5 ms·
What really amazes me about this attack is that the main attack vector seems to be exploiting a SMB vulnerability. Reasonable enough of a way to spread within a
by ufmace 9y ago
What really amazes me about this attack is that the main attack vector seems to be exploiting a SMB vulnerability. Reasonable enough of a way to spread within an organization, but it's amazing that so many organizations seem to have this port and service open to the world for this worm to exploit.
I'm not the most diligent follower of security news, but I'm pretty sure that SMB network sharing is riddled with security vulnerabilities, latency issues, etc, and is generally wildly unsuitable for being left wide open to the entire internet. How could any institution with a competent IT department not have had this service firewalled off from the net for years?
- supermatt 9y agoIt only spread through SMB shares where available. Other vectors include downloaded executables (email, web, etc).
- dhd415 9y agoThe attack was usually introduced via a phishing attack and then spread through SMB vulnerabilities. It generally wasn't that SMB endpoints were open to the internet.
- ufmace 9y agoCertainly possible, but if it was spread with an ordinary phishing attack, I gotta wonder why all of these organizations got hit so hard in such a short timeframe. We've had lots and lots of conventionally spread ransomware attacks go out, but I don't know of any that have had this kind of effect in this timeframe.
- y_u_no_rust 9y agowindows defender exploit though or a preexisting nsa implant
- joelhaasnoot 9y agoCould it be organisations sharing data by SMB infecting each other?
- jsz0 9y agoThe irony of this is SMB servers are often setup with insecure configs exactly because it's so rarely used over public networks. Too many people assume public networks will be their Maginot Line against SMB attacks.
- lmm 9y agoAny network service being shipped right now by a serious vendor ought to be secure enough for the open Internet; frankly most large organizations' internal networks aren't any safer than the Internet. Why should SMB be any less safe than SSH or HTTP?
- benjibobs 9y agoThe whole attack is a wonderful show of incompetence within the IT departments of the compromised companies.
- remx 9y agoAfter the recent so called 'cyber attacks' of WannaCry, I was careful to update any Windows machine I have and install things like EMET and MalwareBytes on them. I switched to Linux years ago because I've heard nothing but bad news concerning Windows, but one thing struck me about the WannaCry infections: I heard the attackers used an exploit pulled from the recent ShadowBrokers leak, something related to 'SMB'. A few questions: Explain it to me like I'm five please 1.) What is SMB? And is it easy to remove from systems by simply uninstalling it (like I have done[0])? 2.) Does WannaCry just land on a machine through a simple point-and-click exploit? Do they just enter a vulnerable IP address and they can plant the exploit on the machine and run it? 3.) I am aware that it also gets onto machines by people randomly clicking on shady e-mail attachments, but I am very curious about how it simply lands on computers with very little or no user stupidity at all? [0] I uninstalled SMB by going to > Add or remove programs > Remove windows features
- muricula 9y agoFirst of all, SMB is a network protocol for sharing files. It's sometimes known by the name samba, which is an implementation of the protocol. If you have a remote drive mounted for sharing documents with your coworkers there's a good chance you're using SMB. This exploit worked in two stages. First, there was a massive email campaign. Then, when employees would click on the attachment, the malware would worm its way onto other computers on the local network using an exploit in the SMB file sharing stack (which orignally came from leaked NSA malware). Then it would encrypt the user's files and demand the ransom.