Internet Ransomware attacks reported in Europe.

[Notebook]

http://www.bbc.co.uk/news/technology-39901382

A massive ransomware campaign appears to have attacked a number of organisations across Europe.
Screenshots of a well known program that locks computers and demands a payment in Bitcoin have been shared online by parties claiming to be affected.
There have been reports of infections in Spain, Italy, Portugal, Russia and Ukraine.
It is not yet clear whether the attacks are all connected.

N.

 

[Urwumpe]

Not sure about any special campaign going on.

The Ransomware attack mostly targets British hospitals right now.

https://www.heise.de/newsticker/mel...t-zahlreiche-Krankenhaeuser-lahm-3713235.html

 

[jedidia]

Not sure about "campaign"... RansomWare attacks are a constant and common threat especially to small businesses. It's more likely that a security leak was discovered somewhere and people took the opportunity.

 

[Thunder Chicken]

What is the vector for this? Is it email?

 

[RisingFury]

The article on BBC claims that the attack is called WannaCry. The wikipedia page for it claims that people believe that one of NSA's exploit, called ETERNALBLUE is being utilized.

If this ends up being true, you might as well rename NSA to National UnSecurity Agency.


Here's a list of Microsoft Windows versions that are affected:
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

 

[Urwumpe]

What is the vector for this? Is it email?

The "WannaCry" ramsonware that mostly hits Spain right now is first email, but then uses a known windows vulnerability to spread in the local network.

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Damn, ninjaed by RisingFury.

 

[Artlav]

SMB1 protocol, a file sharing subsystem of Windows, is the origin.
No actions are needed from the user - a computer would get infected as readily as it was infected with Win10 in the old days.
Affected are every version at least from Vista up to Win10.

That, gentlemen, is what a real virus looks like.

At least there is a quick registry hack that can plug that hole.

If this ends up being true, you might as well rename NSA to National UnSecurity Agency.

How can a Ministry of Truth be producing falsehoods? Don't you want to be safe?
...no, i don't think i can be sarcastic about such stuff any more.

 

[RisingFury]

At least there is a quick registry hack that can plug that hole.

Can you please post it? (As opposed to us searching for it, because not all of us are well-versed in the inner guts of Windows and thus can't tell if what we're being fed is good or malicious.)

 

[Artlav]

Here it is:
https://support.microsoft.com/en-us...r-2008-r2,-windows-8,-and-windows-server-2012

Only SMBv1 needs to be disabled.

 

[jedidia]

The "WannaCry" ramsonware that mostly hits Spain right now is first email, but then uses a known windows vulnerability to spread in the local network.

Huh? I thought they patched that two days ago.

 

[jangofett287]

The patch for the SMBv1 RCE vuln was released in March.

 

[RisingFury]

Just for kicks, I googled "Remove WannaCry". No links that I'd even dare click on, let alone actually install programs from. I imagine a few victims might get a double punch: First the virus, then a removal scam.

If anyone gets hit, probably best to just lay low for a few days.

If NSA really is behind the exploit, then they might have caused people to die because of hospitals getting hit... A spy agency, hacking everyone to keep people safe, now indirectly responsible for a worldwide attack.

 

[jangofett287]

It uses an exploit the NSA discovered (codename EternalBlue) the details of which were leaked in the Shadow Broker dumps. It also looks for an NSA persistence tool called DoublePulsar and uses that if it can.

It's important to note that the bug in SMBv1 existed and was exploitable whether or not the NSA discovered it. While most people agree sitting on vulns is a bad idea because of the risk of parallel discovery, there is debate as to whether telling Microsoft earlier would have prevented these attacks, or if we'd have just seen it earlier.

Also, if you want an idea of how bad this is, Microsoft have released a patch for Windows XP.: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

---------- Post added at 11:00 ---------- Previous post was at 10:48 ----------

Oh, almost forgot.
When WannaCry first arrives on a system it tries to connect to a specific URL. If it gets any response it exits. This appears to be some kind of kill switch. The URL is hard coded in the binary, so has now been sinkholed to a server which responds, effectively ending this variant, although it wouldn't take much work to change that so patching still very important as always.

 

[Urwumpe]

Just went to my local O2 store for doing some business ... out of order, the telefonica hacks also disabled the local stores here. German train stations have been photographed showing the ramsonware message on the departing/arriving train displays.

Good news - any Windows 10 Desktop system should be patched since January. It mostly targets older installations and unpatched enterprise systems, especially Windows Server.

 

[jedidia]

Also, if you want an idea of how bad this is, Microsoft have released a patch for Windows XP

I sure hope so, most ATMs still run on it.

 

[NukeET]

I sure hope so, most ATMs still run on it.

Not true here in the U.S.

 

[Urwumpe]

Not true here in the U.S.

In Germany quite many ATMs still run on XP, only few have already switched to... Windows 8. :lol:

 

[Notebook]

I've seen a XP fault screen in a bank ATM here in the UK. A few years ago now.

N.

 

[NukeET]

In Germany quite many ATMs still run on XP, only few have already switched to... Windows 8. :lol:

I get that...thanks.

 

[RisingFury]

Are regular users getting hit at all or is it just business / institutions?