3

One of the computers in my office has been compromised by Cryptolocker. Once informed, my immediate response was to disconnect the computer from the network - though there was a period of a few hours in which I was not aware of the issue.

The infected computer was connected to a NAS drive, as well as multiple computers on the network. The NAS drive is publicly accessible, and some of the files therein were encrypted. The computers require separate access credentials, and do not appear to have been infected.

In this situation, are the other computers currently at risk of being infected? How exactly does Cryptolocker (or similar ransomware) propagate through networks? Could something have been done to better secure the NAS drive?

Improve this question
7
  • 1
    A search for "cryptolocker propagation" returns many results (tomsguide.com/us/cryptolocker-evolves-worm,news-18066.html). It will be impossible for us to guess what variant you have.
    – schroeder ♦
    Sep 16, 2015 at 19:55
  • 1
    Cryptolocker will scan for attached and mapped network shares and encrypt the files in them, but wont propagate through the local network, as far as I know. Cryptolocker's infection vector are compromised websites (which may host exploit kits), malicious email attachments and malicious ads. Are you sure its cryptolocker that infected you? There are a handfull of ransomewares out in wild. No network shares should have full permission for all users.
    – Nikhil_CV
    Sep 16, 2015 at 19:56
  • 2
    @Nikhil_CV yes, newer variants self-propagate.
    – schroeder ♦
    Sep 16, 2015 at 19:58
  • 2
    @Nikhil_CV - did you read the Tom's Guide link in Schroeder's comment? From first sentence "...it's evolved from a Trojan into a worm."
    – Neil Smithline
    Sep 16, 2015 at 20:01
  • 1
    I would suggest tools like [Cryptoprevent](foolishit.com/cryptoprevent-malware-prevention ) or [Cryptomonitor](easysyncsolutions.com/CryptoMonitorDetails ) for preventing such incidents in future.
    – Nikhil_CV
    Sep 16, 2015 at 20:05

1 Answer 1

Reset to default
3

To answer the NAS portion of the question: the typical CryptoLocker behaviour is to crawl all connected drives (local and network mapped drives), which would include a connected NAS.

Protect the NAS by:

  1. Not keeping it mounted
  2. Backups that you can restore even if the entire NAS gets compromised
Improve this answer
1
  • 1
    Also, Least Privilege.
    – Iszi
    Sep 16, 2015 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.