3 ms·
After the recent so called 'cyber attacks' of WannaCry, I was careful to update any Windows machine I have and install things like EMET and MalwareBytes on them
by remx 9y ago
After the recent so called 'cyber attacks' of WannaCry, I was careful to update any Windows machine I have and install things like EMET and MalwareBytes on them. I switched to Linux years ago because I've heard nothing but bad news concerning Windows, but one thing struck me about the WannaCry infections: I heard the attackers used an exploit pulled from the recent ShadowBrokers leak, something related to 'SMB'. A few questions:
Explain it to me like I'm five please
1.) What is SMB? And is it easy to remove from systems by simply uninstalling it (like I have done[0])?
2.) Does WannaCry just land on a machine through a simple point-and-click exploit? Do they just enter a vulnerable IP address and they can plant the exploit on the machine and run it?
3.) I am aware that it also gets onto machines by people randomly clicking on shady e-mail attachments, but I am very curious about how it simply lands on computers with very little or no user stupidity at all?
[0] I uninstalled SMB by going to > Add or remove programs > Remove windows features
- muricula 9y agoFirst of all, SMB is a network protocol for sharing files. It's sometimes known by the name samba, which is an implementation of the protocol. If you have a remote drive mounted for sharing documents with your coworkers there's a good chance you're using SMB. This exploit worked in two stages. First, there was a massive email campaign. Then, when employees would click on the attachment, the malware would worm its way onto other computers on the local network using an exploit in the SMB file sharing stack (which orignally came from leaked NSA malware). Then it would encrypt the user's files and demand the ransom.