SonicWall Protects Customers from the Latest Massive WannaCry Ransomware Attack

Re-posted from SonicWall Blog

WannaCry Ransomware

First, if you are a SonicWall customer and you are using our Gateway Anti-Virus, Intrusion Prevention service, and Capture Advanced Threat Protection then your SonicWall firewall has been protecting your network from WannaCry ransomware and the worm that spreads it since 17 April, 2017. Since the release of the first version of the code, we have identified several new variants and have released additional counter measures. We will continue to update this blog as our Capture Labs research team uncovers more information and as additional protection is automatically rolled out to our customers’ firewalls.

Here’s more:

The Attack

This massive ransomware attack became infamous by shutting down a number of hospitals in the UK’s National Health Service (NHS) system and thus preventing patients from receiving critical care. The attack hit over 100 countries across the world with an untold number of victims. WannaCry is a combination of a Trojan/ransomware and a worm that leverages an SMB file sharing protocol exploit named EternalBlue. The Shadow Brokers leaked EternalBlue in April 2017 as part of a bigger dump of NSA developed exploits. This exploit affects various versions of Microsoft Windows operating systems, including a number of versions that are in end-of-life status. Although Microsoft released a large number of patches on March 14 to address this vulnerability, the attack remains dangerous as many organizations have not applied the patch.

The first version of the worm/ransomware package had a kill switch that was accidently used to disable the worm feature which slowed its advance on Friday, 12 May 2017. However, new variants are appearing in the wild without this weakness. While the first version of the worm code can no longer spread the ransomware code, systems encrypted by WannaCry 1.0 will remain encrypted. Unfortunately, there is no known decryption method to recover files affected by WannaCry without paying cyber criminals (which is not advised).

Since Friday, 12 May 2017, SonicWall’s Capture Labs released six new signatures to block all known versions of WannaCry.  It is also worth noting that SonicWall security services on the firewall have built-in protections against the many components of this code, ranging from blocking contact with WannaCry Command and Control (C&C) servers to blocking attempts at exploitation of any unpatched SMB Microsoft vulnerabilities (such as EternalBlue).

The Protection

SonicWall Capture Labs analyzed the EternalBlue attack in mid-April immediately after the Shadow Brokers file dump and rolled out protection for all SonicWall firewall customers well in advance of the first public attack.  All known versions of this exploit can be blocked from SonicWall protected networks via active next-generation firewall security services.

As a SonicWall customer, ensure that your next-generation firewall has an active Gateway Security subscription to receive automatic real-time protection from known ransomware attacks such as WannaCry. Gateway Security includes Gateway Anti-virus (GAV), Intrusion Prevention (IPS), Botnet Filtering, and Application Control. This set of technology has signatures against WannaCry (part of GAV), protections against vulnerabilities outlined in Microsoft’s security bulletin MS17-010 (part of IPS), and it blocks communication with the C&C servers where WannaCry’s payload comes from (part of botnet filtering).

Since SonicWall Email Security uses the same signatures/definitions as Gateway Security, we can effectively block the emails that deliver the initial route to infection. Ensure all email security services are also up to date to block malicious emails.  Since 65% of all ransomware attacks happen through phishing emails, this needs to be a major focus when giving security awareness training. Additionally, customers with SonicWall Content Filtering Service should activate it to block communication with malicious URLs and domains, which works in a similar way Botnet filtering disrupts C&C communication.

As a best practice always deploy Deep Packet Inspection of all SSL/TLS (DPI-SSL) traffic since more than 50% of malware is encrypted. This will enable your SonicWall security services to identify and block all known ransomware attacks. Enabling DPI-SSL also allows the firewall to examine and send unknown files to SonicWall Capture Advanced Threat Protection for multi-engine processing to discover and stop unknown ransomware variants.

View our webpage to learn more on how SonicWall protects against ransomware.

WannaCrypt Signatures

The most recent list of GAV/IPS signatures against EternalBlue and WannaCrypt as of 14 May 2017 at 11:45 AM PST

What’s Next

The party behind this attack has already released several variations of this attack for which we have established protections in place (see above). To ensure you are safe from newly developed updates and similar copycat attacks, first apply the Windows patch provided by Microsoft listed in the resources section.  Second, apply Capture Advanced Threat Protection (Capture ATP), SonicWall’s multi-engine network sandbox, to examine suspicious files coming into your network to discover and stop the latest threats just as we did with Cerber ransomware. Enable the service’s block until verdict feature to analyze all files at the gateway to eliminate malware before it can enter your network. Additionally, Capture Labs will continue to email customers Sonic Alerts on new threats.

Finally, phishing emails are the most common delivery mechanism for ransomware. It is possible that future variants of this ransomware will be delivered via emails. SonicWall’s email security solution uses Advanced Reputation Management (ARM) to inspect not only the sender IP but also the message content, embedded URLs and attachments. In addition, make sure you enable SPF, DKIM and DMARC advanced email authentication to identify and block spoofed emails and protect from spam and phishing attacks. For the best possible protection against such attacks, deploy SonicWall’s email security solution with Capture ATP service to inspect every email attachment in a multi-engine sandbox environment.

Resources

VISIT SONICWALL

Some Things Will Remain Unchanged

At the forefront of South East Asia’s blooming internet security and networking market, D-Synergy has remained one of the fastest-growing value-added distributors of cutting edge internet security and networking technology, satisfying customers with its attractive products as well as a sound business continuation policy.

The road to modern success however, was not easy. Managing Director Doreen Sim began her entrepreneur journey way back before her company’s establishment, where she worked multiple part-time jobs to gather enough money to pay for her university education and other expenses. Then in 1998, fresh out of university and armed with a degree in political science, Doreen plunged headfirst into the emergent ICT industry, despite having no prior engineering training or IT experience. She had to both cope with quickly learning the ropes of this challenging industry while trying to formulate and then execute a realistic business survival program.

[Read more…]

除夕不巧落在星期天 多数公司明天节前不“早放”

Zaobao (2012-01-19)

中小型企业商会会长曾宗敏表示,一些企业到了农历新年前几天是最忙碌的时候,农历新年前还有个周末,相信不少企业会趁这两天赶工,因此明天不提早收工是意料中事。

根据以往惯例,到了大年除夕,企业会在中午过后收工,让员工早点下班为年夜饭做准备。不过今年,除夕“不巧”落在多数人无需上班的星期日,而多数受访企业表示,不会在明天(20日),也就是农历新年前的最后一个工作日提早休息,不少员工因此少了半天有薪假期。

本报向10家不同领域的企业查询,明天是否会提早让员工休息,结果发现,有六家不会这么做,只有三家会,最后一家则表示会等到明天早上才决定。

[Read more…]

Security for SMEs

BUSINESSES MUST KEEP UP WITH THE AWARENESS AND RISK OF INTERNET SECURITY
The Internet has changed the world in which SMEs operate and grow their businesses. Infocomm Technology (ICT) and the Internet have become powerful platforms and an eco-system where SMEs can find solutions and opportunities to expend their business. However, the digital transformation brings along security threats and vulnerabilities that SMEs must be aware of.

Today, SMEs must understand that security threats are endless and they compromise business information and employees’ productivity. So are SMEs protecting themselves adequately? Do they know where to begin with in their ICT adoption exercise?

[Read more…]