4 ms·

"The success of the attack is thought to be due to a vulnerability in Microsoft Windows" It's really 'good' day for Microsoft. Europe realizing that Microsoft

by batter 9y ago

"The success of the attack is thought to be due to a vulnerability in Microsoft Windows" It's really 'good' day for Microsoft. Europe realizing that Microsoft is not that good and cheap: https://news.ycombinator.com/item?id=14314713 https://news.ycombinator.com/item?id=14314713 NHS in England is under attack due to Microsoft bug: https://news.ycombinator.com/item?id=14325213 https://news.ycombinator.com/item?id=14325213

raesene6 9y ago
The issue being exploited in the ransomware attack was patched months ago (MS17-010). The reason that it's successful is a) people don't apply patches quickly b) people us unsupported versions of the operating system and c) the NSA dropped a reliable exploit for it. All software has bugs, from all vendors. Security patching is a fact of life.
djsumdog 9y ago
The NHS one was posted on Slashdot earlier. A bunch of companies and governments seem to be affected and it's spreading across much of Europe. Whoever started this is probably going to make a killing. The trouble is, it's not unreasonable to open en e-mail attachment if it looks like it comes from someone on your work network. You may be expecting spreadsheets or PDFs every day, and the most recent MS issue was due to the scanning process itself; you didn't even have to open that attachment. I feel like several things need to happen here. Non-tech jobs need solid white listing. A lot of white listing software is crap and at B-sides 2016, there was a talk on how to bypass a lot of them. Solid white-listing based on application hashes and complete paths of the binary needs to become the defacto standard. Many PCs need to stop being PCs. If it's order entry for a doctor or nurse and the software already has a web interface, a Chromebook or Linux box that just boots straight to Firefox/Chromium or something else that's very simple/kiosk is a much better and cheaper solution. You don't need a full blown Mac/Win laptop for most of the applications we use them for. (Maybe Win 10 S could even be an option in this situation, if you can connect it to a domain and offer only company apps instead of store apps?) Large organisations need solid backup strategies, snap-shoting storage systems for staff, backup verification (would suck of that storage rack had a ransomware timebomb waiting to encrypt your backups) so they're never out more than 24 hours of date. Even though a lot of this is a "less is better" approach, it does increase costs, it is a learning curve, it does add some limitations and, for public organisations like the NHS, it will be a burden on already taxes IT departments. It sucks, but I wonder if we'll start to see better practices due to this and if these types of ideas will become common practice in the next decade.
- RubenSandwich 9y ago
  Absolutely we need to decrease the attack surface. We can't expect for each of those doctors to make sure they always have the latest version of Windows, etc. I'd also go so far as saying that we can't even trust IT to always update the systems because large corporates loose track of boxes all the time.
- TazeTSchnitzel 9y ago
  > The trouble is, it's not unreasonable to open en e-mail attachment if it looks like it comes from someone on your work network. It's a worm, this isn't a targeted email virus.

by batter 9y ago

raesene6 9y ago

The issue being exploited in the ransomware attack was patched months ago (MS17-010). The reason that it's successful is a) people don't apply patches quickly b) people us unsupported versions of the operating system and c) the NSA dropped a reliable exploit for it. All software has bugs, from all vendors. Security patching is a fact of life.

djsumdog 9y ago

The NHS one was posted on Slashdot earlier. A bunch of companies and governments seem to be affected and it's spreading across much of Europe. Whoever started this is probably going to make a killing. The trouble is, it's not unreasonable to open en e-mail attachment if it looks like it comes from someone on your work network. You may be expecting spreadsheets or PDFs every day, and the most recent MS issue was due to the scanning process itself; you didn't even have to open that attachment. I feel like several things need to happen here. Non-tech jobs need solid white listing. A lot of white listing software is crap and at B-sides 2016, there was a talk on how to bypass a lot of them. Solid white-listing based on application hashes and complete paths of the binary needs to become the defacto standard. Many PCs need to stop being PCs. If it's order entry for a doctor or nurse and the software already has a web interface, a Chromebook or Linux box that just boots straight to Firefox/Chromium or something else that's very simple/kiosk is a much better and cheaper solution. You don't need a full blown Mac/Win laptop for most of the applications we use them for. (Maybe Win 10 S could even be an option in this situation, if you can connect it to a domain and offer only company apps instead of store apps?) Large organisations need solid backup strategies, snap-shoting storage systems for staff, backup verification (would suck of that storage rack had a ransomware timebomb waiting to encrypt your backups) so they're never out more than 24 hours of date. Even though a lot of this is a "less is better" approach, it does increase costs, it is a learning curve, it does add some limitations and, for public organisations like the NHS, it will be a burden on already taxes IT departments. It sucks, but I wonder if we'll start to see better practices due to this and if these types of ideas will become common practice in the next decade.

RubenSandwich 9y ago
Absolutely we need to decrease the attack surface. We can't expect for each of those doctors to make sure they always have the latest version of Windows, etc. I'd also go so far as saying that we can't even trust IT to always update the systems because large corporates loose track of boxes all the time.
TazeTSchnitzel 9y ago
> The trouble is, it's not unreasonable to open en e-mail attachment if it looks like it comes from someone on your work network. It's a worm, this isn't a targeted email virus.