The WannaCry ransomware has brought the enterprise, government agencies to their toes and organisations have swung into action to manage and prevent the threat. There is speculation that more is yet to come. Sharad Sadadekar, CISO, HDFC Life suggests a comprehensive guide on the best practices to shield organisations against such threats and even, for those who are affected, what are the steps to be taken. “The Information Security community has got into a huddle to take on the WannaCry swamp and we have been able to do in a matter of two-three days, something that could have taken weeks”, a CISO said on the condition on anonymity. This guide can prove to be a step in that direction.
Reports of ransomware attacks in Spain, UK and US began early morning on 12 May 2017 and later it started spreading like wildfire in other countries including India. Shortly thereafter, it was confirmed to be WannaCry ransomware using an Microsoft SMB vulnerability exploit techniques. Once this malware/ransomware gets installed, it encrypts the files (using AES and RSA encryption) and prompts for ransom.
Impact:
The ransomware cyber-attack targeted tens of thousands of computers in 150+ countries including India. It has crippled leading healthcare services, financial and logistic service systems and has been creating havoc across the globe.
Affected Software:
This ransomware appears to have exploited Windows vulnerability for which Microsoft released a patch in March called MS17-010. The flaw was in the Windows Server Message Block (SMB) service, which Windows computers use to share files and printers across local networks.
WannaDecryptoris ransomware has multiple names like WannaCry, WCry, WanaCrypt and WanaCrypt0r – with encrypted files extensions wnry, .wcry, .wncry and .wncrypt.
This ransomware leverages the AES-128 cryptosystem to lock data down, therefore any further manipulations are only efficient as long as the secret AES key is at the victim’s disposal.
Microsoft Windows systems using Samba (SMB) and Unpatched or End of Life Microsoft Windows systems like windows 2003, XP are at higher risk of infection.
Top 15 controls and measures which should be considered and implemented:
1. Newly released Intrusion Prevention signature should be configured on Firewall / IPS which will block any internet based attacks.
2. Disable uPNP on all your gateways, firewalls, routers and proxy servers.
3 Blacklist malicious IP addresses and website URLs received as part of multiple threat intelligence alerts and advisory groups.
4. Update the signature and block suspicious keyword patterns and emails at SPAM gateway. Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
5 Download latest antivirus signature to detect and prevent such attacks. Roll out across all end point systems and servers.
6 Download the latest operating system patches to address the vulnerability (Microsoft vulnerability MS17-010). Roll out of patches across all applicable endpoints and servers.
7 SMB port access and RDP (Remote Desktop Protocol) to all computers from the internet. Port 445 and 139 for SMB and 3389 for RDP should be blocked.
8 Strictly adhere to the NAC policy to restrict devices on network. Ensure updated AV and patch before connecting to the network.
9 Block domains which are high risk at gateway level. Refer Annexure1.
10 Disable SMB on end of life systems and harden the same before connecting on network.
11 Disable office macros through a group policy.
12 Backup all critical data or data of critical users on centralized system
13 Stop granting any privilege access to users who want to run an unknown program as an administrator.
14 SOC (Security Operation center) team to be on high alert and monitor and block all suspicious activities.
15 Ransomware Attack – Advisory awareness mailer to all users and Leadership.
What if you are already infected?
If you notice that you are a victim of this ransomware. Follow these steps immediately to
reduce the impact:
- Disconnect all network connections and external storage immediately.
- Inform your IT Or Infosec team
- Do not pay any ransom to the hacker as this will fuel the illegal ecosystem and there is no guarantee that you will get the data back.
- Safeguard and keep your backups ready before experts assist you.
Annexure1
- Indicators of compromise (IOCs)
File names
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa b.wnry
055c7760512c98c8d51e4427227fe2a7ea3b34ee63178fe78631fa8aa6d15622 c.wnry
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c r.wnry
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b s.wnry
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79 taskdl.exe
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d taskse.exe
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6 t.wnry
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 u.wnry
- Domain to be blocked or watched.
domain – 57g7spgrzlojinas.onion
domain – 76jdd2ir2embyv47.onion
domain – cwwnhwhlz52maqm7.onion
domain – gx7ekbenv2riucmf.onion
domain – sqjolphimrr7jqw6.onion
domain – xxlvbrloxvriy2c5.onion)
- CnC IP addresses be blocked or watched
38.229.72.16
188.166.23.127:443
193.23.244.244:443
2.3.69.209:9001
146.0.32.144:9001
50.7.161.218:9001
213.61.66.116
217.79.179.77
128.31.0.39
212.47.232.237
81.30.158.223
79.172.193.32
89.45.235.21
188.138.33.220
- Known hash values
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9
09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa
0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894
428f22a9afd2797ede7c0583d34a052c32693cbb55f567a60298587b6e675c6f
5c1f4f69c45cff9725d9969f9ffcf79d07bd0f624e06cfa5bcbacd2211046ed6
62d828ee000e44f670ba322644c2351fe31af5b88a98f2b2ce27e423dcf1d1b1
72af12d8139a80f317e851a60027fdf208871ed334c12637f49d819ab4b033dd
85ce324b8f78021ecfc9b811c748f19b82e61bb093ff64f2eab457f9ef19b186
a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b
a93ee7ea13238bd038bcbec635f39619db566145498fe6e0ea60e6e76d614bd3
b43b234012b8233b3df6adb7c0a3b2b13cc2354dd6de27e092873bf58af2693c
eb47cd6a937221411bb8daf35900a9897fb234160087089a064066a65f42bcd4
24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
2c2d8bc91564050cf073745f1b117f4ffdd6470e87166abdfcd10ecdff040a2e
7a828afd2abf153d840938090d498072b7e507c7021e4cdd8c6baf727cafc545
a897345b68191fd36f8cefb52e6a77acb2367432abb648b9ae0a9d708406de5b
fb0b6044347e972e21b6c376e37e1115dab494a2c6b9fb28b92b1e45b45d0ebc
9588f2ef06b7e1c8509f32d8eddfa18041a9cc15b1c90d6da484a39f8dcdf967
b43b234012b8233b3df6adb7c0a3b2b13cc2354dd6de27e092873bf58af2693c
4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982
09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa
Excellent reference and advisory:
- CERT‐In is constantly updating its webpage, please refer for latest update: http://www.cyberswachhtakendra.gov.in/alerts/wannacry_ransomware.html
- Windows OS Update: In order to prevent infection, users and organizations are advised to apply patches to Windows systems as mentioned in Microsoft Security Bulletin MS17‐ 010. https://technet.microsoft.com/library/security/MS17‐010/
Microsoft has released SMB patch update for unsupported Windows Versions ‐ XP, Vista, 8, Server 2003, 2008, etc. http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598
- If you are not infected then try out NoMoreCry CCN-CERT’s tool to prevent the execution of the ransomware WannaCry
This tool is available to all organisations that need to use it. It creates a mutex (mutual exclusion algorithm) on the computer that prevents the execution of the malicious code WannaCry 2.0. It is important to note that this tool is Not intended to clean compromised machines.
CCN-CERT indicates that the tool should be run after each restart. This process can be automated by modifying the Windows registry or through the implementation of the proper policies in the domain
This tool works on all versions of Windows.
CCN-CERT NoMoreCry Tool is located in CCN-CERT’s cloud, LORETO. In this location there is also available a complementary Script that prevents the execution of the malware on Windows computers in English and Spanish.
Further information on:
CCN-CERT NoMoreCry and script
https://loreto.ccn-cert.cni.es/index.php/s/tYxMah1T7x7FhND
CCN-CERT Press Release
https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/4464-ataque-masivo-de-ransomware-que-afecta-a-un-elevado-numero-de-organizaciones-espanolas.html
Generic Prevention Tools (As Recommended by Cert‐In) : Sophos: Hitman.Pro∙ https://www.hitmanpro.com/en‐us/surfright/alert.aspx Trendmicro Ransomware Screen Unlocker tool:∙ https://esupport.trendmicro.com/en‐us/home/pages/technical‐support/1105975.aspx Microsoft Enhanced mitigation and experience toolkit(EMET)∙ https://www.microsoft.com/en‐us/download/details.aspx?id=50766
If you have a viewpoint, best practice guide, guideline against Ransomware, this is the right time. reach out to us. Send in your writeup to expresscomputer.editor@expressindia.com