River Beach is a small town in Florida, of less than 40,000 people. The City Council in Riviera Beach agreed to pay a $600,000 ransom to hackers who encrypted files on their computers. In hindsight it would have been cost effective to hire a couple of IT guys to go around and apply the Microsoft Security patches to all the computers used by River Beach.
Ransomware attacks targeting small cities are prevalent and growing. Those cities which do not pay the ransom, may end up spending Millions of Dollars rebuilding their IT Systems. Click on this link to visit the Wired website to read their article titled: “ATLANTA SPENT $2.6M TO RECOVER FROM A $52,000 RANSOMWARE SCARE”.
When the Security Patches were being applied, the IT guys could also discuss Phishing emails as most people are not even aware what a Phishing email is. It is not just small cities that fall for Phishing emails. The accounting departments of huge Tech firms have sent out cheques worth Millions of dollars because of fake Phishing emails.
Video courtesy of the RT America YouTube channel
Many of the Ransomware attacks (such as WannaCry) used the Microsoft SMB vulnerability.
There was a prior Cert advisory titled: “Vulnerability Note VU#867968” (Microsoft Windows SMB Tree Connect Response denial of service vulnerability) was issued on Feb 02 2017.
In March Microsoft issued their Microsoft Security Bulletin MS17-012 which addressed the SMB issue.
There was also an even earlier US-CERT Advisory posted on Jan 16 2017 titled: “SMB Security Best Practices”, which suggested “blocking outbound SMB connections (TCP ports 139 and 445 along with UDP ports 137 and 138) from the local network to the WAN. “. Port blocking can be done using your Firewall Software (or Hardware).
A number of attacked city systems had “not” updated “all” their computers with suggested Security Updates. Some of their Operating Systems and Server System software go back to days of Windows 7. The often quoted statement is that they did not have the IT resources to get Security Updates installed on all the computers.
One area which IMHO require more training is Phishing Attacks. That is the use of fake emails sent to emails which are part of a city’s system. The fake email will ask the receiver to click on a link. If the receiver clicks on the link they will link to one of the Hacker’s Command and Control Servers, which will then upload the Ransomware to the receiver’s computer. The Ransomware will be started and spread to the System Servers and to all the other computers. Once running on a computer, the Ransomware will start to Encrypt data files using a secret key. Next messages will pop up on infected computers telling them that their files have been encrypted and that they have so many days to pay a Ransom to get the key to be able to un-encrypt their files.
I recently posted the following article on this site which was titled: “Phishing eMail Scam targeted Facbook and Google for $100 Million Dollars.”.
If the main Servers have Security Updates installed then the Ransomware will not spread. Also, if the System Admins have been doing daily backups, they may be able to recover the Servers using their backup files. They would still have to deal with individual end user computers which were infected.
The “key” is training End Users to not open emails from unfamiliar people. If opened, then the end user should not click on any links and they should immediately contact their IT Support Team. Unfortunately in real life, that is easer said than done.
Click on the CYBERSECURITY box in the menu at the top of this site, to read more Security related posts.
Posted by Vincent Banial
New Adylkuzz Malware attack uses the same tools which were used by WannaCry Ransomware – (EternalBlue for instance) which were released by The Shadow Brokers back in April. Eternal Blue code scans a network to find computers running the Microsoft SMB v1.0 protocol service (open TCP ports 139 and 445 along with UDP ports 137 and 138). When found it can then install the malware. Adylkuzz is infecting thousands of computers around the Globe. Microsoft released a Security patch back in March which addressed the SMB vulnerability. Last week Microsoft also released further Windows Security Patches for Windows systems going back to Windows XP. Microsoft’s Windows Security Updates will stop the spread of WannaCry and Adulkuzz, once the Security Patches have been installed and the system rebooted. At the bottom of this post, you will find links to the official Microsoft Patches.
Video is courtesy of the DAHBOO77 YouTUbe channel
This new AdylKuzz Malware does not request any ransom from the owner of the infected computer. It does it’s processing in the background. One interesting aspect about the way that Adylkuzz works is that once it infects a computer it then disables the SMB v1.0 protocol. That move prevents any other Malware from infecting the computer. Adylkuzz may very well have protected thousands of computers around the globe from becoming infected by WannaCry Ransomware because Adylkuzz it is believed has been running in the wild on the internet for many weeks and before the WannaCry attack was launched.
Adylkuzz essentially is a Cryptocurrency Miner. Apparently, it is being reported that Adylkuzz does not damage any files. A lot of people use their powerful computers to do Cryptocurrency Mining. Cryptocurrency like Monero and Bitcoin is essentially untraceable Internet money which can be converted to a National Currency or used directly on the Internet. Adylkuzz mines the Monero Cryptocurrency. Once installed on the infected computer it will start to use computer resources. On an older slow PC, the end user will notice a dramatic slowdown. On a Top End fast PC there will be a far less noticeable slowdown. What will be dramatically affected, will be one’s useable internet bandwidth. Downloads and even web page loading will take longer. Watching internet videos will be affected with slowdowns.
To prevent being infected by either WannaCry or Adylkuzz one needs to make sure that any Microsoft Windows Security Updates have been installed. Yes, one can manually disable the SMB v1.0 protocol on a PC, but the Microsoft Security Patches also patch other holes and vulnerabilities in the Windows Operating Systems. Install the Windows Security Patches. Also make sure to Update any and all of your Computer Security software like your Firewall, Anti-Virus, and Anti-Malware software. Then consider buying an external hard drive (if you do not already have one) and start backing up your data. Having a daily Backup of your data files costs far less than having to pay Ransomware, should your PC become infected.
The following was posted by Anonymous on their YouTube channel TORnado – Anonymous France. Permission to share was posted on their YouTube channel along with the video linked to below,:
“Published on May 17, 2017
Greetings citizens of the world,
We are Anonymous.
This is a new warning about a massive hack.
Following the attack “WannaCry Ransomware”, a much larger hack was discovered.
Much more vicious, better hidden and bringing much more money to black-hats hackers, this massive virus is called “Adylkuzz” and simply uses the same flaw as WannaCry.
This is once again a computer tool stolen from the NSA.
But this time it is not your data that is affected but your entire computer that through the rat, will become a minor zombie of crypto-currency.
For the moment of what we, Anonymous know, here is the process:
The virus enters the computer with DoublePulsar and EternalBlue, via the MS17-010 fault on the TCP port 445 as the previous “WannaCryptor” but there will be nothing on the screen. You will not even know that you are infected.
Then the hack will begin to mining the cryptomony with your machine, ie you will produce virtual currency of type “Monero”, similar to the famous bitcoin without
You know it and free for hackers you do not know.
Knowing that the mining uses the abilities of the PC, the victim then undergoes slowdowns which causes a malfunction of the computer.
Several hundred thousand people would already be in this case, that’s why we’re alerting you once again. It seems that “WannaCry” was only the part of the iceberg, stay alert, update your Windows and keep your antivirus.
On our side we follow different tracks to find these hackers. Already about 40,000 dollars in Monero have recently been discovered probably the money gained through the hack.
The cryptomontee is thus once again likely to have a bad image in the media whereas this currency remains a practical and anonymous means to buy or give money.
Now calls to the Anonymous, it’s time to stop these criminals and help those affected or not knowing how to protect themselves.
The NSA can not even protect its own data, so we can only count on ourselves.
In any event,
We are Legion,
We do not forget,
We do not forgive,
Rogues, thieves, whoever you are,
The video below, by Anonymous, is the above info but spoken in French.
Video is courtesy of the TORnado – Anonymous France YouTube channel
The following are LINKS to Official Microsoft Patches for assorted versions of Windows (including Windows XP). Download English language security updates:
To download localized versions for the security update for Windows XP, Windows 8 or Windows Server: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598
Microsoft Windows MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by Vincent Banial
Disclaimer: Everything in the post above is subject to change without notice. There could be unintentional errors. Please confirm all info via the linked to websites and web pages. Best Practice is to always create daily backups