[RESOLVED] WannaCry

[tthurman]

WannaCry is ransomware with a worm, and it's on the loose.

http://www.reuters.com/article/us-britain-security-hospitals-ransomware-idUSKBN1882O2?il=0

<edit>

Apparently this was stopped in it's tracks, no more than I had revived the email alert, it was pretty much old news, and over.  Looked like a nasty one though!

[tthurman]

WOW

http://bgr.com/2017/05/13/ransomware-wannacry-cyber-attack-kill-switch/

 

[tthurman]

Might as well put something useful in this post.

 

If you don't regularly update you may want to check this:

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

 

Tools other ransomware removal:

https://noransom.kaspersky.com/

 

[Adultery]

That's crazy! Funny how a small exit condition can ruin all those hours of hard work, huh hacker community?

Just another reason why it's a good idea to keep that machine updated. Just let it do its thing on patch Tuesday.

[tthurman]

never say never LOL

 

https://www.theverge.com/2017/5/13/15635006/microsoft-windows-xp-security-patch-wannacry-ransomware-attack

would be scary to know all of what out there is still running on XP Pro.

[Adultery]

They did drop a couple big names there, FedEx was the one that probably surprised me the most.

I certainly have an XP VM, but I only use rarely. Looks like it'll be even more rarely now.

[Draco1962]

XP is totally safe so long as it isn't allowed to connect to the internet.

[tthurman]

8 hours ago, Adultery said:

They did drop a couple big names there, FedEx was the one that probably surprised me the most.

Yeah, just got an email from FedEx about service disruption....pretty amazing!  I was running some instances on VM's, but XP combined with Java in a VM is instant fail....well for my application it was anyhow.

[stigzler]

lol @ the "[Resolved]" status.

[tthurman]

While perhaps not for everyone, it does seem that the kill switch resolved a worldwide spread of this.  I bet this is the last time something that obvious is left in the source code.

[ClassicGMR]

The concern now is a newer release from the same coder without the back door programmed in or a copycat who makes it worse.

[tthurman]

On 5/13/2017 at 1:04 PM, Adultery said:

Just another reason why it's a good idea to keep that machine updated. Just let it do its thing on patch Tuesday.

Well given this was a backdoor left open for "certain" particularly nosy departments, the best we can do is follow Adultery's advice by keeping things patched when microsoft realizes there's a leak.  The best solution; nope, but it's all we currently have.....so it seems!

 

[Adultery]

Funny twist to the story... The kid that stopped the threat that would have crippled millions of computers just got picked up by the FBI today in Las Vegas for some other hacking incident before he started working"for good".

Way to go America! Fill those prisons up!! Lol!

 http://www.reuters.com/article/us-usa-cyber-arrest-idUSKBN1AJ2IC