2 ms·

> The worm would have needed someone do download the executable from the NAS and run it... Well, by that time the NAS is lost so it is already game over anyway

by tjoff 9y ago

> The worm would have needed someone do download the executable from the NAS and run it... Well, by that time the NAS is lost so it is already game over anyway. Nothing of value is stored on individual workstations (and if they do they ought to have some form of backup (which again, probably is the very same NAS)). It is an inconvenience, sure, but comparatively a minor detail.

xg15 9y ago
> Nothing of value is stored on individual workstations (and if they do they ought to have some form of backup [...]) That's a very broad assertion. Maybe that's true in a setup where everyone uses thin clients, but in the usual case, there is still enough friction on Windows to using network shares that many people will have local copies of the files they work with. Also, a NAT is probably the fist thing you'd hook up to a backup - if you're not using a cloud service anyway. Finally, the workstation itself is absolutely important. If only the NAS were affected you could at least keep working with what's left. Some machines are also specialized, e.g. info screens, ATMs, PoS terminals, hospital equipment...
- tjoff 9y ago
  Info screens, ATMs etc. are easily reimaged though - no data loss. Anyway: http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomworm.html http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomwo... The initial infection vector is still unknown. Reports by some of phishing emails have been dismissed by other researchers as relevant only to a different (unrelated) ransomware campaign, called Jaff. There is also a working theory that initial compromise may have come from SMB shares exposed to the public internet. Results from Shodan show over 1.5 million devices with port 445 open – the attacker could have infected those shares directly. Surprisingly large amount of SMB shares exposed directly to internet, that would of course be a great starting point.
  - xg15 9y ago
    > Info screens, ATMs etc. are easily reimaged though - no data loss. Indeed. I figure the damage in that case is more lost time and bad publicity (lots of photos showing the ransom note on public screens) > The initial infection vector is still unknown [...] SMB shares exposed to the public internet That's interesting. I wasn't aware of that but I agree, it would explain the quick spreading much better.

by tjoff 9y ago

xg15 9y ago

> Nothing of value is stored on individual workstations (and if they do they ought to have some form of backup [...]) That's a very broad assertion. Maybe that's true in a setup where everyone uses thin clients, but in the usual case, there is still enough friction on Windows to using network shares that many people will have local copies of the files they work with. Also, a NAT is probably the fist thing you'd hook up to a backup - if you're not using a cloud service anyway. Finally, the workstation itself is absolutely important. If only the NAS were affected you could at least keep working with what's left. Some machines are also specialized, e.g. info screens, ATMs, PoS terminals, hospital equipment...

tjoff 9y ago
Info screens, ATMs etc. are easily reimaged though - no data loss. Anyway: http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomworm.html http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomwo... The initial infection vector is still unknown. Reports by some of phishing emails have been dismissed by other researchers as relevant only to a different (unrelated) ransomware campaign, called Jaff. There is also a working theory that initial compromise may have come from SMB shares exposed to the public internet. Results from Shodan show over 1.5 million devices with port 445 open – the attacker could have infected those shares directly. Surprisingly large amount of SMB shares exposed directly to internet, that would of course be a great starting point.
- xg15 9y ago
  > Info screens, ATMs etc. are easily reimaged though - no data loss. Indeed. I figure the damage in that case is more lost time and bad publicity (lots of photos showing the ransom note on public screens) > The initial infection vector is still unknown [...] SMB shares exposed to the public internet That's interesting. I wasn't aware of that but I agree, it would explain the quick spreading much better.