Security Alert – Another Massive New Ransomware Outbreak 28-06-2017

A major cyber attack swept through countries across the world , affecting Indian operation of global companies operation at one of terminals of Jawaharlal Nehru Port trust in Mumbai had to be shut down following the Ransomware attack ( Petya ransomware)

It has been reported that variants of Petya ransomware is spreading quickly by leveraging the EternalBlue Exploit targeting Windows SMB
file sharing protocol.

 

In order to prevent infection, users and organizations are advised to apply patches to Windows systems and abide with following advisories

  • Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally,this data should be kept on a separate device, and backups should be stored offline.
  • Block SMB ports on Enterprise Edge/perimeter network devices [UDP 137, 138 and TCP 139, 445] or Disable SMBv1. Block all Access to USB ports.
  • Don’t open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly through browser.
  • Establish a Sender Policy Framework (SPF),Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified.
  • Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
  • Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations. Enforce applicationwhitelisting on all endpoint workstations.
  • Deploy web and email filters on the network. Configure these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.
  • Disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running.
  • Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.
  • Maintain updated Antivirus software on all systems.
  • Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
  • Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
  • Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
  • Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
  • Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
  • Network segmentation and segregation into security zones-help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
  • Disable remote Desktop Connections, employ least-privileged accounts.
  • Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems, Check regularly for the integrity of the information stored in the databases.
  • Restrict user’s abilities (permissions) to install and run unwanted software applications.
  • Employ data-at-rest and data-in-transit encryption.
  • Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to Law Enforcement agencies.

112 comments

  1. I have to get across my affection for your kindness supporting women who actually need help on the subject. Your real dedication to getting the message all-around became extremely good and has specifically empowered those much like me to arrive at their aims. Your insightful facts denotes a lot to me and extremely more to my office colleagues. Best wishes; from all of us.

  2. I needed to draft you this very small observation to say thanks a lot the moment again for your stunning thoughts you’ve shown in this case. This is quite wonderfully open-handed of people like you to make unreservedly exactly what most people would have offered as an e book to make some bucks on their own, specifically since you might have done it if you desired. Those principles as well served to become a easy way to recognize that other people online have similar zeal the same as mine to find out much more in terms of this issue. I’m sure there are millions of more pleasurable instances ahead for many who read through your blog.

  3. I enjoy you because of your whole work on this web page. Gloria really loves doing internet research and it’s really simple to grasp why. My spouse and i hear all relating to the lively means you produce very helpful guidelines via your web site and as well strongly encourage contribution from others on this subject while our own princess is always discovering a whole lot. Enjoy the rest of the year. You have been conducting a really great job.

  4. I would like to convey my affection for your kind-heartedness giving support to those people that really need help on this particular concern. Your very own dedication to getting the solution all around has been astonishingly practical and have regularly permitted most people much like me to achieve their pursuits. This helpful guide entails a whole lot to me and a whole lot more to my office workers. Thanks a ton; from everyone of us.

Comments are closed.