Video | Business Headlines | Internet | Science | Scientific Ethics | Technology | Search

 

What you need to know about the WannaCry Ransomware

Symantec Security Response – What you need to know about the WannaCry Ransomware

WannaCry ransomware spreads aggressively across networks, holds files to ransom.

What has happened?

On May 12, 2017 a new variant of the Ransom.CryptXXX family (Detected as Ransom.Wannacry) of ransomware began spreading widely impacting a large number of organisations, particularly in Europe.

What is the WannaCry ransomware?

WannaCry encrypts data files and ask users to pay a US$300 ransom in bitcoins. The ransom note indicates that the payment amount will be doubled after three days. If payment is not made after seven days, the encrypted files will be deleted.


Click for big version.

Figure 1 Ransom demand screen displayed by WannaCry Trojan

It also drops a file named !Please Read Me!.txt which contains the ransom note.


Click for big version.

Figure 2 Ransom demand note from WannaCry Trojan

Who is impacted?

A number of organisations globally have been affected, the majority of which are in Europe.

Is this a targeted attack?

No, this is not believed to be a targeted attack at this time. Ransomware campaigns are typically indiscriminate.

Why is it causing so many problems for organisations?

WannaCry has the ability to spread itself within corporate networks, without user interaction, by exploiting a known vulnerability in Microsoft Windows. Computers which do not have the latest Windows security updates applied are at risk of infection.

Can I recover the encrypted files?

Decryption is not available at this time but Symantec is investigating. Symantec does not recommend paying the ransom. Encrypted files should be restored from back-ups where possible.

What are best practices for protecting against ransomware?

· New ransomware variants appear on a regular basis. Always keep your security software up to date to protect yourself against them.

· Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by ransomware attackers.

· Email is one of the main infection methods. Be wary of unexpected emails especially if they contain links and/or attachments.

· Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email.

· Backing up important data is the single most effective way of combating ransomware infection. Attackers have leverage over their victims by encrypting valuable files and leaving them inaccessible. If the victim has backup copies, they can restore their files once the infection has been cleaned up. However organisations should ensure that back-ups are appropriately protected or stored off-line so that attackers can’t delete them.

· Using cloud services could help mitigate ransomware infection, since many retain previous versions of files, allowing you to “roll back” to the unencrypted form.

WannaCry encrypts files with the following extensions, appending .WCRY to the end of the file name:

123.3dm.3ds.3g2
.3gp.602.7z.ARC
.PAQ.accdb.aes.ai
.asc.asf.asm.asp
.avi.backup.bak.bat
.bmp.brd.bz2.cgm
.class.cmd.cpp.crt
.cs.csr.csv.db
.dbf.dch.der.dif
.dip.djvu.doc.docb
.docm.docx.dot.dotm
.dotx.dwg.edb.eml
.fla.flv.frm.gif
.gpg.gz.hwp.ibd
.iso.jar.java.jpeg
.jpg.js.jsp.key
.lay.lay6.ldf.m3u
.m4u.max.mdb.mdf
.mid.mkv.mml.mov
.mp3.mp4.mpeg.mpg
.msg.myd.myi.nef
.odb.odg.odp.ods
.odt.onetoc2.ost.otg
.otp.ots.ott.p12
.pas.pdf.pem.pfx
.php.pl.png.pot
.potm.potx.ppam.pps
.ppsm.ppsx.ppt.pptm
.pptx.ps1.psd.pst
.rar.raw.rb.rtf
.sch.sh.sldm.sldx
.slk.sln.snt.sql
.sqlite3.sqlitedb.stc.std
.sti.stw.suo.svg
.swf.sxc.sxd.sxi
.sxm.sxw.tar.tbk
.tgz.tif.tiff.txt
.uop.uot.vb.vbs
.vcd.vdi.vmdk.vmx
.vob.vsd.vsdx.wav
.wb2.wk1.wks.wma
.wmv.xlc.xlm.xls
.xlsb.xlsm.xlsx.xlt
.xltm.xltx.xlw.zip

It propagates to other computers by exploiting a known SMB remote code execution vulnerability in Microsoft Windows computers. (MS17-010)

Am I protected against this threat?

The Blue Coat Global Intelligence Network (GIN) provides automatic detection to all enabled products for web-based infection attempts.

Symantec and Norton customers are protected against WannaCry using a combination of technologies.

Antivirus

· Ransom.Wannacry

· Ransom.CryptXXX

· Trojan.Gen.8!Cloud

· Trojan.Gen.2

Customers should run LiveUpdate and verify that they have the following definition versions or later installed in order to ensure they have the most up-to-date protection:

· 20170512.009

SONAR protection

· SONAR behavior detection technology will also detect Wannacry variants.

Network based protection


© Scoop Media

 
 
 
 
 
Business Headlines | Sci-Tech Headlines

 

Skodafone Goneski: Sky TV, Vodafone Drop $3.44 Billion Merger Plan

Sky Network Television and Vodafone New Zealand have terminated their merger agreement which aimed to create the country's largest telecommunications and media group, and have withdrawn an appeal against the Commerce Commission's rejection of the plan. More>>

Quake Insurance: Reforms To EQC Act Announced

· Increasing the monetary cap from $100,000 (plus GST) to $150,000 (plus GST) for EQC building cover.
· Clarifying EQC land cover is for natural disaster damage that directly affects the insured residence or access to it... More>>

ALSO:

Reserve Bank: Official Cash Rate Unchanged At 1.75 Percent

Global economic growth has increased and become more broad-based. However, major challenges remain with on-going surplus capacity and extensive political uncertainty... More>>

Kaikōura Earthquake: Private Insurers Receive $1.8b Claims

Insurance Council Chief Executive Tim Grafton said most is for commercial loss at $1.36 billion, with residential claims amounting to over $460 million. “...We have a high level of confidence that most people will have received settlement offers by the end of this year." More>>

ALSO:

Forms And Data: New Proposals To Simplify Personal Income Tax

The Government is proposing to make tax simpler for individuals, with people whose only income is from a salary, wages or investments no longer being required to file tax returns to receive tax refunds or to calculate any additional tax. More>>