[3rd Update]WCry ransomwsre has possible links to Lazarus Group & PRNK

[goodtofufriday]

Currently EVERY IT admin in the world (myself included)

 

 

And when someone gets hit 

 

[samcool55]

1 minute ago, Tech_Dreamer said:

Having second thoughts about disabling updates now aren't you 

Yeah, i have! I have updates disabled on the laptop i'm currently using because i can't afford it to randomly start installing updates when i'm shutting it down at the end of class. Luckily i updated it during the least 2-week break so i'm safe.

 

Also i updated it immediately after seeing this even tho i should have been safe anyway

[Prysin]

incase it wasnt clear yet.

 

https://twitter.com/wikileaks/status/863122677820731393

[Master Disaster]

I'm really interested to hear from

@LinusTech

@Slick

@nicklmg

 

Is LMGs rack unaffected? Are you guys safe from this?

[Master Disaster]

3 minutes ago, Prysin said:

incase it wasnt clear yet.

 

https://twitter.com/wikileaks/status/863122677820731393

So basically "we didn't make this, we just showed everyone how to use it"

[vanished]

13 minutes ago, NumLock21 said:

That would be indeed scray, but most backup should be done on tape drives not SSD or HDD

There's lots of things that "should" be done, and if they had been, we wouldn't be talking about this story right now.

[Master Disaster]

6 minutes ago, Ryan_Vickers said:

There's lots of things that "should" be done, and if they had been, we wouldn't be talking about this story right now.

When would you say would be the right time for MS to do the "still think forced updates are a bad idea" press conference?

[vanished]

1 minute ago, Master Disaster said:

When would you say would be the right time for MS to do the "still think forced updates are a bad idea" press conference?

I wasn't thinking about that, but I suspect they won't do that, at least not immediately.  "too soon", you know?  

[TAHIRMIA]

I think they did apparently patch this in march

[NumLock21]

10 minutes ago, Ryan_Vickers said:

There's lots of things that "should" be done, and if they had been, we wouldn't be talking about this story right now.

Backup should be done at regular intervals, Did backup a week ago before got infected, then it's just a week of lost data, instead of the beginning of time.

[vanished]

Just now, NumLock21 said:

Backup should be done at regular intervals, Did backup a week ago before got infected, then it's just a week of lost data, instead of the beginning of time.

You hope they have a good backup solution at bare minimum.  But that's like hoping the program/game has a good auto-save feature as opposed to actually being reliable.  I'm saying there are many things that could have been done to avoid this, including but not limited to having a good quality system in place at NHS that wasn't vulnerable.

[Master Disaster]

7 minutes ago, Ryan_Vickers said:

I wasn't thinking about that, but I suspect they won't do that, at least not immediately.  "too soon", you know?  

 

6 minutes ago, TAHIRMIA said:

I think they did apparently patch this in march

Yeah they did, I think the main issue is most of the affected systems would come under Microsoft's corporate edition target rather than consumer edition and in these cases updates are normally handled by internal admins anyway. Forced updates wouldn't be relevant.

[vanished]

Just now, Master Disaster said:

 

Yeah they did, I think the main issue is most of the affected systems would come under Microsoft's corporate edition target rather than consumer edition and in these cases updates are normally handled by internal admins anyway. Forced updates wouldn't be relative.

I think you mean relevant, but yes, I agree

[ESPImperium]

This is freaking scary. My dad is getting his second blood test results on Monday and if our doctors are hit, we may not get them.

 

However, as someone who works for a major UK supermarket, our systems have venerability in them, we run with Windows 2000 and 7 32bit across 2 server systems. I am worried that one day we will be affected and will have to shut for unknown lengths of time.

 

I have spent most of the night explaining to my Dad what things mean, and will do so tomorrow at work I think to the folk who don't know computer speak.

[Master Disaster]

Just now, Ryan_Vickers said:

I think you mean relevant, but yes, I agree

Indeed I do, I'm a little drunk right now so I apologise.

[BuckGup]

26 minutes ago, samcool55 said:

They almost have 100 bitcoins already, damn.

Also it's still growing, infecting 80-100 pc's per minute.

https://intel.malwaretech.com/botnet/wcrypt

That's usually how ransomware works. You set an amount depending on your victim. $30 for personal and for large companies in the thousands. But with a wide spread attack setting a low ball of $300 doesn't seem bad at all for a company. Well multiply it by thousands and there you go.

[NumLock21]

32 minutes ago, goodtofufriday said:

Currently EVERY IT admin in the world (myself included)

 

 

And when someone gets hit 

 

pulling the power cord will be faster and no need to redo all the network cables.

[goodtofufriday]

1 minute ago, NumLock21 said:

pulling the power cord will be faster and no need to redo all the network cables.

I panicked 

[NumLock21]

1 minute ago, goodtofufriday said:

I panicked 

I wonder if anyone has literally try to cut that much cables in 1 go.  Probably need a giant cutting pliers.

 

[2FA]

48 minutes ago, NumLock21 said:

Depends on the backup. If it's connected the there is a chance its infected too. Only safe backup is a offline backup, that means it's never physically connected to the system, when the infection occurred.

It actually depends on the user account that got infected since ransomware really only use exploits for the initial infection onto a network (the grand majority at least, especially non-targeted ones). Whatever the user has write access to, the virus will encrypt. 

[ashypanda]

2 minutes ago, NumLock21 said:

pulling the power cord will be faster and no need to redo all the network cables.

pulling the power cord might not work just as the systems affected would be on UPS's, pouring gas on them and torching them might be more effective.

[Mira Yurizaki]

So other than a vulnerability in Windows that was patched last month that was exploited by NSA/CIA malware, is there any thing else we know about that can mitigate infection?

[Bananasplit_00]

great... because buissnises dont update their shit we might get harder laws on the net... yay

[2FA]

1 minute ago, M.Yurizaki said:

So other than a vulnerability in Windows that was patched last month that was exploited by NSA/CIA malware, is there any thing else we know about that can mitigate infection?

MS is the greater evil, we don't need those patches... kappa

[goodtofufriday]

4 minutes ago, NumLock21 said:

I wonder if anyone has literally try to cut that much cables in 1 go.  Probably need a giant cutting pliers.

 

 

Every IT Admin should have one in the closet just in case