plc.myforum.ro

mark11 · Member Joined: 30 Mar 2014 Posts: 114

Cyber-attack
One of the greatest cyber-attack ever is under development starting with 11-12 May 2017 AfterMidnight.

Russia seems to be the main target but almost 90 countries have been attacked.

Cyber-attack Cyber-attack

Ransomware on the infected computers.
Cyber-attack Cyber-attack

What's NEXT?

https://wikileaks.org/vault7/#AfterMidnight

mark11 · Member Joined: 30 Mar 2014 Posts: 114

A 'kill switch' is slowing the spread of WannaCry ransomware
A security researcher may have helped stop the spread of the ransomware, which hit tens of thousands of PCs worldwide
Cyber-attack Cyber-attack

The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe.
It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.

http://www.itnews.com/article/3196513/security/a-kill-switch-is-slowing-the-spread-of-wannacry-ransomware.html

mark11 · Member Joined: 30 Mar 2014 Posts: 114

Wannacry 2.0

Cyber-attack Cyber-attack

Demonstration of WannaCry Ransomware Infection (non-tech)
https://www.youtube.com/watch?v=K8DJCqSPmdI&feature=youtu.be

WannaCry Ransomware Using Windows SMB Vulnerability
https://www.youtube.com/watch?v=4MMeSneDBNs&feature=youtu.be

Cyber-attack Cyber-attack

mark11 · Member Joined: 30 Mar 2014 Posts: 114

or set Windows Defender on automatic update...
hope you do not deactivate it...????
keep both your antivirus and WD active.. :rant:

mark11 · Member Joined: 30 Mar 2014 Posts: 114

Customer Guidance for WannaCrypt attacks
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

Microsoft Security Bulletin MS17-010 - Critical
Security Update for Microsoft Windows SMB Server (4013389)
Published: March 14, 2017
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Cyber-attack Cyber-attack

General information on ransomware:
https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx

mark11 · Member Joined: 30 Mar 2014 Posts: 114

Adylkuzz the attack is going on...
Adylkuzz Cryptocurrency Mining Malware Spreading for Weeks Via EternalBlue/DoublePulsar
After the WannaCry ransomware attack last Friday, "researchers at Proofpoint's security company have discovered a new Wannacry attack named Adylkuzz. It uses in a more discreet and different way the piracy tools recently revealed by the NSA (National Security Agency of the United States) .

Virus that spreads over Internet networks through vulnerable computers has been detected only now because it is latent and does not cauzează any virus-like symptoms. Specifically, this type of malware (malware) is introduced into vulnerable computers due to the same vulnerability in Windows used by WannaCry, detected by the NSA.
Symptoms of this attack conține loss of access to shared Windows resources and degradation of PC and server performance.

https://www.proofpoint.com/us/threat-insight/post/adylkuzz-cryptocurrency-mining-malware-spreading-for-weeks-via-eternalblue-doublepulsar

Must update your software..

https://www.commvault.com/blogs/2017/may/ransomware-when-potential-becomes-reality-fast-recovery-is-priority
https://kapost-files-prod.s3.amazonaws.com/published/557b16e44dc878618d0004cf/a-case-for-proactive-ediscovery.pdf

How to Protect Against Ransomware [Webinar]
https://discover.commvault.com/how-to-protect-against-ransomware-webinar.html
Don't tell people to turn off Windows Update, just don't
https://www.troyhunt.com/dont-tell-people-to-turn-off-windows-update-just-dont/

mark11 · Member Joined: 30 Mar 2014 Posts: 114

Microsoft Security Bulletin MS17-010 - Critical
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
According to Microsoft's MS17-010 Security Bulletin, the following operating systems contain the vulnerability:

Windows XP, Windows 7, Windows 8, Windows 10, Windows Server 2003, Windows Server 2008 R1/R2, Windows Server 2012, Windows Server 2016 Note: Both 32-bit and 64-bit versions are vulnerable.

1.) For any supported operating systems, utilize the "Windows Update" feature to download and apply updates.

2.) For unsupported operating systems, download English language security updates directly:
Windows Server 2003 SP2 x64
Windows Server 2003 SP2 x86
Windows XP SP2 x64
Windows XP SP3 x86
Windows XP Embedded SP3 x86
Windows 8 x86
Windows 8 x64
[URL=https://userscloud.com/dqgtjrkfatwr]windows8-rt-kb4012598-x64_f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu - 985 KB[/URL]
[URL=https://userscloud.com/x8w0w2livzqq]windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu - 873 KB[/URL]
[URL=https://userscloud.com/y8r96bzjk1xz]windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211(1).exe - 951 KB[/URL]
[URL=https://userscloud.com/6c9n150cbzzc]windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe - 951 KB[/URL]
[URL=https://userscloud.com/fokp5wx6sy7e]windowsserver2003-kb4012598-x86-custom-enu_f617caf6e7ee6f43abe4b386cb1d26b3318693cf.exe - 682 KB[/URL]
[URL=https://userscloud.com/t9n2jzgvje2c]windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe - 665 KB[/URL]
[URL=https://userscloud.com/cv4sdwabfy3v]windowsxp-kb4012598-x86-embedded-custom-enu_8f2c266f83a7e1b100ddb9acd4a6a3ab5ecd4059.exe - 666 KB[/URL]

3.) For non-English unsupported operating systems, download localized versions for Windows XP, Windows 8 or Windows Server 2003:
http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

4.) Alternatively, Microsoft recommends that you disable the SMB service following these instructions:
https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012

GENERAL SECURITY GUIDELINES
Run all software as User, not as Administrator.
Use trusted software and software patches that are obtained only from highly reputable sources.
Employ training and awareness programs to educate users on the warning signs of a phishing or social engineering attack.
Locate control system networks and devices behind firewalls, and isolate them from the business network, helping to make sure that messages with mismatched IP and interface origination do not reach the target system.
Help minimize network exposure for all control system devices and/or systems, and confirm that they are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that a VPN is only as secure as the connected devices.
Refer to our Industrial Network Architectures Page for comprehensive information about implementing validated architectures designed to deliver these measures.

mark11 · Member Joined: 30 Mar 2014 Posts: 114

How to avoid the WannaCrypt virus if you run Windows on a Mac
If you're only an occasional user of Windows on a Mac, make sure you don't get hit by current worms.
http://www.itnews.com/article/3197144/security/how-to-avoid-the-wannacrypt-virus-if-you-run-windows-on-a-mac.html

mark11 · Member Joined: 30 Mar 2014 Posts: 114

Hackers can use subtitles to take over millions of devices running VLC, Kodi, Popcorn Time and Stremio
Check Point researchers revealed a new attack vector threatening millions of users of popular media players, including VLC, Kodi (XBMC), Popcorn Time and Stremio. By crafting malicious subtitle files for films and TV programmes, which are then downloaded by viewers, attackers can potentially take complete control of any device running the vulnerable platforms.
https://www.helpnetsecurity.com/2017/05/23/subtitle-hack/