|
|
Post by Lighthouse on Jun 29, 2017 12:05:37 GMT
Tuesday’s global cyber-attack that hit companies around the world may have been started via corrupted updates on a piece of accountancy software. Experts are pointing the finger at a piece of Ukrainian tax-filing software as the source of the infection although the firm concerned is denying it. Companies in 64 countries were affected by the malware which infiltrates networks via email attachments that users click on in error. Microsoft has described the method as a “recent dangerous trend”. The shipping giant Maersk was one of the major corporations affected by the cyber-attack and said that it was unable to process new orders and was expecting delays to consignments. One of Europe’s largest port operators,Rotterdam said that it had been forced to use manual processes and many other firms including the advertising giant WPP and the Russian oil company Rosneft were also affected.
|
|
|
|
Post by Admin_Vistamike on Jun 29, 2017 13:45:33 GMT
There are many others attacking the net, especially through email attachments. As we have pointed out before, if you don't know the sender, delete it. Don't open it.... I have a few email accounts and often get this type of mail....if the email shows a paperclip for instance it means that some document/image is attached, usually a macro will then automate the insertion of some very nasty stuff. But of course we all have defenses? Or do we? Personally I run Superantispyware, Malwarebytes, Defender and SecureAPlus. In addition I also have this running, RansomFree from Cybereason: A small install file here: ransomfree.cybereason.com/Tis a pain in the proverbial to do all this but this the real world and we have to deal with it somehow. KEEP SAFE FOLKS!! |
|
|
|
Post by irvsp on Jul 3, 2017 23:59:25 GMT
I installed RansomFree some months ago.
First of all it claims to work, but it basically uses 'honey pots'. Creates folders and files in various places and 'hope' they get hit first by a virus. Once they start doing the encryption the program will recognize that and take action. Sounds good, but I don't know if it halts it while waiting for you to respond or not? While the idea seems good, if I'm a ransom maker I'd think this 'protection' would be easy to circumvent. For instance it created these two folder when I booted this morning:
==========
Directory of C:\
07/03/2017 05:44 AM <DIR> Acfound158
07/03/2017 05:44 AM <DIR> Xuse250
=========
First and last alphabetically on the C: drive. Each of those folders have similar content:
============
C:\>dir acfound158
Volume in drive C is OS
Volume Serial Number is EEE1-088E
Directory of C:\acfound158
07/03/2017 05:44 AM <DIR> .
07/03/2017 05:44 AM <DIR> ..
07/03/2017 05:44 AM 258,078 AKnToGfb.jpg
07/03/2017 05:44 AM 424,380 artsabnormal.doc
07/03/2017 05:44 AM 24,349 dull accompany nine capital.txt
07/03/2017 05:44 AM 97,542 germany-autumn.rtf
07/03/2017 05:44 AM 14,587 kept_handshake_waited_similar.sql
07/03/2017 05:44 AM 214,614 like-align-hypothesis-telescope.mdb
07/03/2017 05:44 AM 54,504 magnificent.bake.pem
07/03/2017 05:44 AM 501,570 performedsteele.xlsx
07/03/2017 05:44 AM 78,110 substances-forms-homework-legislature.xls
07/03/2017 05:44 AM 275,440 toneyesterday.docx
10 File(s) 1,943,174 bytes
========
Similar folders are in other folders and drives as well.
I would think that there would be an easy way to first tell is such honey pots were there by first checking the boot time and then skipping these? Also don't go alphabetically?
My C: is an SSD and these do cause unnecessary writes to it as well. Also my Security Suite (both McAfee and Norton) sent me e-mail telling me I WAS protected by the recently released Ransomware.
I'm still running it, seems to be almost no load on the system anyway, just wonder how robust it is?
|
|
|
|
Post by GuiltySpark on Jul 4, 2017 21:27:53 GMT
The SAS forum was being hit recently probably more from a ddos than a ransomware attack but who knows, the guest list rose from 20 to 800+ in a matter of minutes. Luckily I was watching and reported it to an admin where they blocked the Israeli IP and it stopped.
|
|
|
|
Post by irvsp on Jul 4, 2017 21:55:56 GMT
Just got a 'newsletter' that states MS is adding 'some sort of protection' for Ransomware to W10. See www.infopackets.com/news/10136/windows-10-gets-anti-ransomware-feature which seems 'interesting'. Of course you must run Windows Defender too (it seems to get along with both McAfee and Norton?) to be able to do this. Depending on how good the included WhiteList would be it might be workable. Of course, I would suspect it would take long for Ransomware makers to possibly circumvent this protection. First way coming to my mind is name the virus EXE file the same as one on a WhiteList. Another would be to discover how Windows Defender did this and either when started remove the protection or put itself on the list. As for the Ukranium company, well they are in some hot water, they were warned before about old known compromised s/w on their servers ( www.theverge.com/2017/7/3/15916060/petya-medoc-vulnerability-ransomware-cyberattack) and didn't take any action. The thought is a supposed update that was pushed out by those servers were Petya. What I listed isn't a problem for me on my PC, I use MailWasherPro as an e-mail front end. It is able to classify the 2 forms of the basic body for me (the BITBY catches more than the ones I don't want) and colors them so I see it. I can click on it as MWP defaults to text and it is easy to see as it is just random words. However when I get my email on my iPad it uses HTML... and these all (both types) show basically legitimate (possibly) web pages. I can't be sure of the game here, I don't think it is to infect more to get paid for referring someone to look at the page? Can't be 100% sure though... and I've not figured out the string of numbers and characters as to what they do? |
|
|
|
Post by Admin_Vistamike on Jul 9, 2017 15:49:55 GMT
Hi Irv, nice to see you around again. Since my post re ransomware I found it had updated. It does not seem to impinge on system. However I never really looked at the engine service as to how it actually works. I have been sort of 'offline' for a bit so catching up. I was reading this article re decryption: www.bleepingcomputer.com/news/security/author-of-original-petya-ransomware-publishes-master-decryption-key/Author of Original Petya Ransomware Publishes Master Decryption KeyThe author of the original Petya ransomware — a person/group going by the name of Janus Cybercrime Solutions — has released the master decryption key of all past Petya versions. This key can decrypt all ransomware families part of the Petya family except NotPetya, which isn't the work of Janus. This list includes: read here>>>>>As we all know, the attack trend changes on a regular basis, same shit but with minor changes to let slip the systems we have. It is an utterly pointless attack on the community, merely TRY to extract our hard earned smackeroozies, even after already being spliced by our governments!! I do image on a regular basis (every 24hours now) so I can restore if I ever get blasted. But we, as (professional) users may see very odd emails for instance and just kick them out. The Mainstream / everyday user is of course the eventual target, his internet browsing very different from ours, they get hit and I see it often with clients, even AFTER telling them not to respond. I have a call coming in, Microsoft Security, virus found, please call toll free this number....... |
|
|
|
Post by irvsp on Jul 12, 2017 11:24:28 GMT
Hi Irv, nice to see you around again. . . I do image on a regular basis (every 24hours now) so I can restore if I ever get blasted. But we, as (professional) users may see very odd emails for instance and just kick them out. The Mainstream / everyday user is of course the eventual target, his internet browsing very different from ours, they get hit and I see it often with clients, even AFTER telling them not to respond. I've been here randomly... just reading mostly. I worry about getting blasted. I worry about the security of my backups. Right not I do it weekly. I can afford to lose up to 1 weeks worth of 'stuff'. Mostly mail and some game progress. Don't do anything else in terms of 'work' on the PC, and surely nothing that couldn't be recreated. Why I worry is what if the attack can find my backups and lock those? I've got them on an always attached External drive. I use Acronis for backup. As far as I know the ransomware payloads only encrypt some specific extensions. Can't do all ones as if they did the Windows wouldn't run. Might be FOLDER driven even to bypass MS files that are JPG's or PNG's or any other that they'd normally encrypt. If I was a writer of such a payload I'd encrypt any backup I located based on known extensions. If they do that, I'll be in a world of hurt? Right now I'm copying the last backup file over to my Network, a USB External drive attached to my Router. It is NOT assigned a drive letter but using Windows Explorer I can open the router and get to it (I should write a task to run an hour after backup creation using the URL of the drive, too lazy right now) but could the ransomware is the question. I know they do propagate over network, so I have to worry about my wife (similar setup to mine, Acronis, external drive always on), and even a grandkid that comes here occasionally getting infected. If I was REALLY PARANOID I guess I could disconnect the External drive when not in use, but that is a pain too and I'd probably forget to reconnect it before Acronis ran. |
|
|
|
Post by Admin_Vistamike on Jul 13, 2017 15:24:32 GMT
I am the same Irv, paranoid. However all my external drives are connected via a powered USB hub, 3 gangs of 3 each gang switchable, so when not needed I can just switch them off. My new Vodafone router, after changing from Sky Fibre does have 2 USB 3 points but I prefer not to use them, too close for comfort even though I have a powerful password. My Synology NAS server is also connected, but not TOO worried about that (runs in linux) and has it's own IP address which I can access anywhere.
My backups are encrypted either Macrium, Aomei Backupper and veeam. Just feel a bit safer, having too many machines, networked. The system backup drive is a military grade 1 tb portable, purely used for my Lenovo and is held in a secure location when done.
Security and protection is now so important!!
|
|
