The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Microsoft Windows WannaCrypt Patches

    Discussion in 'Windows OS and Software' started by hmscott, May 14, 2017.

  1. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    WannaCrypt Emergency Patch for pre-Windows 10 computers targeted
    http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

    (Microsoft) Customer Guidance for WannaCrypt attacks

    MSRC Team May 12, 2017
    https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
    "Customers running Windows 10 were not targeted by the attack today", the same SMB Patches were issued for Windows 10 computers.
    Today many of our customers around the world and the critical systems they depend on were victims of malicious “WannaCrypt” software. Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful. Microsoft worked throughout the day to ensure we understood the attack and were taking all possible actions to protect our customers. This blog spells out the steps every individual and business should take to stay protected. Additionally, we are taking the highly unusual step of providing a security update for all customers to protect Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003. Customers running Windows 10 were not targeted by the attack today.

    Details are below.
    • In March, we released a security update which addresses the vulnerability that these attacks are exploiting. Those who have Windows Update enabled are protected against attacks on this vulnerability. For those organizations who have not yet applied the security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010.
    • For customers using Windows Defender, we released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt. As an additional “defense-in-depth” measure, keep up-to-date anti-malware software installed on your machines. Customers running anti-malware software from any number of security companies can confirm with their provider, that they are protected.
    • This attack type may evolve over time, so any additional defense-in-depth strategies will provide additional protections. (For example, to further protect against SMBv1 attacks, customers should consider blocking legacy protocols on their networks).
    We also know that some of our customers are running versions of Windows that no longer receive mainstream support. That means those customers will not have received the above mentioned Security Update released in March. Given the potential impact to customers and their businesses, we made the decision to make the Security Update for platforms in custom support only, Windows XP, Windows 8, and Windows Server 2003, broadly available for download (see links below).

    Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible.

    This decision was made based on an assessment of this situation, with the principle of protecting our customer ecosystem overall, firmly in mind.

    Some of the observed attacks use common phishing tactics including malicious attachments. Customers should use vigilance when opening documents from untrusted or unknown sources. For Office 365 customers we are continually monitoring and updating to protect against these kinds of threats including Ransom:Win32/WannaCrypt. More information on the malware itself is available from the Microsoft Malware Protection Center on the Windows Security blog. For those new to the Microsoft Malware Protection Center, this is a technical discussion focused on providing the IT Security Professional with information to help further protect systems.

    We are working with customers to provide additional assistance as this situation evolves, and will update this blog with details as appropriate.

    Phillip Misner, Principal Security Group Manager Microsoft Security Response Center

    Further resources:

    Download English language security updates: Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86, Windows XP SP2 x64, Windows XP SP3 x86, Windows XP Embedded SP3 x86, Windows 8 x86, Windows 8 x64

    Download localized language security updates: Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86, Windows XP SP2 x64, Windows XP SP3 x86, Windows XP Embedded SP3 x86, Windows 8 x86, Windows 8 x64

    General information on ransomware: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx

    MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

    MS17-010: Security update for Windows SMB Server: March 14, 2017
    Including Windows 10

    https://support.microsoft.com/en-us/help/4013389/title
    Summary
    This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.
    To learn more about the vulnerability, see Microsoft Security Bulletin MS17-010.

    More Information
    Important
    • All future security and non-security updates for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you install update 2919355 on your Windows RT 8.1-based, Windows 8.1-based, or Windows Server 2012 R2-based computer so that you receive future updates.
    • If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.
    Additional information about this security update

    The following articles contain more information about this security update as it relates to individual product versions. These articles may contain known issue information.
    • 4012598 MS17-010: Description of the security update for Windows SMB Server: March 14, 2017
    • 4012216 March 2017 Security Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2
    • 4012213 March 2017 Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2
    • 4012217 March 2017 Security Monthly Quality Rollup for Windows Server 2012
    • 4012214 March 2017 Security Only Quality Update for Windows Server 2012
    • 4012215 March 2017 Security Monthly Quality Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1
    • 4012212 March 2017 Security Only Quality Update for Windows 7 SP1 and Windows Server 2008 R2 SP1
    • 4013429 March 13, 2017—KB4013429 (OS Build 933)
    • 4012606 March 14, 2017—KB4012606 (OS Build 17312)
    • 4013198 March 14, 2017—KB4013198 (OS Build 830)
    Security update deployment

    Windows Vista (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file names

    For all supported 32-bit editions of Windows Vista:
    Windows6.0-KB4012598-x86.msu

    For all supported x64-based editions of Windows Vista:
    Windows6.0-KB4012598-x64.msu

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    WUSA.exe does not support uninstall of updates. To uninstall an update installed by WUSA, click Control Panel, and then click Security. Under "Windows Update," click View installed updates and select from the list of updates.

    File information

    See Microsoft Knowledge Base article 4012598

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.

    Windows Server 2008 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file names

    For all supported 32-bit editions of Windows Server 2008:
    Windows6.0-KB4012598-x86.msu

    For all supported x64-based editions of Windows Server 2008:
    Windows6.0-KB4012598-x64.msu

    For all supported Itanium-based editions of Windows Server 2008
    Windows6.0-KB4012598-ia64.msu

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    WUSA.exe does not support uninstall of updates. To uninstall an update installed by WUSA, click Control Panel, and then click Security. Under "Windows Update," click View installed updates and select from the list of updates.

    File information

    See Microsoft Knowledge Base article 4012598

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.

    Windows 7 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file name

    For all supported x64-based editions of Windows 7:
    indows6.1-KB4012212-x64.msu
    Security only

    For all supported x64-based editions of Windows 7:
    Windows6.1-KB4012215-x64.msu
    Monthly rollup

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, clickSystem and Security, and then under "Windows Update," click View installed updates and select from the list of updates.

    File information

    See Microsoft Knowledge Base article 4012212
    See Microsoft Knowledge Base article 4012215

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.

    Windows Server 2008 R2 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file name

    For all supported x64-based editions of Windows Server 2008 R2:
    Windows6.1-KB4012212-x64.msu
    Security only

    For all supported x64-based editions of Windows Server 2008 R2:
    Windows6.1-KB4012215-x64.msu
    Monthly rollup

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, clickSystem and Security, and then under "Windows Update," click View installed updates and select from the list of updates.

    File information

    See Microsoft Knowledge Base article 4012212
    See Microsoft Knowledge Base article 4012215

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.


    Windows 8.1 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file name

    For all supported x64-based editions of Windows 8.1:
    Windows8.1-KB4012213-x64.msu
    Security only

    For all supported x64-based editions of Windows 8.1:
    Windows8.1-KB4012216-x64.msu
    Monthly rollup

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, clickSystem and Security, click Windows Update, and then under "See also," click Installed updates and select from the list of updates.

    File information

    See Microsoft Knowledge Base article 4012213
    See Microsoft Knowledge Base article 4012216

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.

    Windows RT 8.1 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Deployment

    The 4012216 monthly rollup update is available via Windows Update only.

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    Click Control Panel, click System and Security, click Windows Update, and then under "See also," click Installed updates and select from the list of updates.

    File information

    See Microsoft Knowledge Base article 4012213

    Windows Server 2012 and Windows Server 2012 R2 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file name

    For all supported editions of Windows Server 2012:
    Windows8-RT-KB4012214-x64.msu
    Security only

    For all supported editions of Windows Server 2012:
    Windows8-RT-KB4012217-x64.msu
    Monthly rollup

    For all supported editions of Windows Server 2012 R2:
    Windows8.1-KB4012213-x64.msu
    Security only

    For all supported editions of Windows Server 2012 R2:
    Windows8.1-KB4012216-x64.msu
    Monthly rollup

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, click Windows Update, and then under "See also," click Installed updates and select from the list of updates.

    File information

    See Microsoft Knowledge Base article 4012214
    See Microsoft Knowledge Base article 4012217
    See Microsoft Knowledge Base article 4012213
    See Microsoft Knowledge Base article 4012216

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.


    Windows 10 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file name

    For all supported x64-based editions of Windows 10:
    Windows10.0-KB4012606-x64.msu

    For all supported x64-based editions of Windows 10 Version 1511:
    Windows10.0-KB4013198-x64.msu

    For all supported x64-based editions of Windows 10 Version 1607:
    Windows10.0-KB4013429-x64.msu

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, clickSystem and Security, click Windows Update, and then under "See also," click Installed updates and select from the list of updates.

    File information

    See Windows 10 and Windows Server 2016 update history.

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.

    Windows Server 2016 (all editions)
    Reference table

    The following table contains the security update information for this software.

    Security update file name

    For all supported editions of Windows Server 2016:
    Windows10.0-KB4013429-x64.msu

    Installation switches

    See Microsoft Knowledge Base article 934307

    Restart requirement

    A system restart is required after you apply this security update.

    Removal information

    To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, clickSystem and Security, click Windows Update, and then under "See also," click Installed updates and select from the list of updates.

    File information

    See Windows 10 and Windows Server 2016 update history.

    Registry key verification

    Note A registry key does not exist to validate the presence of this update.

    More Information

    How to obtain help and support for this security update

    Properties
    Article ID: 4013389 - Last Review: Mar 14, 2017 - Revision: 5

    Applies to Windows Server 2016 Datacenter, Windows Server 2016 Essentials, Windows Server 2016 Standard, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Standard, Windows Server 2012 R2 Essentials, Windows Server 2012 R2 Foundation, Windows 8.1 Enterprise, Windows 8.1 Pro, Windows 8.1, Windows RT 8.1, Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows Server 2012 Essentials, Windows Server 2012 Foundation, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Standard, Windows Web Server 2008 R2, Windows Server 2008 R2 Foundation, Windows 7 Service Pack 1, Windows 7 Ultimate, Windows 7 Enterprise, Windows 7 Professional, Windows 7 Home Premium, Windows 7 Home Basic, Windows 7 Starter, Windows Server 2008 Service Pack 2, Windows Server 2008 Foundation, Windows Server 2008 Standard, Windows Server 2008 for Itanium-Based Systems, Windows Web Server 2008, Windows Server 2008 Enterprise, Windows Server 2008 Datacenter, Windows Vista Service Pack 2, Windows Vista Home Basic, Windows Vista Home Premium, Windows Vista Business, Windows Vista Ultimate, Windows Vista Enterprise, Windows Vista Starter

    WannaCrypt Patches ( Microsoft MS17-010 is also for Windows 10 )

    Originally posted here:
    http://forum.notebookreview.com/threads/windows-10.762434/page-416#post-10526534

    Source: (Microsoft + https://imgur.com/gallery/Hl9Kt )

    Note: I've had a few timeout failures with the Microsoft sites, so try again if it times out on you - it's very busy :)

    Windows XP SP3 http://download.windowsupdate.com/d..._eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe

    Windows Vista x86 http://download.windowsupdate.com/d..._13e9b3d77ba5599764c296075a796c16a85c745c.msu

    Windows Vista x64 http://download.windowsupdate.com/d..._6a186ba2b2b98b2144b50f88baf33a5fa53b5d76.msu

    Windows 7 x64 http://download.windowsupdate.com/d..._2decefaa02e2058dcd965702509a992d8c4e92b3.msu

    Windows 7 x86 http://download.windowsupdate.com/d..._6bb04d3971bb58ae4bac44219e7169812914df3f.msu

    Windows 8 http://download.windowsupdate.com/c..._f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu

    Windows 8.1 http://download.windowsupdate.com/c..._5b24b9ca5a123a844ed793e0f2be974148520349.msu

    Windows 10 http://download.windowsupdate.com/c..._e805b81ee08c3bb0a8ab2c5ce6be5b35127f8773.msu

    Windows 2003 x86 http://download.windowsupdate.com/c..._f617caf6e7ee6f43abe4b386cb1d26b3318693cf.exe

    Windows 2003 x64 http://download.windowsupdate.com/d..._f24d8723f246145524b9030e4752c96430981211.exe

    Windows 2008 http://download.windowsupdate.com/d..._6a186ba2b2b98b2144b50f88baf33a5fa53b5d76.msu

    Windows 2008R2 http://download.windowsupdate.com/d..._2decefaa02e2058dcd965702509a992d8c4e92b3.msu

    Windows 2012
    http://download.windowsupdate.com/c..._b14951d29cb4fd880948f5204d54721e64c9942b.msu

    Windows 2012R2 http://download.windowsupdate.com/c..._5b24b9ca5a123a844ed793e0f2be974148520349.msu

    Windows Server 2016 http://download.windowsupdate.com/d..._ddc8596f88577ab739cade1d365956a74598e710.msu

    Here are the Microsoft Update Catalog pages:

    Windows 7/2008R2
    http://www.catalog.update.microsoft.com/search.aspx?q=4012212

    Windows 2012
    http://www.catalog.update.microsoft.com/Search.aspx?q=4012214

    Windows XP / Vista / 8 / 2003 / 2008
    http://www.catalog.update.microsoft.com/Search.aspx?q=4012598

    Windows 10
    http://www.catalog.update.microsoft.com/Search.aspx?q=4012606

    Windows 8.1/2012R2
    http://www.catalog.update.microsoft.com/Search.aspx?q=4012213

    Windows Server 2016
    http://www.catalog.update.microsoft.com/Search.aspx?q=4013429

    Source: (Microsoft + https://imgur.com/gallery/Hl9Kt )

    Various news reports...
    Ransomware 'WannaCry' attack explained


    What is Ransomware?


    Massive hacking strike affects millions


    WannaCry global hacking


    Who is to blame for the massive ransomware attack? - Inside Story
     
    Last edited: May 19, 2017
  2. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    Ransomware cyber-attack threat escalating
    Europol 6 hours ago
    http://www.bbc.com/news/technology-39913630?ocid=socialflow_twitter

    "Friday's cyber-attack has affected more than 200,000 victims in 150 countries, Europol chief Rob Wainwright says.

    He told the BBC the act was "unprecedented in its scale" and warned more people could find themselves affected on Monday morning.

    The virus took control of users' files, demanding payments; Russia and the UK were among the worst-hit countries.

    Experts say another attack could be imminent and have warned people to ensure their security is up to date.

    Mr Wainwright said that the ransomware - software that blocks access to data until a ransom is paid - was combined with a worm application - a program that replicates itself in order to spread to other computers.

    This, he said, was allowing the "infection of one computer to quickly spread across the networks".

    He added: "That's why we're seeing these numbers increasing all the time."

    'Patch before Monday'" (see Post #1 for patches)
    Europol director Rob Wainwright warned that companies must patch their systems before Monday morning
     
    Last edited: May 15, 2017
  3. alexhawker

    alexhawker Spent Gladiator

    Reputations:
    500
    Messages:
    2,540
    Likes Received:
    792
    Trophy Points:
    131
  4. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    (see Post #1 for patches)

    WannaCry Kill-Switch(ed)? It’s Not Over! WannaCry 2.0 Ransomware Arrives
    Saturday, May 13, 2017 Swati Khandelwal
    https://thehackernews.com/2017/05/wannacry-ransomware-cyber-attack.html
    "If you are following the news, by now you might be aware that a security researcher has activated a "Kill Switch" which apparently stopped the WannaCry ransomware from spreading further.

    But it's not true, neither the threat is over yet.

    However, the kill switch has just slowed down the infection rate.

    Updated: Multiple security researchers have claimed that there are more samples of WannaCry out there, with different 'kill-switch' domains and without any kill-switch function, continuing to infect unpatched computers worldwide (find more details below).

    So far, over 237,000 computers across 99 countries around the world have been infected, and the infection is still rising even hours after the kill switch was triggered by the 22-years-old British security researcher behind the twitter handle ' MalwareTech.'

    For those unaware, WannaCry is an insanely fast-spreading ransomware malware that leverages a Windows SMB exploit to remotely target a computer running on unpatched or unsupported versions of Windows."
    Cyber attack 'hero': I was just 'doing my bit' to stop hackers


    There is a "malwaretech.com" website with tracking info whenever he gets pings from wcrypt infections to the re-registered domain name:
    https://intel.malwaretech.com/botnet/wcrypt/?t=24h&bid=all

    Current stats:
    Malwaretech wcrypt stats.JPG

    Also fun, enabled the checkboxes for audio after clicking "Connect" in blue, top left:
    https://intel.malwaretech.com/pewpew.html

    (see Post #1 for patches)
     
    Last edited: May 17, 2017
    t456 and Primes like this.
  5. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    (See Post #1 for patches)

    Trump administration reacts to global cyberattack


    Analyzing the impact of the worldwide cyber attack



    NHS Cyber Attack: Piers Morgan vs. Ben Wallace [Part 1]+[Part 2]



    NHS Cyber Attack: Piers Morgan vs. Ben Wallace [Part 2]

    (See Post #1 for patches)
     
    Last edited: May 15, 2017
  6. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    (See Post #1 for patches)

    Brit IT Expert Who Cracked Virus: 'I'm No Hero'

    Published on May 15, 2017
    The British man who halted a cyberattack said he's no hero but was just "doing his job." IT expert Marcus Hutchins was hailed a hero after finding the "kill switch" for the malware which attacked Britain's hospital network on Friday. (May 15)


    Experts warn of new cyber-attack threats
    Published on May 15, 2017
    Further large-scale disruption in the wake of Friday's ransomware computer attack appears to have been averted.
    The Wanna Cry virus locked data and demanded a ransom on more than 200,000 computers in 150 countries. But there are still many questions about who is responsible. Experts say the latest attack is unlikely to be the last.


    Microsoft’s president says global cyberattack is a 'wakeup call'



    When should the government reveal cyber flaws to tech companies?



    (See Post #1 for patches)
     
    Last edited: May 17, 2017
  7. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    Patches are in Post #1!!

    Computers are still being infected; total infected count still increasing...
    https://intel.malwaretech.com/botnet/wcrypt/?t=24h&bid=all

    wcrypt 5-17-17.JPG

    Patches are in Post #1!!

    (See Post #1 for patches)

    Thanks to @3Fees for posting this:

    Important notice regarding global cyberattack WannaCry

    "Dear McAfee Customer,

    This past Friday we witnessed a coordinated global cyberattack known as WannaCry. It is one of the biggest cyberattacks that we have ever seen impacting over 150 countries and infecting more than 250,000 machines. WannaCry is a type of malicious software (malware) classified as ransomware.

    It encrypts essential files on your Windows device and requires that you pay a ransom to unlock those files. Although it primarily focuses on organizational or business networks - as was the case with WannaCry - you can do your part to stop the spread of this by doing the following:
    • Since our security products are automatically updated, as a McAfee customer you are protected from this ransomware when you connect to the Internet and update your security software. As new variants of this ransomware arise, we will continuously update our software to keep you protected. You can confirm your McAfee security is up-to-date by following these instructions.
    • Apply any Microsoft Windows security patches that Microsoft has sent you. If you are using an older version of Microsoft’s operating systems, such as Windows XP or Windows 8, click here to download emergency security patches from Microsoft.
    • Be careful what you click on. This malware was distributed by phishing emails. You should only click on emails that you are sure came from a trusted source. Click here to learn more about phishing emails.
    • Be sure to back up all your computing devices. Regularly backing up your devices helps you recover your information should your computer become infected with ransomware.
    We are actively working on a free decryption tool that, if successful, we will make it available as soon as possible. We are also working with law enforcement agencies around the world to understand who conducted this attack and will do everything we can to bring them to justice.

    You can learn more about WannaCry by clicking here.

    Sincerely,
    Gary J. Davis
    Chief Consumer Security Evangelist
    McAfee, LLC
    Follow me on Twitter @GaryJDavis for breaking cybersecurity news.

    https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/wannacry-ransomware-attacks/ "

    (See Post #1 for patches)
     
  8. katalin_2003

    katalin_2003 NBR Spectre Super Moderator

    Reputations:
    14,958
    Messages:
    5,671
    Likes Received:
    1,519
    Trophy Points:
    331
    toughasnails and hmscott like this.
  9. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    That's right on topic, as it will affect us moving forward - less munitions inventory for the hackers to pull from - remove the detonators and it's just useless code ;)

    Leaked NSA exploit spreading ransomeware WorldWide
    https://threatpost.com/leaked-nsa-exploit-spreading-ransomware-worldwide/125654/

    Next NSA exploit payload could be much worse than WANNACRY
    https://threatpost.com/next-nsa-exploit-payload-could-be-much-worse-than-wannacry/125743/

    "No one should be letting their guard down now that the WannaCry ransomware attacks have been relatively contained. Experts intimately involved with analyzing the malware and worldwide attacks urge quite the opposite, warning today that there’s nothing stopping attackers from using the available NSA exploits to drop more destructive malware."
     
    Last edited: May 18, 2017
  10. alexhawker

    alexhawker Spent Gladiator

    Reputations:
    500
    Messages:
    2,540
    Likes Received:
    792
    Trophy Points:
    131
    Researchers have developed a tool that decrypts the files in certain specific situations: "
    The researchers cautioned that their solution only works in certain conditions, namely if computers had not been rebooted since becoming infected and if victims applied the fix before WannaCry carried out its threat to lock their files permanently.

    Europol said on Twitter that its European Cybercrime Centre had tested the team's new tool and said it was "found to recover data in some circumstances"."

    http://www.reuters.com/article/us-cyber-attack-cure-idUSKCN18F1CA
     
  11. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    That's pretty awesome, but there is a pre-requisite limitation that many won't realize they need, until it's too late:

    From the top of the 1st page:

    "DO NOT REBOOT your infected machines and TRY wanakiwi ASAP*!
    * ASAP because prime numbers may be over written in memory after a while."

    WannaCry — Decrypting files with WanaKiwi + Demos
    Working Windows XP & 7 demos.
    #FRENCHMAFIA
    Matt SuicheFollow
    Hacker, Microsoft MVP, Founder of @comaeio — Co-Founder of @CloudVolumes (now @VMWare) May 18
    https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d


    If you try this, please come back and let us know how it works out!, Good luck!

    gentilkiwi/wanakiwi
    https://github.com/gentilkiwi/wanakiwi/releases
     
  12. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    Last edited: Jun 29, 2017
    inm8#2 likes this.
  13. hmscott

    hmscott Notebook Nobel Laureate

    Reputations:
    7,110
    Messages:
    20,384
    Likes Received:
    25,139
    Trophy Points:
    931
    New Cyberattack Spreads From Russia to the United States
    Author of Original Petya Ransomware Publishes Master Decryption Key
    https://www.bleepingcomputer.com/ne...a-ransomware-publishes-master-decryption-key/
    "The author of the original Petya ransomware — a person / group going by the name of Janus Cybercrime Solutions — has released the master decryption key of all past Petya versions.

    This key can decrypt all ransomware families part of the Petya family except NotPetya, which isn't the work of Janus. This list includes:

    First Petya ransomware version (flashed white skull on red background during boot-up screens)
    Second Petya version that also included Mischa ransomware (flashed green skull on black background during boot-up screens)
    Third Petya version, also known as GoldenEye ransomware (flashed yellow skull on black background during boot-up screens)

    Authenticity of Petya decryption key confirmed
    Janus released the master key on Wednesday in a tweet that linked to an encrypted and password-protected file uploaded on Mega.nz.

    JANUS @JanusSecretary

    "They're right in front of you and can open very large doors" https://mega.nz/#!lmow0Z7D!InyOTGaodVLX2M9pMGQvHJaGpvon11FyGep10ki4LHc … @hasherezade @MalwareTechBlog ;)

    Malwarebytes security researcher Hasherezade cracked the file yesterday and shared its content:

    Congratulations!
    Here is our secp192k1 privkey:
    38dd46801ce61883433048d6d8c6ab8be18654a2695b4723
    We used ECIES (with AES-256-ECB) Scheme to encrypt the decryption password into the "Personal Code" which is BASE58 encoded.

    Kaspersky Lab security researcher Anton Ivanov tested and confirmed the master key's validity.

    [​IMG]

    Anton Ivanov @antonivanovm

    The published #Petya master key works for all versions including #GoldenEye

    This key is the private (server-side) key used during the encryption of past Petya versions. Decrypters can be built that incorporate this key. In the past, security researchers have cracked Petya encryption on at least two ocassions [ 1, 2], but with the private key in the open, decrypter will recover files much faster than the previously known methods.

    Unfortunately, this decryption key won't be as useful as many people think.

    Most (original) Petya campaigns happened in 2016, and very few campaigns have been active this year. Users that had their files locked have wiped drives or paid the ransom many months before. The key will only help those victims who cloned their drives and saved a copy of the encrypted data.

    Decryption key is useless for NotPetya victims
    This key won't help NotPetya victims because the NotPetya ransomware was created by " pirating" the original Petya ransomware and modifying its behavior by a process called patching. NotPetya used a different encryption routine and was proven to have no connection to the original Petya.

    In 2016, Janus had been very active on Twitter while promoting a Ransomware-as-a-Service (RaaS) portal where other crooks could rent access to the Petya+Micha ransomware combo. Janus became active in 2017 after a long period of silence just to deny any involvement with the NotPetya outbreak.

    Hashezerade believes that Janus released Petya's decryption key as a result of the recent NotPetya outbreak, and he might have decided to shut down his operation.

    Janus is not the first ransomware author/group who released his master decryption key. The TeslaCrypt group did the same in the spring of 2016. Last year, Janus also hacked the servers of a rival ransomware author — Chimera ransomware — and dumped his decryption keys."

    Level1 News July 11 2017: Timeshare Sex Robots Is A Really Good Band Name
    4:21 - Author of Original Petya Ransomware Publishes Master Decryption Key

    Articles and references used in show:
    https://www.one-tab.com/page/L5dGPtxyQKO-rBXh9nhSVw

    0:48 - AT&T: Forced arbitration isn't "forced" because no one has to buy service
    4:21 - Author of Original Petya Ransomware Publishes Master Decryption Key
    5:51 - Wikileaks Unveils CIA Implants that Steal SSH Credentials from Windows & Linux PCs
    7:16 - New attack can now decrypt satellite phone calls in "real time"
    8:25 - iTWire - Systemd flaw leaves many Linux distros open to attack
    9:33 - Facebook investigated by Germany's Federal Cartel Office over claims it extorts personal data from users
    13:07 - Amid Unprecedented Controversy, W3C Greenlights DRM for the Web
    17:27 - State Dept. Enlists Hollywood And Its Friends To Start A Fake Twitter Fight Over Intellectual Property
    19:45 - Verizon Wireless disconnects some heavy data users in rural areas
    21:32 - Cox expands home Internet data caps, while CenturyLink abandons them
    24:44 - NHMC Motion for Extension of Time 17-108 FINAL 07.07.2017 1130AM
    26:32 - OneDrive has stopped working on non-NTFS drives
    27:54 - Raspberry Pi's smaller, cheaper rival: NanoPi Neo Plus2 weighs in at $25
    28:54 - Samsung is reportedly developing a voice-controlled speaker to compete with Amazon Echo
    30:35 - Apple Tests 3-D Face Scanning to Unlock Next iPhone
    34:03 - Waymo Drops Most Patent Claims in Car Tech Fight With Uber
    37:15 - Microsoft is laying off "thousands" of staff in a major global sales reorganization
    38:20 - Robots are coming to a farm near you
    40:34 - Press Association wins Google grant to run news service written by computers
    42:53 - Stream-ripping is 'fastest growing' music piracy
    46:26 - Elon Musk promises world's biggest lithium ion battery to Australia
    48:40 - NPA panel pitches limiting elderly drivers to cars with automatic braking tech
    50:54 - TV networks said to hide bad ratings with typos
    53:35 - Quantum Breakthrough: Researchers Successfully Simulated a 45-Qubit Quantum Circuit
    55:03 - Tesla shares plunge 12 percent this week on disappointing deliveries
    57:32 - Wildcard Certificates Coming January 2018
    58:27 - In attempt to achieve YouTube stardom, woman accidentally kills her boyfriend
    1:00:13 - The Best Keyboard Ever Is Back
    1:03:45 - The robot sex doll revolution may have some big downsides, experts warn
     
    Last edited: Jul 11, 2017