All Questions
16 questions
251
votes
10
answers
83k
views
How is the "WannaCry" Malware spreading and how should users defend themselves from it?
There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names.
It ...
- 62.6k
63
votes
3
answers
16k
views
What happens if you run WannaCry after installing the necessary patches?
I understand that WannaCry spreads itself by exploiting the SMBv1 vulnerability, which is fixed by patch MS17-010.
Does this mean that even with the patch installed, WannaCry can still infect the ...
- 647
26
votes
3
answers
37k
views
Does WannaCry infect Linux? [duplicate]
After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu.
One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is ...
- 279
5
votes
1
answer
2k
views
How to reverse engineer WannaCry? [closed]
I was reading an article today about a Google researcher linking the WannaCry malware to the earlier malware Cantopee.
I had two primary questions based on the contents of the article.
What do the ...
- 153
5
votes
2
answers
615
views
Does EMET prevent WannaCry exploit execution?
Based on answers to the question How is the “WannaCry” Malware spreading (...), I understand it leverages vulnerabilities present in the SMB implementation. Assuming an unpatched and otherwise ...
- 594
5
votes
2
answers
717
views
Are we safe from infection of Bad Rabbit?
I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
- 739
4
votes
1
answer
1k
views
How can Malware authors be determined? [duplicate]
My question is:
How can we make any conclusions about malware authors at all, when anyone could just get sample malware online, copy paste the parts they like, and add their own parts to it?
...
- 1,595
2
votes
2
answers
1k
views
Can the new WannaCry affect Linux ext4 file system data from Windows?
So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system....
user152282
2
votes
1
answer
2k
views
WannaCry - block callback IP/domain?
While new variants of Wannacry has sprung up, the old variant is still lurking around corners and I am not sure whether the following callback IPs and domains should be blocked as per typical ...
- 739
2
votes
1
answer
310
views
Wannacry testing in lab - Not getting SMB scan attempts
So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is ...
2
votes
1
answer
383
views
How does WannaCrypt detect when someone pays the ransom?
It seems they are processing it manually, but how can they verify the payment? WannaCry doesn't provide a unique ransom bitcoin adress for each victim.
- 123
1
vote
3
answers
1k
views
What do emails have to do with the spread of WannaCrypt?
After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them.
But the malware is spreading as a worm using SMB to infect other ...
- 977
1
vote
1
answer
1k
views
How can we beef the security of our Windows Server 2012 R2 against ransomware? [duplicate]
We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware.
We did install the latest ...
- 848
1
vote
5
answers
18k
views
Will Running MEMZ or Wanna Cry in VirtualBox Harm Host Computer?
I have read some threads talking about the safety of running malware in a VM. I found out that it may not be safe and there is still a risk. I would like to know specifically if running Wanna Cry, a ...
- 13
1
vote
2
answers
283
views
Would it be possible and advisable to create a worm to patch for WannaCrypt?
WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it.
Our worm infects a computer ...
- 123
1
vote
1
answer
256
views
How is Malware Traced to a Specific Country? [duplicate]
Following the WannaCry malware being traced to North Korea, how is the malware traced to a specific country?
How I think this could be done:
Malware is reverse engineered to find IP addresses or ...
- 2,764