Skip to Content.
Sympa Menu

permaculture - [permaculture] Virus Akert: WannaCry virus (ransmware), possible new attack today (Monday), security measures to take (links below in message)

permaculture@lists.ibiblio.org

Subject: permaculture

List archive

Chronological Thread  
  • From: Lawrence London <lfljvenaura@gmail.com>
  • To: permaculture <permaculture@lists.ibiblio.org>
  • Subject: [permaculture] Virus Akert: WannaCry virus (ransmware), possible new attack today (Monday), security measures to take (links below in message)
  • Date: Mon, 15 May 2017 04:43:23 -0400

Virus Akert: WannaCry virus (ransmware), possible new attack today
(Monday), security measures to take (links below in message)
1) Be careful what links you click on and unplug all computers you don't
need to be online
2) I followed a Google News link to an article in Fortune magazine which
diractly linked to Microsoft's page
for security patches for various versions of Windows. They are providing
support for versions that are no longer supported by Microsoft

Here is the link to the Fortune magazine article:
Microsoft Windows Now Patched Against WannaCry Ransomware Attack
http://fortune.com/2017/05/13/wannacry-ransomware-microsoft-windows-patch/
The WannaCry ransomware that swept the globe on Friday has proven so
malicious that Microsoft <http://fortune.com/fortune500/microsoft-25/> has
issued patches for Windows versions dating back as far as 14 years.Late
Friday, emergency security updates were released for Windows XP, Windows 8,
and Windows Server 2003. Links to the updates can be found in Microsoft's
announcement
<https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/>
.
See below:
Customer Guidance for WannaCrypt attacks
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

Details are below.

- In March, we released a security update which addresses the
vulnerability that these attacks are exploiting. Those who have Windows
Update enabled are protected against attacks on this vulnerability. For
those organizations who have not yet applied the security update, we
suggest you immediately deploy Microsoft Security Bulletin MS17-010
<https://technet.microsoft.com/en-us/library/security/ms17-010.aspx>*.*
- For customers using Windows Defender, we released an update earlier
today which detects this threat as Ransom:Win32/WannaCrypt

<https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt>.
As an additional “defense-in-depth” measure, keep up-to-date anti-malware
software installed on your machines. Customers running anti-malware
software from any number of security companies can confirm with their
provider, that they are protected.
- This attack type may evolve over time, so any additional
defense-in-depth strategies will provide additional protections. (For
example, to further protect against SMBv1 attacks
<https://aka.ms/disablesmb1>, customers should consider blocking legacy
protocols on their networks).

We also know that some of our customers are running versions of Windows
that no longer receive mainstream support. That means those customers will
not have received the above mentioned Security Update released in March.
Given the potential impact to customers and their businesses, we made the
decision to make the Security Update for platforms in custom support only,
Windows XP, Windows 8, and Windows Server 2003, broadly available for
download (see links below).

Customers who are running supported versions of the operating system
(Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2,
Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2,
Windows Server 2016) will have received the security update MS17-010 in
March. If customers have automatic updates enabled or have installed the
update, they are protected. For other customers, we encourage them to
install the update as soon as possible.

This decision was made based on an assessment of this situation, with the
principle of protecting our customer ecosystem overall, firmly in mind.

Some of the observed attacks use common phishing tactics including
malicious attachments. Customers should use vigilance when opening
documents from untrusted or unknown sources. For Office 365 customers we
are continually monitoring and updating to protect against these kinds of
threats including Ransom:Win32/WannaCrypt. More information on the malware
itself is available from the Microsoft Malware Protection Center on the
Windows
Security blog
<https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/>.
For
those new to the Microsoft Malware Protection Center, this is a technical
discussion focused on providing the IT Security Professional with
information to help further protect systems.

<....>

Further resources:

Download English language security updates: Windows Server 2003 SP2 x64
<http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe>,
Windows Server 2003 SP2 x86,
<http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x86-custom-enu_f617caf6e7ee6f43abe4b386cb1d26b3318693cf.exe>
Windows
XP SP2 x64
<http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe>,
Windows XP SP3 x86
<http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe>,
Windows XP Embedded SP3 x86
<http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-embedded-custom-enu_8f2c266f83a7e1b100ddb9acd4a6a3ab5ecd4059.exe>,
Windows 8 x86,
<http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu>
Windows
8 x64
<http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x64_f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu>

Download localized language security updates: Windows Server 2003 SP2 x64
<http://www.microsoft.com/downloads/details.aspx?FamilyId=d3cb7407-3339-452e-8371-79b9c301132e>,
Windows Server 2003 SP2 x86
<http://www.microsoft.com/downloads/details.aspx?FamilyId=350ec04d-a0ba-4a50-9be3-f900dafeddf9>,
Windows XP SP2 x64
<http://www.microsoft.com/downloads/details.aspx?FamilyId=5fbaa61b-15ce-49c7-9361-cb5494f9d6aa>,
Windows XP SP3 x86
<http://www.microsoft.com/downloads/details.aspx?FamilyId=7388c05d-9de6-4c6a-8b21-219df407754f>,
Windows XP Embedded SP3 x86
<http://www.microsoft.com/downloads/details.aspx?FamilyId=a1db143d-6ad2-4e7e-9e90-2a73316e1add>,
Windows 8 x86
<http://www.microsoft.com/downloads/details.aspx?FamilyId=6e2de6b7-9e43-4b42-aca2-267f24210340>,
Windows 8 x64
<http://www.microsoft.com/downloads/details.aspx?FamilyId=b08bb3f1-f156-4e61-8a68-077963bae8c0>

General information on ransomware:
https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx

MS17-010 Security Update:
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

<>


Go here to download the appropriate security update for your version of
Windows:

MS17-010 Security Update:
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Microsoft Security Bulletin MS17-010 - Critical

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Affected Software and Vulnerability Severity Ratings
--- there is a chart here with links to patches for various Windows
versions. There are other links with info to follow if you feel the need
but I just went directly to the verion I wanted the patch for, i.e. Win 8.1
64 bit, which was labelled:

Windows 8.1 for x64-based Systems
(4012213)
Security Only[1]

I picked the "security only" patch rather that the "monthly rollup" and it
led me to a download area where I successfully downloaded the patch,
installed it and rebooted.

Hope this is useful. If you have questions post them here or to me. Today,
Monday, a new wave of attacks is expected so you will probably need to
follow Microsifts security update schedule and get every patch that you
need to stay protected. I will be doing this and will post any new
information I come up with as I find it.

LL


--
Lawrence F. London, Jr.
lfljvenaura@gmail.com
https://sites.google.com/site/avantgeared



  • [permaculture] Virus Akert: WannaCry virus (ransmware), possible new attack today (Monday), security measures to take (links below in message), Lawrence London, 05/15/2017

Archive powered by MHonArc 2.6.24.

Top of Page