Ways to protect your computers from Petya Ransomware

Some CERT recommendations to better protect your computers from becoming infected by Petya Ransomware:

    • Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
    • Applocker policies to block execution of files having name perfc.dat as well as psexec.exe utility from sysinternals.
    • Don’t open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly through browser.
    • Restrict execution of powershell /WSCRIPT/ PSEXEC / WMIC in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
    • Establish a Sender Policy Framework (SPF),Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
    • Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations. Enforce application whitelisting on all endpoint workstations.
    • Deploy web and email filters on the network. Configure these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.
    • Disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running.
    • Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.
    • Disable remote Desktop Connections, employ least-privileged accounts.

Click on this link to view the prior coverage about WannaCry Ransomware found on Uniquely Toronto.

Posted by Vincent Banial

Find the Key needed to unencrypt a Hard Drive encrypted by Petya Ransomware

Click on this link to visit the GitHub site where Leo Stone has posted some code which might just figure out the key required to unencrypt a Hard Drive encrypted by Petya Ransomeware. He suggests to try finding the key using an image copy of the Petya encrypted Hard Disk,. That way the original may not be harmed.  

Disclaimer: if you use Leo Stone’s code and method, you do so at your own risk. Loe also suggested to make and use an image copy of the encrypted hard Drive so as not to potentially damage the original. Leo’s code may find the key, or it may not. Playing around with the encrypted Hard Drive may damage it to the point that even if you pay the Ransom, you may not be able to reteive your data from said hard drive. I again state that following Loe Stone’s method as posted on GitHub is done at your own risk. Do your own Due Diligence. You could lose all the data on the hard drive.

Posted by Vincent Banial

Petya Ransomware Major Global Attack

WannaCry Ransomware paved the way by showing how to quickly spread across the Global Internet. It focused on on a vulnerability with Windows SMB which had been there for years and only exploited by Nation State employed Hackers.

Petya Ransonware, as has been named by the Security Staff at Kaspersky Lab, learned much from the WannaCry outbreak. Petya Ransomware has spread to thousands of computers at major institutions across the Globe. Petya ransomware is just starting. This is a major Ransomware attack.

It is basically a Worm which was first spread by malicious XL spreadsheets. Once on a network it stays in memory and as such is no so easy to detect and protect against. It looks like it is also focusing on the Windows SMB protocol and the Ports which support SMB.No wonder the focus on SMB as Petya use EternalBlue code as did WannaCry

My big fear is that Banks and Financial Institution had been targeted by Petya Ransomware. If it infects a large number of Banks then we could possibly see a Major Banking Crisis. It might be an idea to keep some cash on hand, in a safe place. Because it operates as Worm Code it is hard to detect and eliminate.

I will prepare a full review later this week. In the meantime the following are links which will shed light on what is happening. Some of the protective measures which stopped WannaCry Ransomware in it’s tracks, like disabling SMB ports, could also work to stop or slow the spread of Petya Ransomware.

Click on this link to visit Krebs On Security to read their initial post about Petya.

Click on this link to visit the Kaspersky Lab post titled “Petya Ransomware eats your hard drives

Click on this link to visit the Securelist site to read their very detailed post about how Petya Ransomware functions.

Click on this link to visit the Check Point site to read their discussion of the Petya Ransomware worldwide outbreak.

Video is courtesy of the F-Secure YouTube channel

 Click on this link to view the prior coverage about WannaCry Ransomware found on Uniquely Toronto.

Posted by Vincent Banial

Analysis of PETYA Ransomware running live on a computer

Petya Ransomware could be called WannaCry V3 as it is using the same EternalBlue / DoublePulsar code. It starts running via a Windows DLL. In the video below Colin runs Petya on a computer to be able to study it.

Video is courtesy of the Colin Hardy YouTube channel

“Making Peace with Cannabis” by Zach Walsh, PhD, Assistant Professor in the UBC Department of Psychology

This TEDx Talk is titled “Making Peace with Cannabis“. It features Zach Walsh, PhD, who is an Assistant Professor in the UBC Department of Psychology and Co-Director for the Centre for the Advancement of Psychological Science and Law. He is also involved in a current study at UBC which is investigating treating PTSD using Medical Cannabis.

Video is courtesy of the TEDx Talks YouTube channel

WannaCry Ransomware infected Traffic Cameras in Australia and Honda’s Sayama factory

Posted by Vincent Banial

WannaCry Ransomware is far from dead. It is still out there on the internet, searching for more victims.

Uniquely Toronto recently had extensive coverage about WannaCry Ransomware and Security Patches and had links to Security Patches and steps to better Secure computers against WannaCry.

When Wannacry was first discovered, Automobile manufacturing plants had been affected after WannaCry infected the Auto Plant’s computers. Seems that the IT folks at a Hond Auto Plant in Japan have not been folllowing the Cyber Security news. WannaCry Ransomware infected Honda’s Sayama car production plant this week.

Click on this link to visit the Reuters News post about Wannacry being found on the computer newtwork at Honda’s Sayama car production plant this week.

Apparently the WannaCry Ransomware was also spread to over 50 Traffic cameras via a USB memory stick. That happened in Austalia. Since wannacry encrypts owner created files on a computer, I would assume it would encrypt any JPGS or video files created by the Traffic cameras. Interesting that it is being claimed that it was spread by the use of a USB Memory stick. A good question to ask, would be “Where has that USB stick been plugged into a computer which was connected to the main system network”. USB Memory sticks generally have to be plugged into a computer to acquire ransomware.

Video courtesy of the Rebas Rebas YouTube channel

Click on this link to visit the 3Aw News Radio Station’s post about wannacry infecting Traffice camera in Austalia.

Traffice cameras must be a huge money maker. The wannaCry ransomware infection was started apparently on June 6. So by June 22 at least 8,000 Traffic Tickets may be withdrawn because of the infection of the Traffic camera. Those cameras must generate huge amounts of money for the city and for insurance companies and for the court system of lawyers, judges and clerks. Nice money making scheme with possibly little impact on traffic safety. 8,000 tickets in two weeks!!!

Click on this link to visit the Canadian Global News page to read their post titled: “8,000 red-light camera traffic tickets withdrawn in Australia due to WannaCry virus”.

Prada Paperclip shaped Money Clip is available at Barneys for only $185 US Dollars

Posted by Vincent Banial.

At Barneys in New York you can buy your own Prada branded Paperclip shaped Money Clip for only $185 US Dollars (shipping may be extra).

Click on this link to visit barneys.com website post featuring this item.

There is a bargain priced “used” one available at THE REAL REAL, at therealreal.com for only $125 US (shipping maybe extra).

Click on this link to visit therealreal.com post about the used item they have for sale.

Photo courtesy of the therealreal.com website.

The following are some sample links to Twitter Tweets:

What looks essentially like a Paperclip selling for $185, is the talk of Twitter of late.

Disclaimer : Always check with the official websites mentioned to confirm price and availability. The price of the Prada item mentioned above is subject to change without notice. Actually everything posted above is subject to change without notice.

$12.8 Million U.S. Dollar Bespoke Sweptail Rolls-Royce, could set a new World Record for the Most Expensive New Automobile

Video is courtesy of the Rolls-Royce Motor Cars YouTube channel 

I could wax eloquent about the new Rolls-Royce Bespoke Sweptail Motor Car. The custom built Rolls-Royce Bespoke Cars Sweptail apparently sold for 10 Million British Pounds or about 12.8 Million U.S. Dollars, which could set a new world record as being the Most Expensive New Automobile.

Video is courtesy of the effspot YouTUbe channel

I will instead post the official News Release from Rolls-Royce Motor Cars:

Photo of a Rolls-Royce Sweptail courtesy of Rpolls-Royce Motor Cars

Photo of the Rolls-Royce Sweptail is courtesy of Rolls-Royce Motor Cars.

Rolls-Royce

Media Information

ROLLS-ROYCE ‘SWEPTAIL’ – THE REALISATION OF ONE CUSTOMER’S COACHBUILT DREAM

27 May 2017, Villa d’Este

When, approximately one year ago, Rolls-Royce presented 103EX to the world, it invoked its coachbuilding heritage to inspire its future clientele. This Vision Vehicle envisaged a world of completely personal luxury mobility where new technologies would allow every Rolls-Royce to be designed in their owners’ image, should they wish. Such a Rolls-Royce would represent the truest meaning of luxury – a personal, Bespoke motor car like no other for each individual commissioning patron.

The mere idea of a modern coachbuilt Rolls-Royce was not enough for one Rolls-Royce connoisseur however. This individual approached the marque with his own idea of a two-seat Rolls-Royce that he wanted to be created in the here and now. That motor car is here, now and is christened ‘Sweptail’. In a nod to the swept-tail of certain Rolls-Royces from the 1920s, admired by the client so much, he asked Rolls-Royce to reimagine this feature on his one-off motor car.

Photo of a Rolls-Royce Sweptail courtesy of Rpolls-Royce Motor Cars

Photo of the Rolls-Royce Sweptail is courtesy of Rolls-Royce Motor Cars.

Presenting the car to the media at the Concorso d’Eleganza at Villa d’Este on Saturday 27th May 2017, Torsten Müller-Ötvös, Chief Executive Officer, Rolls-Royce Motor Cars said, “Sweptail is a truly magnificent car. It exudes the romance of travel for its own sake, and immediately places ‘Sweptail’ in the pantheon of the world’s great intercontinental tourers.  Rolls-Royce’s history as the world’s leading coachbuilder is at the very core of its identity as the world’s leading luxury brand. The arrival of 103EX shone a light on the future of Rolls-Royce in this field, and ‘Sweptail’ is proof, today, that Rolls-Royce is at the pinnacle of coachbuilding. We are listening carefully to our most special customers and assessing their interest in investing in similar, completely exclusive coachbuilt masterpieces.  At the same time we are looking into the resources which will allow us to offer this unique service to these discerning patrons of luxury.”

Through this commission, Rolls-Royce has proven once again to be the world’s leading luxury goods provider.

Continue reading

“Rivolta” gives an insight into the Exploits of a 15-year-old “Elite” Hacker named Michael ‘MafiaBoy’ Calce, who had taken down the websites of some of the largest companies.

Michael “MafiaBoy” Calce was just 15 years old. During his Exploit days, prior to being arrested, he had taken down the websites of some of the largest companies in the world, causing an estimated $1.7 billion in losses. He realized the depth of what he had done, after watching a news program where then President Clinton spoke about what “Mafiaboy” had done.

This video: “Rivolta: Inside the Mind of Canada’s Most Notorious Hacker” was produced by HP Canada. “Rivolta” was directed by Hubert Davis.

In one way this young person was extremely curious and yet his educators did not pick-up on that, so he sought out info elsewhere. In one part of the video, Michael Calce talked about taking a computer programming class in Pascal, but showed his instructor that he could code the course examples in far more powerful and complex “C Language“.

How many other genius kids who have the inner desire to learn, are also being missed by their Educators? Yes, this video is about the Exploits of a 15-year-old “Elite” Hacker, but it is also about an Educational System which in my opinion failed this young lad.

Video is courtesy of the HP Canada YouTube channel

Altaro is offering a free ebook “Ransomware: A Survival Guide”

Click on this link to visit the Altraro website to Download their free ebook titled “Ransomware: A Survival Guide”. They ask for your name and email to be able to D/L. Just do a Google search on “Temp Email” to find a site which will give you a free temp email address, if you do not wish to give out your email address.

The Altaro eBook is a short, yet interesting read about Ransomware.

Altaro also have a much more detailed video about Ransomware on their YouTube channel (see below).

Video is courtesy of the Altaro Software YouTube channel

Posted by Vincent Banial

WannaKey along with WanaKiwi may help to decrypt your WannaCry encrypted files without having to pay the Ransom

WannaKey works with older variants of Windows Server and Windows Workstation Operating Systems such as Windows Server 2003, Windows Server 2008, Windows XP, Windows 7, and Windows Vista.

When WannaCry encrypts your files, it creates a Private Key which is used to create the decrypt key. Then the Private key is erased. On older Windows systems the erase does not remove the data from memory. So if you are lucky and you have “not” rebooted the PC then there is a chance that WannaKey could recover the Private key, because it is still held in the system memory.

Once you have the Private Key then you can use a different program called wanakiwi to decrypt the files on the WannaCry encrypted PC.

The key point to remember is that the above process “MAY’ work. The Computer which was encrypted by WannaCry Ransomware, must “NOT” have been rebooted. Any files to download would be done using a different computer and then run on the encrypted PC via a USB flash Drive.  The WannaCry code did issue the command to erase the Private Key but the bug in older Windows Operating Systems is that Private Key has not been erased from the computer’s main memory.  With a bit of luck, you may be able to decrypt your WannaCry encrypted PC. Note there is no guarantee that this will work. If you are unsure how to go about this, then get a computer professional to help you.

Click on this Link to visit the GitHub page for Wannakey.

Click on thsLink to visit the

Click on this Link to visit the Comae Blog post by Matt Suiche titled “WannaCry — Decrypting files with WanaKiwi + Demos”. Matt goes thru the whole process along with screen shots.

Video is courtesy of the Vishnu Ava YouTube channel

Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.

Posted by Vincent Banial

Disclaimer: Everything in the post above is subject to change without notice. There could be unintentional errors. Please confirm all info via the linked to websites and web pages. Best Practice is to also always create daily backups. If you try to decrypt a WannaCry encrypted personal computer or server, you do so at your own risk. There is no guarantee that the above info will be successful in decrypting the files.

CERT had issued Vulnerability Note VU#867968 advising about the SMB vulnerability in Microsoft Windows

WannaCry Ransomware seems to have appeared out of the blue. Because of it thousands of people have searched the internet to find out how to disable SMB on their Microsoft Windows based Servers and Workstations and Personal Computers. Thousands had dropped by Uniquely Toronto to read out posts which provided details on ways to disable SMB v1.0.

Now Adylkuzz is running another major attack which is underway and uses the SMB vulnerability in Windows.

There was a prior Cert advisory titled: “Vulnerability Note VU#867968” (Microsoft Windows SMB Tree Connect Response denial of service vulnerability) was issued on Feb 02 2017.

In March Microsoft issued their Microsoft Security Bulletin MS17-012 which addressed the SMB issue.

There was also an even earlier US-CERT Advisory posted on Jan 16 2017 titled: “SMB Security Best Practices”, which suggested “blocking outbound SMB connections (TCP ports 139 and 445 along with UDP ports 137 and 138) from the local network to the WAN. “. Port blocking can be done using your Firewall Software (or Hardware)

“US-CERT cautions users and administrators that disabling or blocking SMB may create problems by obstructing access to shared files, data, or devices. The benefits of mitigation should be weighed against potential disruptions to users. For more information on SMB, please review Microsoft Security Advisories 2696547 (link is external) and 204279 (link is external).”

Microsoft Windows MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx.

Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.

Posted by Vincent Banial

Disclaimer: Everything in the post above is subject to change without notice. There could be unintentional errors. Please confirm all info via the linked to websites and web pages. Please install the Microsoft Windows MS17-010 Security Update (see link above). Best Practice is to also always create daily backups

Massive Adylkuzz attack is underway which uses the same tools used by WannaCry

New Adylkuzz Malware attack uses the same tools which were used by WannaCry Ransomware – (EternalBlue for instance) which were released by The Shadow Brokers back in April. Eternal Blue code scans a network to find computers running the Microsoft SMB v1.0 protocol service (open TCP ports 139 and 445 along with UDP ports 137 and 138). When found it can then install the malware.  Adylkuzz is infecting thousands of computers around the Globe. Microsoft released a Security patch back in March which addressed the SMB vulnerability. Last week Microsoft also released further Windows Security Patches for Windows systems going back to Windows XP.  Microsoft’s Windows Security Updates will stop the spread of WannaCry and Adulkuzz, once the Security Patches have been installed and the system rebooted. At the bottom of this post, you will find links to the official Microsoft Patches.

Video is courtesy of the DAHBOO77 YouTUbe channel

This new AdylKuzz Malware does not request any ransom from the owner of the infected computer. It does it’s processing in the background. One interesting aspect about the way that Adylkuzz works is that once it infects a computer it then disables the SMB v1.0 protocol. That move prevents any other Malware from infecting the computer. Adylkuzz may very well have protected thousands of computers around the globe from becoming infected by WannaCry Ransomware because Adylkuzz it is believed has been running in the wild on the internet for many weeks and before the WannaCry attack was launched.

Click on this Link to visit the PHYS.Org website to read their post titled: “Another large-scale cyberattack underway: experts”.

Adylkuzz essentially is a Cryptocurrency Miner. Apparently, it is being reported that Adylkuzz does not damage any files. A lot of people use their powerful computers to do Cryptocurrency Mining. Cryptocurrency like Monero and Bitcoin is essentially untraceable Internet money which can be converted to a National Currency or used directly on the Internet. Adylkuzz mines the Monero Cryptocurrency. Once installed on the infected computer it will start to use computer resources. On an older slow PC, the end user will notice a dramatic slowdown. On a Top End fast PC there will be a far less noticeable slowdown. What will be dramatically affected, will be one’s useable internet bandwidth. Downloads and even web page loading will take longer. Watching internet videos will be affected with slowdowns.

To prevent being infected by either WannaCry or Adylkuzz one needs to make sure that any Microsoft Windows Security Updates have been installed. Yes, one can manually disable the SMB v1.0 protocol on a PC, but the Microsoft Security Patches also patch other holes and vulnerabilities in the Windows Operating Systems. Install the Windows Security Patches. Also make sure to Update any and all of your Computer Security software like your Firewall, Anti-Virus, and Anti-Malware software. Then consider buying an external hard drive (if you do not already have one) and start backing up your data. Having a daily Backup of your data files costs far less than having to pay Ransomware, should your PC become infected.

Click on the following like to visit the Proofpoint cybewrsecurity firm’s post titled: “Adylkuzz Cryptocurrency Mining Malware Spreading for Weeks Via EternalBlue/DoublePulsar”.

Click on this Link to visit the Symantec Security Response blog to read their post titled: “Adylkuzz Cryptocurrency Miner Is Not The Next WannaCry”.

Click on this Link to visit the news.com.au site to read their post titled: “New Adylkuzz cyberattack targeted at mining virtual currency in infected computers”.

Click on this Link to visit the RT website to read their post titled: “WannaCry XXL? 2nd even bigger global cyber attack already underway”.

The following was posted by Anonymous on their YouTube channel TORnado – Anonymous France. Permission to share was posted on their YouTube channel along with the video linked to below,:
“Published on May 17, 2017

Greetings citizens of the world,

We are Anonymous.

This is a new warning about a massive hack.
Following the attack “WannaCry Ransomware”, a much larger hack was discovered.

Much more vicious, better hidden and bringing much more money to black-hats hackers, this massive virus is called “Adylkuzz” and simply uses the same flaw as WannaCry.
This is once again a computer tool stolen from the NSA.
But this time it is not your data that is affected but your entire computer that through the rat, will become a minor zombie of crypto-currency.

For the moment of what we, Anonymous know, here is the process:

The virus enters the computer with DoublePulsar and EternalBlue, via the MS17-010 fault on the TCP port 445 as the previous “WannaCryptor” but there will be nothing on the screen. You will not even know that you are infected.

Then the hack will begin to mining the cryptomony with your machine, ie you will produce virtual currency of type “Monero”, similar to the famous bitcoin without
You know it and free for hackers you do not know.
Knowing that the mining uses the abilities of the PC, the victim then undergoes slowdowns which causes a malfunction of the computer.

Several hundred thousand people would already be in this case, that’s why we’re alerting you once again. It seems that “WannaCry” was only the part of the iceberg, stay alert, update your Windows and keep your antivirus.

On our side we follow different tracks to find these hackers. Already about 40,000 dollars in Monero have recently been discovered probably the money gained through the hack.

The cryptomontee is thus once again likely to have a bad image in the media whereas this currency remains a practical and anonymous means to buy or give money.

Now calls to the Anonymous, it’s time to stop these criminals and help those affected or not knowing how to protect themselves.
The NSA can not even protect its own data, so we can only count on ourselves.
In any event,

We’re Anonymous,
We are Legion,
We do not forget,
We do not forgive,
Rogues, thieves, whoever you are,
Expect us.

————————————-“

The video below, by Anonymous, is the above info but spoken in French.
Video is courtesy of the TORnado – Anonymous France YouTube channel

The following are LINKS to Official Microsoft Patches for assorted versions of Windows (including Windows XP). Download English language security updates:

Windows Server 2003 SP2 x64,

Windows Server 2003 SP2 x86,

Windows XP SP2 x64,

Windows XP SP3 x86,

Windows XP Embedded SP3 x86,

Windows 8 x86,

Windows 8 x64

To download localized versions for the security update for Windows XP, Windows 8 or Windows Server: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

Microsoft Windows MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx.

Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.

Posted by Vincent Banial

Disclaimer: Everything in the post above is subject to change without notice. There could be unintentional errors. Please confirm all info via the linked to websites and web pages. Best Practice is to always create daily backups

Global spread of WannaCry Ransomware – Mon May 15 2017

Video is courtesy of the NIC Webcast YouTube channel

WannaCry Ransomware is continuing the spread around the globe. Some have even called it the start of a CyberWar. Russian President Putin is apparently blaming the U.S. for creating the tool set. Microsoft is apparently pointing that it is the stolen software tools from the N.S.A (National Security Agency).

Click on this link to visit the Kaspersky Lab SecureList blog site to read their detailed coverage titled “WannaCry ransomware used in widespread attacks all over the world”

I’m going to try something new, by featuring links to current news and major website posts related to the Global spread of WannaCry Ransomware:

Click on this link to visit the Microsoft Blog to read their post titled: “The need for urgent collective action to keep people safe online: Lessons from last week’s cyberattack” by Brad Smith – President and Chief Legal Officer.

The following is a paragraph from Brad Smith’s post:
All of this provides the broadest example yet of so-called “ransomware,” which is only one type of cyberattack. Unfortunately, consumers and business leaders have become familiar with terms like “zero day” and “phishing” that are part of the broad array of tools used to attack individuals and infrastructure. We take every single cyberattack on a Windows system seriously, and we’ve been working around the clock since Friday to help all our customers who have been affected by this incident. This included a decision to take additional steps to assist users with older systems that are no longer supported. Clearly, responding to this attack and helping those affected needs to be our most immediate priority.

Kudos go out to Microsoft for providing the Security Update for Windows XP:

Windows XP SP2 x64,

Windows XP SP3 x86,

Windows XP Embedded SP3 x86,

Click on this Link to visit the Wall Street Journal website to read their post “Cyberattack Is Likely to Keep Spreading. In the post they state that WannaCry Ransomware has spread to over 150 countries. Yesterday I had checked a tracking site which stated that over 230,000 computers had been hit with WannaCry. The Tracker only keeps track of those PCs which were still connected to the internet.

Click on this Link to visit The Telegraph news site to read their post “Cyber attack latest: Vladimir Putin blames US for hack as thousands more computers hit by ransomware“.

Click on this Link to visit the CyberSecurity Firm Malwaretech to view their live tracker for WannaCry / WannaCrypt.

Click on this Link to visit the Yahoo Tech site to read the Associated Press article “The Latest: 29,000 Chinese institutions hit by cyberattack“.

Click on this link to visit the Associated Press news site to read their article “Log in, look out: Cyber chaos may grow at workweek’s start.

Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.

Posted by Vincent Banial

Running demo of WannaCry v2 Ransomware Binary

WnnaCry Version 2 Ransomware is out. I had mentioned it in a prior post. The main difference is that the Kill SwitchCode has been removed. It is still a Worm which can spread across a Windows Server-based network, using the SMB v1.0 protocol.

In the video below the actual Binary Code of the WannaCry V2 Ransomware is run in a virtual environment.

Video is courtesy of the Colin Hardy YouTube channel.

Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.

 

Posted by Vincent Banial

How to find the presence of WannaCry Ransomware and SMB v1.0 Servers running on your Windows Network.

First and foremost make sure that you are running backups. The traditional backup system is called Grandfather, Father, and Son. The Son backup set is created Daily. The Father backup set is created Weekly. The Grandfather backup set is created Monthly. If the Daily backup set has problems, then you have fallback options. At most you should only lose one day’s worth of data input, which normally can be reentered or recreated.

Click on this link to visit the SANS Institute InfoSec Reading Room, to D/L their helpful PDF about backup sets, titled “Backup Rotations – A Final Defense”.

Next, please make sure that you have installed Microsoft’s patches (see the bottom of this post for links) on your Windows Servers. and all Windows based Workstations. Do not forget about patching Portable Notebook Computers running Windows, as they may not always be connected to your network. This includes Apple Mac Equipment, which may be virtually running Windows.

Click on this link to view a map of the spread of the WannaCry Ransomware attack – so far over 230,000 computers have been hit.

As a further precaution, I would check your Windows Servers and Windows based Workstations to ensure that SMB v1.0 has been disabled.

For Windows based Workstations and Notebooks: Open Control Panel. Scroll down to and click Programs. Next click Turn Windows features on or off. In the Windows Features window, Scroll to find the SMB 1.0/CFIS File Sharing Support line. Make sure to clear the checkbox on the SMB1.0/CIFS File Sharing Support line. Click OK. Now restart the Windows based computer or notebook.

For Windows Server Operating Systems: Open Server Manager. Find and click on the and then click the Manage menu. Next select Remove Roles and Features. In the Features window, scroll down and find and clear the SMB1.0/CIFS File Sharing Support check box. Click OK to close the window. Restart the Windows  Server.

Once your Windows Server-based Network is back up and running, start your Network Monitoring tool(s) and Packet Sniffing tool(s). Wireshark is well known. Microsoft Message Analyzer is the replacement for Microsoft’s Network Monitor. SmartSniff is another one. NAST (Network Analyzer Sniffer Tool)  is popular. Capsa Free Network Analyzer allows you to monitor over 300 different protocols.

Click on this link to visit Microsoft’s Technet website to view their post titled: “Microsoft Message Analyzer Operating Guide”.

You should be looking out for the some of the followingUse of file sharing protocol versions, especially SMB v1.0. Activity spikes, like File Renames or New File Creation. Multiple Workstations connecting to the same external IP address.

Keep an eye out for instances of the file@Please_Read_Me@.txton your file shares. Also check for any instances of files with these extensions:.wnry,.wcry,.wncryand.wncryt“.

Video is courtesy of the DAHBOO77 YouTube channel

The following are LINKS to Official Microsoft Patches for assorted versions of Windows (including Windows XP). Download English language security updates at the following links:

Windows Server 2003 SP2 x64,

Windows Server 2003 SP2 x86,

Windows XP SP2 x64,

Windows XP SP3 x86,

Windows XP Embedded SP3 x86,

Windows 8 x86,

Windows 8 x64

Click on this link to download localized versions of the security update for Windows XP, Windows 8 or Windows Server: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

Link to the important Microsoft Windows MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Click on this link to visit Microsoft’s site to read their post titled: “Customer Guidance for WannaCrypt attacks”.

Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.

 

Posted by Vincent Banial

Disclaimer: The above post is subject to change without notice. There may be unintentional errors in the above post.

How to disable SMB to stop WannaCry Ransomware. Also links to Microsoft Patches for Windows to stop WannaCry Ransomware

UPDATE May 14 at 3:00pm – added more ways to disable SMB

Some Cyber Weapons which were apparently developed by a National Spy Service to break into enemy computers, were supposedly stolen. Then some of the code for the Cyber Weapons was released to the public, on 14 April, through a dump by a group called Shadow Brokers.

On May 12 2017, a new Ransomware was released on the Internet. It utilized some of the code found in the Cyber Weapons and also a Malware called WannaCry. Hundreds of thousands of computers around the globe got hit. Then a kill switch was set off which dramatically slowed and possibly will stop the Ransomware from spreading further.

Stop the presses. A new version 2 of the WannaCry Malware is now out, which no longer has the Kill Switch code. That will make it difficult to stop.

The Hacker News facebook page posted a solution. Essentially their posts stated to disable the SMB service within Windows. It is not needed and is enabled for backwards compatibility.

Ok, but how do you disable SMB in Windows?

In Windows go to Control Panel. In Control Panel go to the icon labeled “Programs”. Click on it. Then under Programs and Features click on Turn Windows Features on and off. Once there, just scroll down till you find SMB 1.0/CIFS File Sharing Support. Make sure the checkbox to the left of SMB 1.0 is “NOT” checked off. Then click OK and then close control Panel. Reboot the computer.

In my Windows 10 it was already off (unchecked).

Video is courtesy of the Andr.oid Eric YouTube channel

Video is courtesy of the HatimTech YouTube channel

Another way to disable SMB is by using the Registry Editor. The following Video shows how to do it in Windows 7.

Video is courtesy of the Brxtt Tech YouTube channel

Another way to do it is to key in a Powershell command. That is like a super DOS Prompt. Open a Powershell Window and key in the following (but not the Quotes):

Disable-WindowsOptionalFeature -Online -FeatureName SMB1protocol

Press Enter and you should be good to go after you reboot the computer. I would double check in ControlPanel. Better safe than sorry.

Windows 8 and Windows Server 2012 introduce the new Set-SMBServerConfiguration Windows PowerShell cmdlet. The cmdlet enables you to enable or disable the SMBv1, SMBv2, and SMBv3 protocols on the server component.

  • To obtain the current state of the SMB server protocol configuration, run the following cmdlet:

    Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol
  • To disable SMBv1 on the SMB server, run the following cmdlet:
          Set-SmbServerConfiguration -EnableSMB1Protocol $false
  • You do not have to restart the computer after you run the Set-SMBServerConfiguration cmdlet. But I would restart the computer.

To enable or disable SMB protocols on an SMB Server that is running Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008, use Windows PowerShell or Registry Editor.
Windows PowerShell 2.0 or a later version of PowerShell

  • To disable SMBv1 on the SMB server, run the following cmdlet:

    Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 -Force
  • Note you must restart the computer after you make these changes.

REGISTRY. To enable or disable SMBv1 on the SMB server, configure the following registry key:
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1

REG_DWORD: 0 = Disabled

REG_DWORD: 1 = Enabled
Default: 1 = Enabled
Restart the computer after making the changes to the Registry.

How to enable or disable SMB protocols on the SMB client
Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012
To disable SMBv1 on the SMB client, run the following commands:

     sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

     sc.exe config mrxsmb10 start= disabled
     Restart the computer after executing the above.

If that is the hole inside all Windows Versions that existed prior to the Mar 2017 Microsoft Patch, then it has been around for ages.

Click on this link to visit The Hackers News Facebook page.

Click on this link to visit The Hackers News website.

The following are LINKS to Official Microsoft Patches for assorted versions of Windows (including Windows XP). Download English language security updates:

Windows Server 2003 SP2 x64,

Windows Server 2003 SP2 x86,

Windows XP SP2 x64,

Windows XP SP3 x86,

Windows XP Embedded SP3 x86,

Windows 8 x86,

Windows 8 x64

To download localized versions for the security update for Windows XP, Windows 8 or Windows Server: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

General information on ransomware: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx

MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Click on this link to visit Microsoft’s site to read their post titled: “Customer Guidance for WannaCrypt attacks”.

One final note which is bugging me. People are saying that this Ransomware is a “VIRUS“. WannaCry Ransomware is “NOT” a Virus. The WannaCry Ransomware is a vastly more complex computer “WORM“, hence it’s ability to find Windows computers connected to a network.

Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.

 

Posted by Vincent Banial

Disclaimer: Everything in the post above is subject to change without notice. There could be unintentional errors. Please confirm all info via the linked to websites and web pages. The WannaCry Malware has already been changed (minus the Kill Switch). Disabling SMB may not prevent future versions from affecting your computer. Best Practice is to always create daily backups

Johanne Astrid – Winner Of Denmark’s Got Talent 2017

Johanne Astrid is an amazing Drummer. She is also only 10 years old and was the Winner Of Denmark’s Got Talent 2017.

The first song that she rocks to was Rage Against the Machine’sKilling in the Name”. The middle song is Led Zeppelin‘s “Whole Lotta Love“. You have to watch this video.

Video is courtesy of the Got Talent Global Youtube channel

The next generation of Musicians is gonna be outstanding.

Kudos to the girl’s parents for letting her develop her passion.

Click on this link to visit the Got Talent Global facebook page.

Click on this link to visit the Johanne Astrid Facebook page.

Click on this link to visit the Poulsen Andersen YouTube channel which features many of Johanne Astrid Drumming videos.

 

Posted by Vincent Banial

How injecting THC and injecting Placebo into veins causes Paranoia, per the results of a poorly designed Oxford University Research Study

Oxford University had posted a News Post titled : “How cannabis causes paranoia”.

Clearly a poorly designed study or one designed to give a negative impression of Cannabis. The study was not about the normal use of Cannabis. It was a study where participants were injected with THC. In the Real World, no one does that.

First of all, they injected THC directly into the veins of participants. IN the Real World, Cannabis users “Do Not” consume Cannabis in that manner. They were only testing THC and not Cannabis. THC is a chemical found in Cannabis, but there are also other chemicals in the Cannabis Plant.

When you smoke or eat Cannabis, it takes time to consume the Joint or Muffin. It takes time for the THC (and other chemicals) to get into the bloodstream. The brain is slowly affected.

When you inject THC, (which “no one” does in the real world) your brain gets hit by the psychoactive chemical THC all at once. There are other Cannabinoids and other chemicals in Cannabis when smoked or eaten. Those other chemicals work with the THC. This test does not represent Cannabis. It represents Injecting THC.

Clearly this was a poorly designed Research Study.

I have never heard of people becoming Paranoid after smoking a joint. Getting the Giggles and laughing at stupid stuff – yes. Getting the Munchies and having a group order Pizza to be delivered – yes. Paranoia – nada.

A clear example is concerts. If you step off to the sidelines and look up you will see a haze of smoke rising from the audience. They are smoking Cannabis – it also has a specific fragrance. I remember Maple Leaf Gardens – same thing rising above the Audience. If large numbers of people were all experiencing Paranoia, they would be running for the exits (or at least a large number would). That has never happened. I have attended and photographed a heck of a lot of concerts and have never seen a mass exit of the audience after they smoked their Cannabis. They all seemed to dance and have fun and enjoyed the music.

Coachella, A recent outdoor concert in the California had an area where free Cannabis was available (to eat and smoke) to those with VIP tickets. Not one single person ran out of that area, because the Cannabis supposedly, as per the failed Oxford study, caused Paranoia.

The other rather interesting thing about that Oxford study is that 30% of the Placebo group “also experienced Paranoia” after being injected with Placebo.

Seems to me that participants lacked Trust in what was being injected into their arms. 50% of those injected with THC experienced Paranoid thoughts. 30% of the participants who were injected with a Placebo also experienced Paranoid thoughts. This is not a normal type of result for a Placebo Group. Interesting how the report of the study did not go into why the 30% of those injected with Placebo had experienced Paranoid thoughts…

I’ll give an example to clarify. Say you wanted to do a study of the effects of drinking two glasses of Red Cabernet Wine each day with your supper. Clearly injecting the equivalent amount of alcohol found in two glasses of Red Wine (12% Alcohol by volume) directly into study participants veins would have a totally different effect than drinking two glasses of wine with supper. No one would design such a sham of study and proclaim the results show the negative effect of drinking two glasses of Red Wine with your supper. Yet this is what was done in the above noted Oxford Study. They injected THC and their News Post was then titled “How Cannabis Causes Paranoia”. They only tested THC (the psychoactive cannabinoid found in Cannabis). They “did not test” using Cannabis. The THC was injected directly into the bloodstream of the participants. No Cannabis was ingested or smoked by the participant. Actually “no Cannabis was ever used” by the Oxford study participants.

That study was funded by the National Health Dept. Medical use of Cannabis is banned by the National Dept of Health. If one wants future Research Funding, does one rock the boat?

Click on this link to visit the University of Oxford website to read their News post titled “How Cannabis Causes Paranoia”.

Here is the URL incase the link has issues: http://www.ox.ac.uk/news/2014-07-16-how-cannabis-causes-paranoia

They could also have called the article
How injecting Placebo causes Paranoia.

Posted by Vincent Banial

Rock Legend Elton John to perform in Kingston and St Catharines Ontario in Nov 2017

This is great news for those living in Kingston and St Catharines Ontario. Elton John will perform in those two towns on Nov 14 and 15th respectively. as part of Elton’s  six-city Wonderful Crazy Night Tour 2017

Elton John and his Band will be playing hits and classic album tracks, as well as selected tracks from his most recent album, Wonderful Crazy Night.

Video is courtesy of the EltonJohnVEVO YouTube channel

Elton had played in Kingston previously but this will be his first time performing in St Catharines.

A Rocket Club membership will be necessary to purchase Rocket Tickets. If you are not already a Rocket Club member, please register for a free account by clicking here.

Rocket Tickets and Behind The Piano Backstage Tour Packages for Elton’s concerts in Kingston and St. Catharines, Ontario went on sale on Wednesday, May 10  on EltonJohn.com.

Clixk on this link to visit the St Catharines Standard News site to read their post titled:”Elton John tickets for Meridian Centre scooped up

Click on this link to visit The Whig News Site to read their post titled: “Elton John to return to Kingston”.

Click on this link to visit the official Elton John facebook page.

 

Posted by Vincent Banial

 

Disclaimer: The above post is subject to change without notice. PLease visit the official Elton John websites for the most up to date concert info.

Arctic Defies Fake News Stories

Source: Arctic Defies Fake News Stories

By Paul Homewood

We have had countless fake news stories over the winter about heatwaves in the Arctic and record ice melt.

Meanwhile, back in the real world, Arctic sea ice is just where it has been for the last few years.

Black Pepper Oil inhibited Cancer Cells proliferation by 3.5-86.8%.

Posted by Vincent Banial

The Medical Research Study was conducted by Bioactive Natural Products and Phytoceuticals, Department of Horticulture and National Food Safety and Toxicology Center, Michigan State University, East Lansing, Michigan 48824, USA. The results were authored by Liu Y1, Yadev VR, Aggarwal BB, Nair MG.

Study “results suggest that black pepper and its constituents like hot pepper, exhibit anti-inflammatory, antioxidant and anticancer activities“.

The extracts of black pepper at 200 microg/mL and its compounds at 25 microg/mL inhibited LPO by 45-85%, COX enzymes by 31-80% and cancer cells proliferation by 3.5-86.8%.

Abstract

“Black pepper (Piper nigrum) and hot pepper (Capsicum spp.) are widely used in traditional medicines. Although hot Capsicum spp. extracts and its active principles, capsaicinoids, have been linked with anticancer and anti-inflammatory activities, whether black pepper and its active principle exhibit similar activities is not known. In this study, we have evaluated the antioxidant, anti-inflammatory and anticancer activities of extracts and compounds from black pepper by using proinflammatory transcription factor NF-kappaB, COX-1 and -2 enzymes, human tumor cell proliferation and lipid peroxidation (LPO). The capsaicinoids, the alkylamides, isolated from the hot pepper Scotch Bonnet were also used to compare the bioactivities of alkylamides and piperine from black pepper. All compounds derived from black pepper suppressed TNF-induced NF-kappaB activation, but alkyl amides, compound 4 from black pepper and 5 from hot pepper, were most effective. The human cancer cell proliferation inhibitory activities of piperine and alklyl amides in Capsicum and black pepper were dose dependant. The inhibitory concentrations 50% (IC50) of the alklylamides were in the range 13-200 microg/mL. The extracts of black pepper at 200 microg/mL and its compounds at 25 microg/mL inhibited LPO by 45-85%, COX enzymes by 31-80% and cancer cells proliferation by 3.5-86.8%. Overall, these results suggest that black pepper and its constituents like hot pepper, exhibit anti-inflammatory, antioxidant and anticancer activities.”.

Click on this line to visit the US National Library of Medicine National Institutes of Health PubMed site to read about this research titled “Inhibitory effects of black pepper (Piper nigrum) extracts and compounds on human tumor cell proliferation, cyclooxygenase enzymes, lipid peroxidation and nuclear transcription factor-kappa-B.

Female Crow saved the life of an abandoned Kitten, by feeding and taking care of it.

Posted by Vincent Banial

I have seen videos about the intelligence of Crows. In one case, people who provided food to a group of Crows were repaid. The Crows would find and bring back shining things like lost rings and other jewelry and leave what they found, in the feeding area. This was clearly the Crows giving back for receiving the food.

In this video, a female Crow saved the life of an abandoned Kitten. The Crow was filmed finding food and actually feeding the Kitten. The Kitten would play with the Crow. When the Kitten wanted to cross the street the Crow would make a lot of noise in effect to warn the kitten that it was dangerous to cross the road. The Kitten and the Crow would spend the whole day with each other.

Video is courtesy of the ozricus YouTube channel

 

 

Maison MargielaFuture Destroyed High-Top Sneaker, White/Yellow USD $1,425.00 in stock at neimanmarcus.com

Photo is displayed from the Neiman Marcus site

Neiman Marcus is renown for selling High-Quality High-End products. They now also sell High-Quality High-End products which have been “Distressed” by the manufacturer. One example is the Maison MargielaFuture Destroyed High-Top Sneaker selling for $1425.00 USD. It seems strange at first glance to be able to buy pristine, not distressed products for hundreds of dollars less. Don’t forget that to be wearing things at the height of fashion does come a premium price.

 

The Washington Post article titled “NFL players fight pain with Medical Marijuana: ‘Managing it with pills was slowly killing me’”.

The Washington Post has posted an interesting article about the use of a strain of Medical Cannabis that is rich in Cannabidiol (CBD). Other strains of Cannabis have levels of THC which can get you highCannabidiol (CBD) does not have the psychoactivity and mood-altering effects of THC.

Cannabidiol or CBD can have Medical benefits especially for patients who have Eplilepsy, by reducing the occurrence of seizures. Another area being researched is the use of Medical Cannabis CBD to reduce pain. Former NFL Players break a lot of bones and unfortunately, that could lead to a lifelong Pain Management.

Click on this link to visit The Washington Post website to read their article titled “NFL players fight pain with medical marijuana: ‘Managing it with pills was slowly killing me’”.

Posted by Vincent Banial