9

Our environment has a few Windows 2012 R2 servers which is already patched against the WannaCry ransomware. The update installed was KB4012213.

  • Is this good enough to protect against the ongoing Petya attacks?
  • Anything else we should be doing other than disabling SMB service if unused?
  • Does it spread itself through networked computers without user intervention?
9

Making sure that SMBv1 is disabled is a good start to protecting against the Ethernalblue exploit.

The malware also uses the WMIC and PSEXEC tools to infect machines that are fully-patched Windows computers. Disabling WMIC is advised see here on how to disable WMIC: https://msdn.microsoft.com/enus/library/aa826517(v=vs.85).aspx

I have also seen people saying to block remote use of local accounts via GPO but I have not seen too much on that yet.

There are also reports saying that paying the ransom will not reward you with the decryption key as the email that is used has since been blocked.

There have also just been some reports that if you power off the machine right as the message appears than it will not encrypt the files. https://twitter.com/hackerfantastic/status/879775570766245888

UPDATE: There seems to now be a kill switch found to stop the attack all you have to do is create a folder C:\Windows\perfc

https://twitter.com/TheHackersNews/status/879782531146461185

2

To protect yourself from Petya virus:

Create a file perfc.dll

At the time of attack, Petya looks for file C:\Windows\perfc.dll. If such a file on the computer already exists, then virus finishes work without infection.

To create such a file to protect against Petya, you can use the usual "Notepad". Experts also advise making the file read-only so that the virus can not make any changes to it.

Install security patches

The virus also spreads through the vulnerabilities of Windows CVE-2017-0199 and CVE-2017-0144. It is recommended to install security patches that close them:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144

We need to install security patches not only for Windows, but also for Microsoft Office.

It is also necessary to install patches that cover the previously exploited vulnerability for WannaCry:

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Update antivirus signatures

Antivirus software signatures database should be updated from June 27, 2017 not earlier than 20:00.

Block resources

The virus uses the following addresses, you should block access to them:

— 84.200.16[.]242
— 84.200.16[.]242/myguy.xls 
— french-cooking[.]com/myguy.exe
— 111.90.139[.]247
— COFFEINOFFICE[.]XYZ

Important! The dots are set for security reason. Do not click on the links. These addresses are published to block them manually.

Disable TCP ports

If the network already has infected workstations or servers, you must disable TCP ports 1024-1035, 139 and 445.

Disable SMB protocol

If you can not install security updates, disable the SMB v1 / v2 / v3 protocol on workstations and servers.

Read more: https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and-windows

Configure attack blocking

In the case of NGFW / NGTP / IPS security features, configure blocking of attacks exploiting EternalBlue (MS17-010).

  • port 139 and not 135 (port 135 being the name exchange it doesn't accept payloads out of strict format). Any source for perfc.dll ? None of the security advice recomend to create a file with extension but a perfc file with no extension (didn't found a detailled explanation of this kill-switch yet). – Tensibai Jun 28 '17 at 14:05
  • @Tensibai It is recommended that a kill switch with an extension .dll (perhaps this is due to one of the versions of Petya virus). – Dmitry Maslennikov Jun 28 '17 at 14:07
  • @Tensibai Information on port 139 corrected – Dmitry Maslennikov Jun 28 '17 at 14:10
  • 1
    From this gist where this script is linked the main idea is to prevent the malware to create itself, as such creating perfc, perfc.dat and perfc.dll (just to add my latest informations) – Tensibai Jun 28 '17 at 14:42
  • 1
    @Tensibai Yes, I think the virus has several versions and in later versions the kill switch has been disabled. – Dmitry Maslennikov Jun 28 '17 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.