Are machines patched against WannaCry protected against the ongoing Petya attacks?

Question

Our environment has a few Windows 2012 R2 servers which is already patched against the WannaCry ransomware. The update installed was KB4012213.

• Is this good enough to protect against the ongoing Petya attacks?
• Anything else we should be doing other than disabling SMB service if unused?
• Does it spread itself through networked computers without user intervention?

Answer 1

Making sure that SMBv1 is disabled is a good start to protecting against the Ethernalblue exploit.

The malware also uses the WMIC and PSEXEC tools to infect machines that are fully-patched Windows computers. Disabling WMIC is advised see here on how to disable WMIC: https://msdn.microsoft.com/enus/library/aa826517(v=vs.85).aspx

I have also seen people saying to block remote use of local accounts via GPO but I have not seen too much on that yet.

There are also reports saying that paying the ransom will not reward you with the decryption key as the email that is used has since been blocked.

There have also just been some reports that if you power off the machine right as the message appears than it will not encrypt the files. https://twitter.com/hackerfantastic/status/879775570766245888

UPDATE: There seems to now be a kill switch found to stop the attack all you have to do is create a folder C:\Windows\perfc

https://twitter.com/TheHackersNews/status/879782531146461185

Answer 2

To protect yourself from Petya virus:

Create a file perfc.dll

At the time of attack, Petya looks for file C:\Windows\perfc.dll. If such a file on the computer already exists, then virus finishes work without infection.

To create such a file to protect against Petya, you can use the usual "Notepad". Experts also advise making the file read-only so that the virus can not make any changes to it.

Install security patches

The virus also spreads through the vulnerabilities of Windows CVE-2017-0199 and CVE-2017-0144. It is recommended to install security patches that close them:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144

We need to install security patches not only for Windows, but also for Microsoft Office.

It is also necessary to install patches that cover the previously exploited vulnerability for WannaCry:

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Update antivirus signatures

Antivirus software signatures database should be updated from June 27, 2017 not earlier than 20:00.

Block resources

The virus uses the following addresses, you should block access to them:

— 84.200.16[.]242
— 84.200.16[.]242/myguy.xls 
— french-cooking[.]com/myguy.exe
— 111.90.139[.]247
— COFFEINOFFICE[.]XYZ

Important! The dots are set for security reason. Do not click on the links. These addresses are published to block them manually.

Disable TCP ports

If the network already has infected workstations or servers, you must disable TCP ports 1024-1035, 139 and 445.

Disable SMB protocol

If you can not install security updates, disable the SMB v1 / v2 / v3 protocol on workstations and servers.

Read more: https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and-windows

Configure attack blocking

In the case of NGFW / NGTP / IPS security features, configure blocking of attacks exploiting EternalBlue (MS17-010).