Review of the WannaCry attack and ransomware prevention tips
By Paul Rummery, Securenet Consulting
WannaCry ransomware - a sign of times to come?
Multiple security researchers have claimed that there are more samples of WannaCry out there. Even with that aside, we know ransomware isn't going to stop or go away anytime soon.
It's very important to understand that, for future attacks, all the attackers need to do is change some code and start again. Patch your systems now.
At the time of writing this blog, another ransomware variant, known as Uiwix, has been spotted in the wild, exploiting the same vulnerability in Windows SMBv1 and SMBv2 as WannaCry used. Cyber criminals are quick to incorporate vulnerabilities, especially when they have the potential to infect a large number of targets like the EternalBlue exploit has.
Possible WannaCry Fix - Wannakey
Caveats and limitations apply... but only if you have not rebooted your XP machine(s), and even then there are no guarantees.The Wannakey tool (download from GitHub), put together by security researcher Adrien Guinet offers in-memory key recovery for Win XP machines, by dumping encryption keys from memory. This RSA private key, once recovered, can be used to restore encrypted files on infected computers.
What is WannaCry ransomware - an overview
WannaCry has infected 300,000 machines in 150 countries over the weekend, Warned Europol.
"Many of those victims will be businesses, including large corporations. The global reach is unprecedented." Says Europol chief Rob Wainwright.
WannaCry new headlines a time of writing:
- 61 NHS England organisations disrupted.
- Car manufacturer Renault had stopped production for a period of time.
- Telefonica’s Madrid HQ stopped their users accessing their endpoints until the situation was assessed.
- Logistics giant FedEx was unable to function at normal effectiveness.
- Russia’s government agencies were reported to be hardest hit with over 1000 endpoints affected.
- Choice hotels in Scandinavia were reported to be affected.
- Police computer systems in some Indian states had been affected
Critical Patch Updates for infected machines should have been patched in March.
The attack exploited a Microsoft SMB server vulnerability that was already addressed in a Microsoft Bulletin released in March (MS17-010) - that was fixed in March.
The attack began by scanning for vulnerable SMB ports exposed to the public internet.
Previously WannaCry was spread via Dropbox URLs embedded in emails, but new variants are now spreading via this previously found SMB vulnerability.
This ransomware had a very unusual component: it contained a worm component. It would scan for and attempt to compromise using the same EternalBlue vulnerability machines on both its LAN and on the internet.
Even before that, in September 2016 Microsoft had strongly urged users to migrate away from SMBv1, which dates back to the early 1990s.
US-CERT had issued similarly strong recommendations as well. Organizations that had followed best practices - both in patching and in proper configuration of SMB services - would not be affected by this attack.
The vulnerability used in this attack (code named EternalBlue) was among those leaked by the Shadow Brokers group that was allegedly stolen from the National Security Agency (NSA). The vulnerability was exploited to drop a file on the vulnerable system, which would then be executed as a service. This would then drop the actual ransomware file onto the affected system, encrypting files with the .WNCRY extension. (A separate component file for displaying the ransom note would also be dropped.) Files with a total of 166 extensions, including those commonly used by Microsoft Office, databases, file archives, multimedia files, and various programming languages.
Affected Microsoft products include:
- Windows Vista
- Windows Server 2008
- Windows 7
- Windows Server 2008 R2
- Windows 8.1
- Windows Server 2012 and Windows Server 2012 R2
- Windows RT 8.1
- Windows 10
- Windows Server 2016
- Windows Server Core installation option
Who is responsible for WannaCry Attack?
1. Microsoft who created an operating system with so many vulnerabilities?
2. is it the NSA, the intelligence agency of the United States, who found this critical SMB vulnerability and indirectly, facilitates WannaCry like attacks by not disclosing it to Microsoft? "If NSA had privately disclosed the flaw used to attack hospitals when they ‘found’ it, not when they lost it, this may not have happened," NSA whistle-blower Edward Snowden says.
3. is it the Shadow Brokers, the hacking group, who managed to hack the NSA servers, but instead of reporting it to Microsoft, they decided to dump hacking tools and zero-day exploits in public?
4. Neel Mehta, a security researcher at Google, found evidence that suggests the WannaCry ransomware, is linked to a state-sponsored hacking group in North Korea - but has since been denied by DPRK representatives.
5. Or is it the Windows users themselves, who did not install the patches on their systems or are still using an unsupported version of Windows?
All are responsible to some degree, but the best course of action is to perform your due diligence, continually assess risk and ensure you have adequate systems in place to pro-actively protect your business and data.
For an in-depth review of the WannaCry outbreak, see Microsoft’s blog
WannaCry prevention steps
Ransomware prevention tips from the UK National Cyber Security Centre
- Disable smb v1, this prevents WannaCry from spreading within your network.
- Install the Microsoft patches, this also prevents WannaCry from spreading within your network.
- Patch operating systems, software, and firmware on devices. Consider using a centralised patch-management system.
- Keep all the software on your computer up to date. When your operating system (OS) or applications release a new version, install it. And if the software offers the option of automatic updating, take it.
- Do not attempt to block access to the domain identified and registered as part of the Kill-Switch activation—doing this will actually enable the malware to successfully encrypt compromised machines.
- Beware of phishing: never open e-mail attachments from an untrusted sender or click on links within e-mails or documents without checking the source.
- Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email.
- Never open attachments in emails from someone you don’t know. Cyber criminals often distribute fake email messages that look very much like email notifications from an online store, a bank, the police, a court or a tax collection agency, luring recipients into clicking on a malicious link and releasing the malware into their system.
- Enable the ‘Show file extensions’ option in the Windows settings on your computer. This will make it much easier to spot potentially malicious files. Stay away from file extensions like ‘.exe’, ‘.vbs’ and ‘.scr’. Scammers can use several extensions to disguise a malicious file as a video, photo, or document (like hot-chics.avi.exe or doc.scr).
- Configure firewalls to block access to known malicious IP addresses.
- Isolate communication to UDP ports 137 / 138 and TCP ports 139 / 445, using next-gen firewall capabilities to block the SMB protocol itself from the internet. The worm-like nature of this malware is due to an active probe for SMBv1 server port 445 on the local LAN searching for the presence of the Backdoor.Double.Pulsar. If the backdoor is present, the payload is delivered and executed through this channel. If not, a slightly less reliable exploitation route is taken.
- The malware downloads a TOR client and starts to communicate to C&C servers via TOR protocol. We recommended that you block outbound TOR traffic.
- Logically separate networks. This will help prevent the spread of malware. If every user and server is on the same network newer variants can spread.
- Use application white-listing, which only allows systems to execute programs known and permitted by security policy.
- Block ads. Ransomware is often distributed through malicious ads served when visiting certain sites. Blocking ads or preventing users from accessing certain sites can reduce that risk.
- Use the principle of “least privilege” to manage accounts: No users should be assigned administrative access unless absolutely needed. If a user only needs to read specific files, the user should not have write access to them.
- Conduct regular penetration tests and vulnerability assessments.
Ransomware Prevention Solutions
While WannaCry has made the general public abruptly aware of ransomware, it’s merely the latest in a series of variants that began plaguing businesses and consumers years ago. Ransomware gangsters extorted over $1B from victims last year; some 47% of businesses suffered at least one ransomware attack.
Affected companies can also be penalised by regulatory bodies if security systems failed to comply with statutory requirements.
Since no security solution provides iron-clad protection against ransomware, the more security layers an IT network has, the higher its potential to catch ransomware infection before it starts running.
Stopping ransomware requires a defense-in-depth approach; there is no one silver bullet to security.
Enterprises should use a multi-layered approach to mitigate the risks brought threats like ransomware.
In an ideal world it’s always best to prevent the virus from entering the network in the first place and there are several actions that can help. Ransomware viruses can gain entry in numerous ways, be it through web browser sessions, emails and their attachments, files on USB devices or any other device that might be used as part of a BYOD policy – all these are potential sources of infection and might not just come from users, but even the IT department themselves or visiting customers.
Click a topic heading below to learn more
Timely patching is a must – best practice
Patch Management
Malware such as ransomware often exploit system and application vulnerabilities in desktops, servers, and other devices in order to penetrate systems and networks.
Operating system and application vendors release patches to address vulnerabilities in their products and help users keep attacks at bay. However, these patches are only as good as when and whether or not they are applied.
Audit installed software and keep it up to date: malware often uses flaws in outdated software. Keep all installed software up to date, not only on end nodes but also in the data centre. Patch Management solutions will detect vulnerabilities in many third-party software.
Patch your systems - all vulnerable versions of Windows are effectively patchable (especially with the update from Microsoft released over the weekend for unsupported systems). The patch for this vulnerability applies to Windows Vista systems and newer, and it can be found in the Microsoft Security Bulletin MS17-010 - Critical security update.
- Simplify and automate patch management
- Centrally manage patching all platforms: on-premise, cloud, datacentre, physical or virtual servers.
- Manage patches for third-party applications (non-Microsoft) such as Adobe, Java, Firefox Chrome, etc.
- Identify the computers that are missing critical patches and then deploy those patches immediately.
Virtual Patching
Implement virtual patching. As mentioned, patching can be challenging as it takes time. Within this process, there is also an exposure period that can leave systems vulnerable to attacks. Virtual patching addresses these issues and offers protection even if patches are not yet available.
The virtual patch enforcement analyses transactions and intercepts attacks, preventing malicious traffic from reaching the vulnerable web app.
Discover and inventory all web apps and to identify critical web app vulnerabilities, which can be protected from targeted attacks by deploying virtual patches.
Virtual patching can be deployed utilising network or virtual-based web application firewall protection (see below).
Also see, database protection using virtual patching
Web Application Firewall
Continually scan for vulnerabilties, virtually patch vulnerable systems at the click of a button without altering application source code, block ransomware applications and malicious web app features from accessing the internet or vice versa.
WAF’s are becoming increasingly simple to use and are very cost effective. You can even minimise data loss should you suffer a breach from another system or a zero day attack. This clearly has implications in relation to GDPR.
Continuously monitors your outward-facing websites and applications to identify, log, and remediate OWASP Top 10 attacks such as SQL Injections and Cross-Site Scripting (XSS).
Integrated IPS detection and prevention features.
By automating security audit procedures, it can dramatically accelerate your application development cycles while removing risks.
Data Backup – Data Protection
Don’t pay the ransom
- Have a recovery system in place so a ransomware infection can’t destroy your data forever.
- You might lose a few hours or a day restoring data, but you won’t have to pay the ransom.
- Backup your data to central repositories, off-site DR locations, cloud services and offline media. If you keep your files backed up with diversity of storage media and locations, you can quickly restore a ransomware-encrypted computer to its pre-infection state.
- Ensuring you backup your data using offline media means ransomware worms can only attempt to infect network connected resources (USB drives, mapped network drives etc.)
- Continuous Data Protection / data replication gives you the ability to 'rewind' files, sites, applications, VM’s.
- Consider authentication in the design and implement as much separation as possible from production workloads - gaining network administrative access is a primary objective because it allows ransomware variants to read/write data on the most critical locations on the network. With this access, they can encrypt the backup files themselves.
- Solution vendors are also providing reporting tools that can help protect against ransomware by alerting users of anomalies occurring within files.
Anti Virus
AV engine detects the malware along with variants
Make sure anti-virus is up-to-date: The majority of anti-virus vendors are now able to detect WannaCry.
Leverage next-generation anti-virus technologies to inspect files and identify malicious behavior to block malware and non-malware attacks that exploit memory and scripting. Schedule your anti-virus and anti-malware programs to automatically conduct regular scans.
Protects against the latest malware variants with proactive technologies able to block previously unknown threat variants. Removes malicious code and registry keys created by malware.
Anti Malware
Deploying a malware protection solution to accompany your existing AV solution is your best bet for catching malware attacks like WannaCry.
Anti Malware goes beyond anti virus programs, incorporating a much wider range of security protection features (often incorporating an AV engine in the solution).
Commonly integrated into a range of security and network solution platform, can be deployed across multiple layers of your infrastructure (cloud servers, perimeter gateways, networks scanners, and endpoints (Windows, Mac, Android, and iOS) mobile devices, desktops, servers, epos, financial and manufacturing terminals...)
Real-time detection and blocking engines continuously monitor for ransomware behaviors, like those seen in WanaCrypt0r.
Prevent mass-distributed malware infections and detect legacy threats.
Anti malware solutions can extend to support mobile devices, protecting them even when they are not connected / protected by the corporate network. Some solution vendors will provide a cloud based engine that will route and filter traffic in the cloud, to save processing and performance utilisation on the local user or network device.
Sandboxing
Detects the malicious behaviour
Sandboxing and other advanced detection techniques identify new ransomware and all of its variants, creating the necessary actionable intelligence for remediation.
Perform automated static and dynamic analysis of files against behavioral indicators. These analyses uncover stealthy threats and help your security team understand, prioritise, and block sophisticated attacks.
It is also possible to prevent a ransomware payload delivery by automatically blocking known bad IP addresses using a continuously updated threat intelligence feeds.
Enterprise class sandbox solutions are often stand alone product or services, because of the shear volume of data processing that needs to take place. However, sandboxing / deep file analysis capabilities that perform static and dynamic malware analysis of unknown files can be incorporated into many email / web gateway solutions.
Intrusion Detection / Prevention
Mitigate threats with real-time protection from ransomware
Detects / or blocks the malicious behaviour of malware
IDS / IPS is critical to stopping never-before-seen ransomware, through the automated sharing of actionable intelligence between detection / prevention components and global intelligence feeds.
Continually monitor your network with built-in vulnerability scanning.
Helps you control the use of risky applications, to reduce your attack surface.
Block attempted connections to the attackers C&C site.
Combined Email and Web Control Protection
Email Security
Email Security defends your business against spear phishing, ransomware, cryptoworms, and other stealthy attacks.
Email has long been a favorite attack vector of cyber criminals and is often an early stage of advanced threats. But not only do you need to keep threats from getting in, you need to keep data from getting out.
- Scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users.
- Enable strong spam filters to prevent phishing emails from reaching end users and authenticate inbound email using technologies such as Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) to prevent spoofing.
- Blocks messages with malicious links.
As mentioned above in the sandboxing section, sandbox feature can be integrated into some enterprise email gateway solutions.
Web Security
Configure your web gateway in such a way as to scan all downloads for viruses and block known web addresses and mechanisms for communication with command & control servers.
Activate the scanning of SSL connections in each case. If your web gateway provides sandboxing technology to analyse downloads, then activate this function.
Web filter identifies targeted sites and appropriately blocks or allows them.
Next Generation Firewall
Stops the spread of the malware
– IPS, Application Control, Malware Scan, IP Botnet, Segmentation, software-defined perimeter
Firewalls are designed to secure today’s dispersed network infrastructures, including on-premises, cloud-hosted, SaaS-based, and mobile elements, as well as third-party applications. They enable secure network connections for your remote workers, improve site-to-site connectivity, and ensure secure, uninterrupted access to cloud-hosted applications.
A dedicated IPS or an IPS integrated into a firewall/UTM should be configured in such a way that the command & control communication is blocked.
Stops the spread of the malware
– IPS, Application Control, Malware Scan, IP Botnet, Segmentation, software-defined perimeter
Firewalls are designed to secure today’s dispersed network infrastructures, including on-premises, cloud-hosted, SaaS-based, and mobile elements, as well as third-party applications. They enable secure network connections for your remote workers, improve site-to-site connectivity, and ensure secure, uninterrupted access to cloud-hosted applications.
A dedicated IPS or an IPS integrated into a firewall/UTM should be configured in such a way that the command & control communication is blocked.
Network Firewall / Segmentation
Software / virtual defined network and user segmentation
You need to segment your network to protect critical business assets.
Security measures at the gateway are rendered useless if a computer that is introduced to the network without authorisation (private notebook, computer belonging to the service provider, company notebook with outdated virus protection) is allowed to infiltrate these measures.
- Software defined segmentation is simpler to enable than VLAN-based segmentation.
- Segment devices without having to redesign the network.
- Easily manage access to enterprise resources.
- Ensures that all endpoints attempting to access a given infrastructure are authenticated and authorised prior to being able to access any resources on the network.
- Restrict lateral movement of threats with micro-segmentation.
- Establish strict context based access to network resources and segment networks (subnets, manufacturering systems).
- Firewall configuration to block the vulnerable ports so that you can prevent WannaCrypt from spreading across your network.
Endpoint Protection
Ensure that your endpoint real-time scanners are switched on
The endpoint is the last line of defense, enabling security features, policy enforcement at the endpoint and intelligence back to central / global management platforms.
Unlike antivirus protection, which only identifies specific signatures, advanced endpoint security provides real-time analysis of file movement and behavior across a whole network.
This behavior-focused strategy stems from lessons we’ve learned from other threats, such as zero-day attacks. If a malicious file slips through and infects a device, endpoint security software can use retrospective analysis to quickly track where a malicious file has landed within the network and, more important, from where it came. This helps network engineers to identify its origin, quarantine infected machines and prevent the malware from spreading further.
The software is also low-impact. It doesn’t perform CPU-sapping malware scans and only activates when files are moved or opened.
Other features commonly found within endpoint protection solutions
- Vulnerability and malware scan
- Host Intrusion Prevention / Firewall - Malware protection |
- Web filter
- Removable media control - Botnet protection |
Application Whitelisting
Where possible, use application whitelisting, which prevents unauthorised applications to be downloaded or run.
Access Control
Least Privilege
Establish and enforce permission and privilege, so that the fewest number of users have the potential to infect business-critical applications, data, or services.
If the user does not have access or only has read-only access, then the files in the folder are protected from ransomware as well.
Establish and enforce a BYOD security policy which can inspect and block devices which do not meet your standards for security (no client or anti malware installed, anti virus files are out of date, operating systems need critical patches, etc.)
Vulnerability Scanning & Assessments
Run a detailed vulnerability scan against all systems in your environments to identify systems missing the MS17-010 security update and identify all Windows endpoints, most will have SMB enabled.
Detect and/or block the malware’s command-and-control (C&C) communication.
Continuously scan your environments, patch the vulnerabilities across on-premises systems, cloud instances, and remote user endpoints provides full visibility of impatched assets for precise and prompt remediation.
Vulnerability assessment services can provide simulators to assess the status of your current systems by emulating potential ransomware attacks.
Penetration Testing
Establish a business continuity and incident response strategy and conduct regular vulnerability assessments.
Penetration Tests are designed to achieve a specific, attacker-simulated goal and should be requested by organisations that are already at their desired security posture. A typical goal could be to access the contents of the prised customer database on the internal network, or to modify a record in an HR system.
The deliverable for a penetration test is a report on how security was breached in order to reach the agreed-upon goal (and often information on how best to remediate).
Also see Security Testing
Forensic Tools
Deploy forensic analysis tools so that after an attack you can identify:
a) where the infection came from,
b) how long it has been in your environment,
c) that you have removed all of it from every device, and
d) that you can ensure it doesn’t come back.
Incident Response
Emergency response services provide remote and on-site investigation to reduce the impact of an incident on your organisation.
Get Proactive and decrease the impact of a breach
Turn your incident response plan into a proactive program that improves incident response times, lowers costs, and implements a continuous improvement process to strengthen your overall security effectiveness.
Backed by Global Intelligence and Integrated Technologies
- Help identify the primary infection source and contain further spread.
- Recommendations to prevent success of future similar attacks.
- Help create a recovery plan.
Analytics & SIEM
Threat intelligence services
Security Event and Intelligence solutions provide a holistic overview of a company’s IT environment from a single point.
|
|
Contact SecureNet Consulting today for solutions advice, engineering, support, professional services and proof of concept resources for ransomware protection.
 |
 |
 |
 |
 |
 |
 +44(0)7714 209927
+44(0)1273 329753
| ||
 info@securenetconsulting.co.uk |
 |  |  |  |
