CIS608 - Week9 - WannaCry - Ransomeware

WannaCry - Ransomware

On May 12, 2017, IT world witnessed new ransomware called WannaCry and it impacted 300,000 immediately. This ransomware exploits the vulnerabilities in the Windows file-sharing protocol. The infiltration of this threat is through and point devices such as Windows devices that allowed inbound SMB communications on firewall ports 139 or 445 and had not been updated with the latest Microsoft security patch. Once a device had been exploited, the malware would scan for other vulnerable devices and spread over.

The way Ransomware works is - once it infects, it encrypts, scrambles the data and then it demands to payout in cryptocurrency. The clients will always think whether to pay out for removing the ransom or replacing the system affected depending on the value of the data being attacked and replacement costs. It is not always true that the hijacked data can be retrieved, reinstalled and never be exported when payments are made. Depending on the variant of the malware it can be restored fully, partially or none. The moment ransomware affects a computer network, it holds the data it finds there to ransom - threatening to delete it without payment. It can find many different routes to infect a computer or cell phone/gadget. The standard way is for it to be sent in an email. In the email, there may be a link the reader is directed to click on or an attachment that needs to be opened. In most cases, the software infects computers through links or attachments in malicious messages known as phishing emails. The ransomware encrypts data on the computer using an encryption key that only the attacker knows. If the ransom isn't paid, the data is often lost forever.

How do we protect our systems -

We should increase the security measures to protect the data.

·        Make sure all the software are up to date.

·        Do not click on any links or attachments unless you know and trust who created it.

·        Password protection policy should be strong and acceptable system usage policy

·        Blacklist unknown portals, with a bad reputation.

·        Exe file downloads should be blocked.

·        Users with administrative privileges should be re-evaluated and minimize these privileges

·        Security patching should be up to date and should not be ignored.

·        Create a robust alert system in the event of incidents

·        Data backup activity should be periodical so that recovery can be done in case of incidents.

·        Log file analysis and reporting should be done to establish patterns.

·        Monitoring systems should be in place to take preventive measures.

·        Data centers should be protected with the highest possible security systems

·        Regular training and workshops are essential to bring awareness about the latest trends in ransomware techniques.

·        Using strong and up to date security software help in preventing ransomware attacks.

Individuals play an important role in keeping network and systems safe from ransomware and other malware attacks. Responsibility not only lies with the IT team or security team to protect the organizations' data and networks from intrusions.

11.     Security Research > Wanna cry Ransomware. URL: https://www.zscaler.com/security-research/wannacry-ransomware?network=g&_bk=&_bt=285339245882&_bm=b&_bn=g&gclid=CjwKCAjwwJrbBRAoEiwAGA1B_aiIxxkiAA8sHeVBMRNrnDxYfwWc4XbA6-h463Qgfdcq95kmKM7N6RoCqEEQAvD_BwE

22.   https://www.cnet.com/news/wannacry-wannacrypt-uiwix-ransomware-everything-you-need-to-know/