Ransomware attack and older PCs, plus mitigation tips

[Edwin]

Microsoft has issued a patch against the current ransomware worm for Windows XP and other older systems that don't normally get patched any more.
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

Also, whatever you do, don't block the domain name iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com on your firewall or elsewhere. It's a "kill switch" for the current strain of malware - so long as the worm can connect to it, it will remain dormant.

Realistically speaking, you'll want to make upgrading your OS more of a priority after this though - their solution won't stop variant attacks or other ransomware worms. And I expect that, after the headline publicity around the world, other attackers will use similar propagation tactics to spread their infections faster than ever, so we can sadly expect the frequency of such attacks to increase.

Generally, you can protect your system by:
1) Running an up to date OS (Windows 7 or newer) i.e. one for which security patches are still being issued
2) Updating Windows regularly (either automatically, or manually 2-3 times a month)
3) Patching other software - especially stuff that gets frequently attacked - if you've got it installed. For example (not an exhaustive list)
- Adobe Flash https://get.adobe.com/flashplayer/ (untick the optional offers)
- Adobe Reader https://get.adobe.com/uk/reader/ (untick the optional offers)
- Microsoft Office (via Windows Update)
- Chrome, Firefox and other browsers (should be under the "Help" or "About" menu, or similar)
- Sun Java RE https://java.com/en/download/
- Apple iTunes https://www.apple.com/uk/itunes/download/ (untick the offer boxes)
4) Installing anti-virus/anti-malware software like Kaspersky etc.
5) Implementing a regular backup strategy, ideal one with multiple copies and/or "offsite" backup (on physical media such as removable HDDs or via one of the cloud backup providers). Ransomware will infect all hard drives it can "see" so it will also attack your backup drive if it's permanently connected.

None of the above is a silver bullet solution, but if you implement all of 1-4 you should be much, much safer than if you don't.

 

[Edwin]

Related aside: back in the day, the original version of XP was so full of security holes that my system was hacked during the time it took to download the service pack immediately after first installating XP as a "clean install". In other words, within 30 minutes.

(Had to do a complete reformat under Linux to get the bad stuff off the boot sector - fun times)

 

[RobM]

There's also a list of tips for linux systems:
1) Make a cup of tea and put your feet up

Seriously though - good advice from Edwin.

 

[Edwin]

There's also a list of tips for linux systems:
1) Make a cup of tea and put your feet up

True. I'm 90% sure I'll switch to Linux in January 2020 when Windows 7 support runs out.

 

[RobM]

I have a windows machine for games and small developments. I have a Mac for my emails and source files. I run multiple linux servers and have linux on another home machine. In my opinion windows is only good for gaming and that's only because a lot of games don't support other OS'. The sad thing is we see this kind of thing almost yearly and *still* people store important information in easily hackable systems.

 

[BeachLife]

The thing that surprised me was that Windows 8 is no longer supported, only 8.1.

 

[Edwin]

Fascinating background by the guy who registered the domain name that ended up stopping the ransomware worm (for now, anyway). It's technical, but at a readable level.
https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html

 

[martin-s]

I tried installing Kaspersky's anti ransomware tool, but it flattened by server. Anyone had more luck?

https://go.kaspersky.com/Anti-ransomware-tool.html

 

[monaghan]

I found a blog post yesterday showing how to capture a copy of the encryption keys that were being sent to the criminals and how to use this in a Linux box to decrypt files, so if anyone has been impacted by this, there's a potential of hope for you. (Can't remember the link as I was sat in the garden on my phone drinking tea at the time but you should be able to google for it)