While the last ransom attack -WannaCry- Shook the world some forensic and malware analysis provided some help to stop the disaster or to slow it down. While reading Matt Suiche blog, he mentioned that you should not reboot the system. As a simple user or a sysadmin, how should I response when such attack happen during my watch to prevent more infected computers and to incise the chance to restore lost data? (paying the ransom is not an option.) And is there any way to make a dump of the infected os memory to analyse it when suck too ( like the one above) will be available hopping that encrypted files could be restored ?
1
-
2Seems like the appropriate response would depend on how valuable/urgent the lost data was. In some cases, people might not even care. For people who cared a bit but don't have urgency, might hold onto the ransomed drive in hopes of the cryption method being broken, the criminals' server being apprehended, or some other workaround (like undeleting the original copies of the files if the ransomware didn't write over it).– NatCommented May 28, 2017 at 1:49
Add a comment
|
1 Answer
With WannaCry specifically, there is a known bug in current strains in the wild where the authors don't clear data that allows recovery of keys that allow for decryption of encrypted files. The blog you link recommends not rebooting because that would clear the contents of memory, thus preventing you from exploiting this flaw to decrypt your files without paying.
Besides keeping your systems up to date on patches, the best strategy for mitigating a ransomeware threat is maintaining backups of user data so that if the worse happens, very little data is permanently lost. You can attempt to decrease the likelihood of infection through user education and AV solutions, but these should not be relied upon as a sole defense. For systems that must remain up at all times, establish a disaster scenario for them being knocked offline by ransomware (or any other attack for that matter).
Also important to note is that by the time you've been hit by ransomeware, there will already be thousands of people attempting to reverse engineer it and find ways of stopping it and fixing any damage it may have caused. Keep an eye on these developments, because like with WannaCry, researchers may find cracks that will allow you to fully recover encrypted files or defend yourself against further infection.
