Category: Cloud Security

The WannaCry Ransom Attack

Earlier this month, hackers exploited a vulnerability in older Microsoft Windows servers to execute a global cyberattack using ransomware — a malicious software that holds your computer’s files hostage for ransom—as well as EternalBlue, a hacking tool stolen from the U.S. National Security Agency (NSA). EternalBlue is a network tool that can automatically spread itself across the Internet, scanning for vulnerable systems as it goes. The attackers used this tool to primarily target older Windows systems (including XP, Win 8, Win Server 2003) which were no longer being supported with security patches, but many new Windows machines were also affected.

This massive attack known as WannaCry completely locked victims out of their PCs. Victims then received ransom messages from the attackers that promised to restore each owner’s access if the owner paid $300 in the digital currency Bitcoin. If an owner refused to pay, the attackers threatened to destroy that owner’s files. The attack was reported to have infected more than 230,000 computers in over 150 countries, including 40 National Health Service trusts in the UK. While the initial attack has been contained, experts worry that the next wave of ransomware attacks could be even worse. Is your organization ready?

In this post, I will lay out common sense steps that organizations should take to protect themselves, as well as strategic security principles to guide you going forward.

What You Need to Do Right Now about WannaCry

If the worst has happened, and you had your data stolen by WannaCry attackers, there are now free tools available to help you decrypt your locked data (such as the EaseUs tool found here). If you have not already taken action to secure your systems from the existing WannaCry cryptoworm, here are the specific steps you should take:

1. Apply the Microsoft patch for the MS17-010 SMB vulnerability.
2. Perform a detailed vulnerability scan of all systems on your network and apply missing patches immediately.
3. Limit traffic from/to ports 139 and 445 to internal network only. Monitor traffic to these ports for unusual behavior.
4. Enable strong spam filters to prevent phishing e-mails from reaching end users, and authenticate in-bound e-mail using technologies like Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) to prevent email spoofing.
5. Scan all incoming and outgoing e-mails to detect threats and filter executable files from reaching your end users.
6. Ensure anti-virus and anti-malware solutions are set to automatically conduct regular scans. I recommend Norton and Sophos.
7. Manage the use of privileged accounts. Implement the principle of least privilege—no users should be assigned administrative access unless absolutely needed, and those with a need for administrator accounts should only use them when necessary. Configure access controls (including file, directory, and network share permissions) with the principle of least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.
8. Disable macro scripts from Microsoft Office files transmitted via e-mail. Consider using Office Viewer software to open Microsoft Office files transmitted via e-mail instead of full Office suite applications.

The Long-Term Implications of WannaCry and Ransomware

While the aforementioned steps will help protect your systems from ransomware and other malware attacks, we do not know what the next major attack will look like. Even the latest patches and security products will only block old and known variants of malware like Wanna—and new variants appear all the time. Making matters worse, some variants of ransomware can enter your systems via your RAM or firmware in order to avoid antivirus detection. This in mind, here are strategic best practices to keep your organization safe.

Back Up Your Data

Having reliable backups is essential for business continuity, especially if you work with PHI or other sensitive healthcare data. In some ransomware attacks, criminals will delete your files even if you pay their ransom. Reliable backups will also protect you from nonsecurity disruptions like unexpected damage to a data center.  

As you back up your data, be sure to create frequent backups to several disconnected servers; this will protect you from malware that spreads across networks. It is also important to regularly test the integrity of your backup data to ensure it will meet your needs after you restore it. Finally, I recommend you set up an enterprise endpoint backup tool to protect individual user data on their laptops and workstations.

Identify Sensitive Systems and Potential Vulnerabilities

You might not be able to predict the next major attack, but you can prepare your systems by finding and protecting potential weak spots. For example, identify any of your users’ storage locations that are inherently vulnerable, such as file shares. It is also important to monitor the integrity of your module, as this has become a popular attack surface for cyber criminals.

As you examine how data flows throughout your network, be sure to evaluate the potential business impact of that data being stolen or encrypted by a cyberattack. If certain data or systems are especially critical to your business, adjust your recovery point objectives to back up these systems more frequently.

Have a Dedicated Security Team

As your organization grows, the stakes of your information security will continue to elevate. The best way to stay ahead of cyberattacks is to create a dedicated security team ready to manage any crisis you face. Ideally, this team would include an applications expert, a network security engineer, and an analyst who can keep up with the latest data security trends.

Once you have this team in place, it is also smart to align this information security team with your IT disaster recovery team and network team in order to develop a cross-department plan to respond to security incidents like the WannaCry attack. This cross-department plan should focus on making you resilient to attacks, not just preventing them altogether.

Get Smart on Ransomware with the Latest Security Information

Now that Verizon has released their yearly Data Breach Investigations Report, we have a host of new information about security breaches that could lead to your data being compromised. However, this lengthy report is only one part of the information security puzzle. In my upcoming webinar on July 12, I will discuss the long term implications of the WannaCry attack as well as best practices to help your organization protect itself from ransomware and other cyberattacks.

Learning from WannaCry – The Long-Term Implications

• Presenter : Ulf Mattsson, CTO Atlantic BT Security
• Duration : 60 min
• Date & Time : July 12 2017 12:00 pm EST

UPDATE: Watch my other recorded webinar on Learning from Verizon 2017 Data Breach Investigations Report

Get Help From The Experts – Have Your Cybersecurity Evaluated Today

Imagine you lived in a luxury high-rise apartment. Chances are, you’d have things inside that home that are valuable to you (computers, TVs, jewelry, and the like)—not to mention your pets and family. Thankfully, your home is protected by an experienced doorman who never lets anyone in who doesn’t have your permission.

Sounds secure—as long as an intruder couldn’t bypass the permission process. Unfortunately that’s exactly what’s happening with the Linux Dirty COW vulnerability. And to make matters worse, this risk has been present for more than nine years—so if you’re using any recent version of Linux or Android, you need to act now.

What We Mean by Dirty COW

Linux uses a Change on Write (or COW) approach to reduce unneeded duplication of memory objects. This works in conjunction with Linux’s Discretionary Access Controls to decide which users get read-only privileges or read-write privileges. However, this permissions framework can be bypassed if a cyber attacker manipulates the COW mechanism to alter read-only memory objects on the system.

While this requires a payload to be installed and executed on the server, this COW exploit allows the attacker to modify and replace a secure command restricted to non-privileged users with a command that could provide root access to the entire system. Because the COW element is what’s been compromised, this attack is known as a Dirty COW. This vulnerability affects anyone using a version of Linux or Android released in the last decade—which includes millions of web servers.

Now for the good news: there is a fix available. This patch will likely require a full reboot of your system (unless you have a special live-patch solution in place), so it’s crucial your IT team has a plan in place based on security and continuity best practices. However (and this is a big however), this vulnerability represents a major wake-up call for any organization that depends on interconnected web based systems—it’s time to get serious about your security if you want your business to survive.

Get Serious about Web Security

As web systems become more complex and interconnected, it’s always safe to assume that new vulnerabilities will emerge. What’s noteworthy in this case is the Dirty COW vulnerability is baked into the Linux system as opposed to being a completely external attack. This suggests application developers should no longer trust the integrity of a host server or kernel; instead, they should work to develop applications that protect themselves from attacks on the kernel.

This makes it even more important to know that your web developers and hosting team are experts in IT security. You need a comprehensive security strategy that keeps attackers as far away as possible from executing arbitrary code on your systems. Before any attackers get close, they should have to first defeat your network firewalls, your intrusion prevention systems, your web filters, and the RBAC protections around your daemons.

In short, it’s time for you to get serious about web security. If you’d like advice from our security experts, feel free to reach out to us on our contact page.