection-flow02 The vulnerability used in this attack (code named EternalBlue) was among those leaked by the Shadow Brokers group. The vulnerability was exploited to drop a file on the vulnerable system, which would then be executed as a service. This would then drop the actual ransomware file onto the affected system, encrypting files with the .WNCRY extension. (A separate component file for displaying the ransom note would also be dropped.) Files with a total of 176 extensions, including those commonly used by Microsoft Office, databases, file archives, multimedia files, and various programming languages.

Propagation If WannaCry/Wcry entered an organization’s network, it could spread within it very rapidly. Any machine or network that has exposed port 445 to the internet is at risk as well. EternalBlue exploit works over the Internet without requiring any user interaction.

How widespread is the damage?

The attack has been found in 150 countries, affecting 200,000 computers, according to Europol, the European law enforcement agency. FedEx, Nissan, and the United Kingdom’s National Health Service were among the victims.

What is the killswitch?

The worm-spreading part of the WannaCry – which is designed to infect other computers — has a special check at the beginning. It tries to connect to a hardcoded website on the Internet and if the connection FAILS, it continues with the attack. If the connection WORKS, it exits. Thus, by registering this domain and pointing it to a sinkhole server, a researcher from the U.K. successfully slowed the spread of the worm.

wannacry_cyberexpert_ap — British IT expert Marcus Hutchins who has been branded a hero for slowing down the WannaCry global cyber-attack sits in front of his workstation during an interview in Ilfracombe, England, Monday, May 15, 2017. ( Image source: AP)

On the one hand, it does stop further spread of the infection. However, only if the worm is able to connect to the Internet. Many corporate networks have firewalls blocking internet connections unless a proxy is used. For these, the worm will continue to spread in the local network. On the other hand, there is nothing stopping the attackers from releasing a new variant that does not implement a killswitch.

Killswitch Domain

The second domain was sinkholed by Matt Suiche of Comae Technologies, who reported stopping about 10,000 infections from spreading further:

We should thank below given people for saving millions of computers from getting hacked:

MalwareTech— very skilled 22-years-old malware hunter (Marcus Hutchins) who first discovered that here’s a kill-switch, which if used could stop ongoing ransomware attack.
Matthieu Suiche— security researcher who discovered the second kill-switch domain in a WannaCry variant and prevent nearly 10,000 computers from getting hacked.
Costin Raiu— security researcher from Kaspersky Lab, who first found out that there are more WannaCry variants in the wild, created by different hacking groups, with no kill-switch ability.

Not only this, Benjamin Delpy, Mohamed Saher, x0rz, Malwarebytes, MalwareUnicorn, and many others.

Multiple security researchers have claimed that there are more samples of WannaCry out there, with different ‘kill-switch’ domains and without any kill-switch function, continuing to infect unpatched computers worldwide.

How to Protect Yourself from WannaCry Ransomware?

Here are some simple tips you should always follow because most computer viruses make their ways into your systems due to lack of simple security practices:

1. Always Install Security Updates

If you are using any version of Windows, except Windows 10, with SMB protocol enabled, make sure your computer should always receive updates automatically from the Microsoft, and it’s up-to-date always.

2. Patch SMB (Server Message Block) Vulnerability

Since WannaCry has been exploiting a critical SMB remote code execution vulnerability (CVE-2017-0148) for which Microsoft has already released a patch (MS17-010) in the month of March, you are advised to ensure your system has installed those patches.

Moreover, Microsoft has been very generous to its users in this difficult time that the company has even released the SMB patches (download from here) for its unsupported versions of Windows as well, including Windows XP, Vista, 8, Server 2003 and 2008.

Note: If you are using Windows 10, you are not vulnerable to SMB vulnerability.

3. Disable SMB

Even if you have installed the patches, you are advised to disable Server Message Block version 1 (SMBv1) protocol, which is enabled by default on Windows, to prevent against WannaCry ransomware attacks.

Here’s the list of simple steps you can follow to disable SMBv1:

Go to Windows’ Control Panel and open ‘Programs.’
Open ‘Features’ under Programs and click ‘Turn Windows Features on and off.’
Now, scroll down to find ‘SMB 1.0/CIFS File Sharing Support’ and uncheck it.
Then click OK, close the control Panel, and restart the computer.

4. Enable Firewall & Block SMB Ports

Always keep your firewall enabled, and if you need to keep SMBv1 enabled, then just modify your firewall configurations to block access to SMB ports over the Internet. The protocol operates on TCP ports 137, 139, and 445, and over UDP ports 137 and 138.

5. Use an Antivirus Program

An evergreen solution to prevent against most threats is to use a good antivirus software from a reputable vendor and always keep it up-to-date.

Almost all antivirus vendors have already added detection capability to block WannaCry, as well as to prevent the secret installations from malicious applications in the background.

6. Be Suspicious of Emails, Websites, and Apps

Unlike WannaCry, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

So, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source to safeguard against such ransomware infection.

Also, never download any app from third-party sources, and read reviews even before installing apps from official stores.

7. Regular Backup your Files:

To always have a tight grip on all your important documents and files, keep a good backup routine in place that makes their copies to an external storage device which is not always connected to your computer.

That way, if any ransomware infects you, it cannot encrypt your backups.

8. Keep Your Knowledge Up-to-Date

There’s not a single day that goes without any report on cyber-attacks and vulnerabilities in popular software and services, such as Android, iOS, Windows, Linux and Mac Computers as well.

What to do if WannaCry infects you?

Well, nothing.

If WannaCry ransomware has infected you, you can’t decrypt your files until you pay a ransom money to the hackers and get a secret key to unlock your file.

Never Pay the Ransom:

It’s up to the affected organizations and individuals to decide whether or not to pay the ransom, depending upon the importance of their files locked by the ransomware.

But before making any final decision, just keep in mind: there’s no guarantee that even after paying the ransom, you would regain control of your files.

Moreover, paying ransom also encourages cyber criminals to come up with similar threats and extort money from the larger audience.

So, sure shot advice to all users is — Don’t Pay the Ransom.

“Given the high profile of the original attack, it’s going to be no surprise at all to see copycat attacks from others, and perhaps other attempts to infect even more computers from the original WannaCry gang. The message is simple: Patch your computers, harden your defences, run a decent anti-virus, and – for goodness sake – ensure that you have secure backups.” Cyber security expert Graham Cluley told The Hacker News.

Source: thehackernews, indianexpress, kaspersky, securelist, trendmicro, Microsoft

Ransomware

April 24, 2017April 24, 2017 · Leave a comment ·

Ransomware is a sophisticated piece of malware that blocks the victim’s access to his/her files.

There are two types of ransomware in circulation:

Encrypting ransomware, which incorporates advanced encryption algorithms. It’s designed to block system files and demand payment to provide the victim with the key that can decrypt the blocked content. Examples include CryptoLocker, Locky, CrytpoWall and more.

Locker ransomware, which locks the victim out of the operating system, making it impossible to access the desktop and any apps or files. The files are not encrypted in this case, but the attackers still ask for a ransom to unlock the infected computer.

Examples include the police-themed ransomware or Winlocker.