Linked Questions

26 votes
3 answers
37k views

Does WannaCry infect Linux? [duplicate]

After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu. One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is ...
rajab's user avatar
  • 279
1 vote
1 answer
1k views

How can we beef the security of our Windows Server 2012 R2 against ransomware? [duplicate]

We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware. We did install the latest ...
Ludisposed's user avatar
-2 votes
2 answers
302 views

is there any solution for wannacry? [duplicate]

"wanna cry" encrypt our data within a minute. So how can they do it that much faster speed on network?? Is my file encrypted by "wanna cry" then any way to decrypt my file without sending bitcoins to ...
Jayesh Dengada's user avatar
15 votes
4 answers
6k views

Has anybody successfully decrypted their files after paying the WannaCrypt ransom?

WannaCrypt is a shot heard 'round the world, for sure. I have seen news articles saying that people have paid more than $20,000 in ransoms. Here's one from Krebs: Global ‘Wana’ Ransomware Outbreak ...
SDsolar's user avatar
  • 977
5 votes
4 answers
26k views

Find SMBv1 status with Nmap

Is there a ready way with nmap's scripting option to find machines with SMB 1 still enabled server side? It'd be a whole lot faster for me to monitor my remediation if it is available. I'd rather ...
Tim Brigham's user avatar
  • 3,792
9 votes
3 answers
16k views

Is it risky to allow SMB traffic to the Internet

SMB is a well-known network file sharing protocol, and I assume it's supposed to be used internally only. At my company I found someone connecting to a share on a server on the Internet over port 445 ...
expertsnipo's user avatar
1 vote
5 answers
17k views

Will Running MEMZ or Wanna Cry in VirtualBox Harm Host Computer?

I have read some threads talking about the safety of running malware in a VM. I found out that it may not be safe and there is still a risk. I would like to know specifically if running Wanna Cry, a ...
Elliot King's user avatar
1 vote
3 answers
1k views

What do emails have to do with the spread of WannaCrypt?

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them. But the malware is spreading as a worm using SMB to infect other ...
SDsolar's user avatar
  • 977
9 votes
2 answers
2k views

What harm is there in obtaining password hashes in a Windows environment?

ArsTechnica posted this article recently talking about how the power grid has been penetrated: Hackers lie in wait after penetrating US and Europe power grid networks Excerpt: One tactic involved ...
SDsolar's user avatar
  • 977
5 votes
2 answers
608 views

Does EMET prevent WannaCry exploit execution?

Based on answers to the question How is the “WannaCry” Malware spreading (...), I understand it leverages vulnerabilities present in the SMB implementation. Assuming an unpatched and otherwise ...
Marc.2377's user avatar
  • 594
2 votes
1 answer
2k views

WannaCry - block callback IP/domain?

While new variants of Wannacry has sprung up, the old variant is still lurking around corners and I am not sure whether the following callback IPs and domains should be blocked as per typical ...
George's user avatar
  • 739
2 votes
1 answer
915 views

Is WannaCry Proxy Aware?

I read the Article of WannaCry on malwaretech.com and as far I understand it works like this: Try to connect via HTTP to www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com if it got an response then ...
Serverfrog's user avatar
-9 votes
2 answers
525 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
SDsolar's user avatar
  • 977
0 votes
2 answers
271 views

Will my 445 port still exposed when I connect a windows machine to my android phone's hotspot/tethering nerwork?

From 2016.05.12, the EternalBlue exploit attacks the 445 port vulnerability in windows systems worldwide, Will my 445 port still exposed if I connect windows machine to the Internet by an android ...
user148208's user avatar