I’ll have a more detailed and up-to-date post on InfoWorld on Monday, but for now, here’s what you need to know if you’re concerned about the WannaCry
[See the full post at: How to make sure you won’t get hit by WannaCry/WannaCrypt]
|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
-
How to make sure you won’t get hit by WannaCry/WannaCrypt
- This topic has 191 replies, 30 voices, and was last updated 7 years, 10 months ago.
AuthorViewing 55 reply threadsAuthor-
-
Take a look at the list again.
For Win7, if you have the March, April or May Monthly Rollups you’re fine. If you have the April Preview you’re fine.
If you have the March Security-Only patch, you’re fine.
Otherwise, you’re begging for trouble.
The other Security-Only patches don’t enter into the equation.
-
Yes, I now see this. Yet I had initially misread it. Others might misread the list as well. Perhaps you should explicitly mention that for Group B user who avoid all updates which install telemetry, those users must have the March Security Only update installed.
1 user thanked author for this post.
-
-
But that tool only blocks WannaCrypt – which has already been blocked, for everybody, forever, thanks to Malwaretech.com. WannaCrypt is no longer the problem. The problem is with MS17-010. People have to get that baby installed. Now.
Not forever. The code can be very quickly modified to not look for this obscure domain name which has been sinkholed. Several people pointed out how quick and easily this could be done. This is why I think that Spain’s CERT tool remains relevant for the time being.
1 user thanked author for this post.
-
-
That’s as it should be. Everything’s fine. No need to install anything new.
As long as you have any one of the listed patches, you don’t need to install anything.
1 user thanked author for this post.
-
-
No. There’s no need to install any new patches unless you specifically don’t have ANY of the ones in the list.
5 users thanked author for this post.
-
-
-
-
-
-
-
Thank you very much for the link; will definitely read that, as am going to attempt dual boot briefly again before taking the inevitable full plunge. WinUpdate had suddenly come through, but broke tablet driver, and also broke the net too badly to fix except through re-formatting again. End of tether vanished miles back, lol, and had already been preparing to leave Windows behind; going entirely to Linux has just come round a lot sooner than I expected. Thanks for good wishes. Hope your updates come through okay, and great to meet you and others on this impressive forum.
1 user thanked author for this post.
-
-
-
I see the changes you’ve made.
If you’re looking at it still and going hm, perhaps this:
“If you have any of those patches already downloaded, then you’re good to go and you can sleep well at night.”
But hey, that’s just my thought. Thanks for all your help, Woody.
1 user thanked author for this post.
-
Woody-
May I suggest that instead of scanning the list of updates, it is easier to copy each of the relevant KBs from your post and paste it into “Search Installed Updates” (at the top of the window on the right-hand side)?
1 user thanked author for this post.
-
-
-
@netdef
Have you got a link for confirming v2.0 doesn’t have the kill switch? I’ve seen conflicting reports, some saying it was merely a theory on how the progression would happen – it left me confused, so I didn’t post anything about it until I found out more. Thks.
-
-
Wave two confirmed:
http://thehackernews.com/2017/05/wannacry-ransomware-cyber-attack.html
“main-article-info” Updated: Multiple security researchers have claimed that there are more samples of WannaCry out there, with different ‘kill-switch’ domains and without any kill-switch function, continuing to infect unpatched computers worldwide
Edit to remove HTML
~ Group "Weekend" ~
1 user thanked author for this post.
-
-
-
I don’t believe even MS has confirmed the exact initial attack vector, we are only presuming that it’s email, but we’ve seen infections that started from machines where the end user did NOT have local admin permissions.
From Microsoft at their war page: https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/
We haven’t found evidence of the exact initial entry vector used by this threat, but there are two scenarios we believe are highly possible for this ransomware family:
- Arrival through social engineering emails designed to trick users to run the malware and activate the worm-spreading functionality with the SMB exploit
- Infection through SMB exploit when an unpatched computer can be addressed in other infected machines
I’m going to theorize that if SMB is exposed on the firewall, that could also be a vector. (I would sure hope that no admins do this!)
~ Group "Weekend" ~
-
From @threatintel:
Two new #wannacry variants found: One had modified killswitch. Second has killswitch disabled, but ransomware payload doesn’t execute.
-
-
-
-
You and pigtail are both right. I’ve modified the download links (per PKCano’s suggestion) to get you directly to the download.
The Catalog has been very, very slow since this all started. The sound of billions of voices all crying out in pain, I think…
4 users thanked author for this post.
-
Yes, that’s correct.
Microsoft was kind enough to release these specific patches for XP and Win8, even though they were under no obligation to do so. They had already developed the patches, but prior to yesterday they were only available to customers who are paying big bucks to get extended support.
4 users thanked author for this post.
-
-
Personally I think that this is Microsoft trying to cover their rear end, instead of having any heart whatsoever for everyone who refuses to upgrade to the Windows 10 Telemetry Operating System (WTOS).
1 user thanked author for this post.
Yes it was a nice gesture from MS……. you know if some companies (not naming anyone) would realise/understand that by helping others they are helping themselves as well. Service/Customer relationship……… comes to mind. When a company adheres to this……… the sky’s the limit……. they and their customers flourish. And although MS’s gesture was very generous….. it was a responsiblity that they owed to the internet.
There is a saying “Noblesse Oblige” which basically means :
“It implies that with wealth, power and prestige come social responsibilities; it is a moral obligation to act with honor, kindliness and generosity.”But after saying all that…. it was a nice gesture and I am sure they will (and would have figured out it was a good move) regain some of the respect and loyalty that has been missing for sometime now. LT
Your time is the greatest gift you can give to someone. Unknown
1 user thanked author for this post.
-
-
-
-
-
Bottom line is that everyone should be patched up to date, regardless of Windows 10 being protected in this case by the original design of the current version of the WannaCrypt worm.
There is no guarantee though that future attacks would not take advantage of this vulnerability and other vulnerabilities already made public.1 user thanked author for this post.
-
-
-
-
No. There’s no need to install any new patches unless you specifically don’t have ANY of the ones in the list.
That sounds like me. I think.
1 user thanked author for this post.
-
@Navi……….. why don’t you have some sort of reminder on your calendar for example to remind you to check what the Defcon levels are. Woody’s popularity has made it very difficult for him to spread himself any further than he does. His website is stretched financially and to put out an email reminder to everyone would be stretching it even further I feel. He really does more than he needs for us and it’s for us to keep abreast with all of this for ourselves.
Also usually speaking the Defcon level rises towards the end of the month after making sure that the latest offering of patches do not cause trouble for people. So perhaps you could have a reminder for yourself to check then. Just thoughts! LT
“I worry about ridiculous things, you know, how does a guy who drives a snowplough get to work in the morning…… that can keep me awake for days” Billy Connolly
-
-
-
-
Oh, almost forgot, and ofcourse it could have started if any of those machines had any TCP/IP ports open to the web… Which could happen to a machine used by a layman, but is somewhere around unacceptable for a huge corporate server or network enviroment…
1 user thanked author for this post.
-
I ran across this: https://blog.fox-it.com/2017/05/12/massive-outbreak-of-ransomware-variant-infects-large-amounts-of-computers-around-the-world/
Infection vector
One of the confirmed infection vectors is the usage of the ETERNALBLUE exploit directly on machines which have SMB directly exposed to the internet.
This chapter previously stated that we were in the process of verifying if phishing e-mails were also an infection vector for the WanaCry ransomware. Thus far Fox-IT has found no evidence that any phishing e-mails were related to this specific ransomware outbreak, and we have therefor removed the related indicators from this blog.
Windows 10 Pro 22H2
1 user thanked author for this post.
-
-
-
-
… and I believe the instructions I gave are accurate. The problems with Kaby Lake, et. al., didn’t start until well after MS17-010 went out.
That said, I wonder how Microsoft will handle similar alerts in the future?
2 users thanked author for this post.
-
There has been a second wave of WannaCry/WannaCrypt. The first wave, detected on Friday, was blocked by registering and sinkholing a hard coded domain name which was found in the code. This created a kill switch to stop further infection. The second wave is a modified version of WannaCry/WannaCrypt which has no hard coded kill switch. This second wave was detected earlier today (Saturday).
The WannaCry/WannaCrypt infection also installs DOUBLEPULSAR which will also have to be removed from an infected computer.
1 user thanked author for this post.
Hey Woody,
Thanks so much for everything you are doing and thanks as well to your great helper experts. I couldn’t download for 8.1 64bit because I got a message that the site wasn’t working and the administrator of said site should be contacted. It seemed a bit weird because it was the link you posted (adjusted to the correct KB number for 8.1 instead of for win 7 as posted).
It was odd though that a MS download site was not encrypted, ie not https. Well, it’s not the first time MS has been odd and dubious and other adjectives.
Thanks to you and your team,
Mike
P.S. Have you ever thought of writing a Dummies book for Linux? – because the way things are going with MS that’s my next OS and your previous books were good and helpful.
1 user thanked author for this post.
From Heimdal Security:
Security Alert: WannaCry Leaves Exploited Computers Vulnerable to Round Two
Preventing another ransomware outbreak becomes essentialLast Updated on May 13, 2017
Andra Zaharia
Security Evangelist
“Given that 97% of phishing emails are ransomware and that 31% of the people who receive them open these emails (and often click on links/attachments), their chances for success are still quite high.Also, their international intent was already clear when they translated the ransom note and payment instructions in 28 languages, including Spanish, Swedish, Turkish, Vietnamese, Portuguese and many others.”
The article includes a link to MS’s Baseline Analyzer 2.3, to discover which updates are missing. The tool also lists the missing updates by severity and potential impact.
Another link has been added, for the CCN-CERT NoMoreCry Tool
Check out the full article here1 user thanked author for this post.
Guidance:
Ransomware: Latest NCSC Guidance
Created: 13 May 2017
Updated: 13 May 2017
Computer locked by ransomware
The latest NCSC guidance on RansomwareThe NCSC are aware of a ransomware campaign relating to version 2 of the “WannaCry” malware affecting a wide range of organisations globally. NCSC are working with affected organisations and partners to investigate and coordinate the response in the UK.
From investigations and analysis performed to date, we know that the malware encrypts files, provides the user with a prompt which includes; a ransom demand, a countdown timer and bitcoin wallet to pay the ransom into.
The malware uses the vulnerability MS17-010 to propagate through a network using the SMBv1 protocol. This enables the malware to infect additional devices connected to the same network.
The NCSC advise the following steps be performed in order to contain the propagation of this malware:
Deploy patch MS17-010:
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
A new patch has been made available for legacy platforms, and is available here:
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks
If it is not possible to apply this patch, disable SMBv1. There is guidance here:
https://support.microsoft.com/en-us/help/2696547
and/or block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445]
If these steps are not possible, propagation can be prevented by shutting down vulnerable systems.
Work done in the security research community has prevented a number of potential compromises. To benefit from this, a system must be able to resolve and connect to the domain below at the point of compromise.
www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
Unlike most malware infections, your IT department should not block this domain.
Anti-virus vendors are increasingly becoming able to detect and remediate this malware, therefore updating antivirus products will provide additional protection (though this will not recover any data that has already been encrypted).
The NCSC have previously published broader guidance on protecting your organisation from ransomware.
Reproduced in full from ncsc.gov.uk1 user thanked author for this post.
-
Yes, I have seen that same THN article published ‘everywhere’, but I haven’t seen anything to corroborate it. There has been so much other corroboration so far, that this seemed peculiar.
-
-
-
I believe Server 2008 R2 reaches end of support on Jan. 14, 2020. It can be patched with the Win7 patches.
Server 2008 died long ago, if memory serves. That’s the one being patched in this TechNet article.
Woody, I am talking about Windows Server 2008 specifically, not R2.
Look at the Microsoft Lifecycle Policy page :
https://support.microsoft.com/en-us/lifecycle/search?alpha=Windows%20Server%202008It clearly shows that Windows Server 2008 SP2 has extended support until January 14, 2020. So it is definitely not dead yet, and not out of support.
A Windows Server 2008 virtual machine that I have also can obtain patches up to this month.
I have also downloaded a copy of KB4018271 (May IE9 Cumulative Security Update) for Windows Server 2008 x64 and attempted to install it on Windows Vista x64 before, and the installation was successful.
By the way, the Vista patch I was talking about should be KB4012598. Sorry for the mistake.
Hope for the best. Prepare for the worst.
1 user thanked author for this post.
-
-
My hat’s off to you, Woody.
I know how much effort it takes to create solid, accurate summary information such as what you have published here, and it’s right on point for those who really want to know whether they’re protected from these threats. The web needs more “this is how it really is” sites like this one.
Thank you.
-Noel
-
-
-
Some other information that may help protect you:
Get rid (uninstall) old versions of java and flashplayer.
Use a good Anti-virus – Avast Free still supports XP
Don’t use IE. Firefox ESL still supports XP.1 user thanked author for this post.
-
-
-
-
If you haven’t yet seen the Sunday updates at the top of the original blog post, please check them out and tell me if you’ve seen more up-to-date, reliable info.
1 user thanked author for this post.
People at Microsoft claim that “nobody running Windows 10 was infected.” I can’t confirm that. Clearly, those who have installed MS07-010 through Win10 cumulative updates are OK (see the list below). But if all Win10 machines are immune, I’d sure like to see an explanation.
Here it is from
https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/The exploit code used by WannaCrypt was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems, so Windows 10 PCs are not affected by this attack.
Hi Woody,
to be totally exact, the March 2017 Previews of Monthly Quality Rollup for Windows 7 and 8.1 (KB4012218, KB4012219) also include the MS17-010 patch.
Regards, VZ
1 user thanked author for this post.
-
You only need one of the March patches. Either one has the fix for the vulnerability.
We have no idea what the effect on a pirated copy will be.1 user thanked author for this post.
-
-
-
From SecureList.com | May 15th:
I’ve seen conflicting reports about the exploit. Is it targeting SMBv1 or SMBv2?
The vulnerability exploited by the EternalBlue tool lies in the SMBv1 implementation. However, to exploit it, the tool also uses SMBv2. This means that it uses both SMBv1 and SMBv2 packets during the attack. Disabling SMBv1 or SMBv2 prevents the infection; however, while disabling SMBv1 (an old protocol) has no significant impact on modern systems, disabling SMBv2 can cause problems. This is why it is highly recommended to disable SMBv1 for the current attack and for the future.
The article contains plenty of good information 🙂
-
-
-
Any attached or networked drive is liable to be affected by ransomware (even if unmapped). So there’s no practical solution for a File History drive:
Be aware new ransomware variants will also encrypt or delete the backup versions of your files. This means that even if you have enabled File History, if you have set the backup location to be a network or local drive your backups might also be encrypted. Backups on a removable drive, or a drive that wasn’t connected when you were infected with the ransomware, might still work.
Microsoft Protection Center: Security Tips to Protect Against Ransomware -
From Symantec:
In some cases, files may be recovered without backups. Files saved on the Desktop, My Documents, or on a removable drive are encrypted and their original copies are wiped. These are not recoverable. Files stored elsewhere on a computer are encrypted and their original copies are simply deleted. This means they could be recovered using an undelete tool.
Benjamin Disraeli said: “I am prepared for the worst, but hope for the best.” What we seem to be doing, these past few days, and it is most certainly vital, is something in between these two points: We are discussing how to avoid the worst. Obviously, this is the best first line of defense and all that have contributed to this should be thanked profusely.
But, we are not spending much time on the actual topic of “being prepared for the worst”. And whether it is WannaCry/WannaCrypt, or something else down the road, I think we should be spending some time on what to do if you get hit. So, this is going to be my topic, perhaps Woody will want to start a new thread for this topic.
Back in November Woody posed the question: “What’s the best way to do a full image backup in Win7?” This discussion can be found here: https://www.askwoody.com/forums/topic/whats-the-best-way-to-do-a-full-image-backup-in-win7/ . Not surprisingly :), no consensus was reached, but a number of imaging programs were mentioned in this thread. Those new to this site, since November, should strongly consider going back to read this thread.
After that, to whatever extent you are unfamiliar with imaging your primary hard drive, and this is probably most valuable to the home user, the pros on this site will likely have their own strategies, it is time to become familiar with imaging and then starting to do it. Because if you get hit, the best/easiest solution may be as simple as going back to a previous image (depending on how old the image is, some data will be lost unless you also are running constant backups of critical files). But even if imaging isn’t the “full” solution, and you have to do a clean re-install, after that, you can then go to your latest image and get back to pretty great point, before the infection, where all/most of your programs are present, all/most of you data is present, and most important, all of your Windows updates, to that point, are present.
I am an attorney by profession, so I am not the person to tell you how to image, what program to use (I use Paragon Backup & Recovery), etc. That said, I do want to make one thing very clear to newbies to imaging: IT WILL NOT BE ENOUGH TO LEARN HOW TO IMAGE BY RUNNING YOUR IMAGING PROGRAM INSIDE OF WINDOWS FOR THE OBVIOUS REASON THAT, IF YOU GET HIT, AND ARE FROZEN BY SOMETHING, YOU CAN’T OPERATE IN WINDOWS. So, yes, by all means, start to learn how to image within Windows but make certain you have a CD/DVD/Thumb Drive, containing the imaging program, and your bios is set to boot to this device/media before launching Windows. If you don’t know how to do this, hire somebody to do it for you. And make certain you know how to image but, more important, make certain you know how to restore an image from your CD/DVD/Thumb Drive. Again, if you don’t know how to do this, or you can’t figure it out, then hire somebody to spend one or two hours to teach you how to do this.
In summation: Now, more than ever, part of preparing for the worst must include knowing how to image and actually having images available for emergencies. Personally, I keep two available (on an external hard drive that is turned off unless I am using it), just in case one image is corrupted. Some may want more images, but two seems to be the minimum. As for scheduling, you must decide for yourself the correct frequency for your situation. But, please, if you don’t know how to create images of your primary hard drive, it’s time to learn, or be taught, a new skill.
5 users thanked author for this post.
-
-
-
But if you wait a week or two after Patch Tuesday before installing the updates, you won’t be a Guinea Pig for everyone else if the patch has a problem.
Right on!
There isn’t just one risk here. It’s complicated, and requires a reasoned approach.
-Noel
1 user thanked author for this post.
-
-
depending on how old the image is, some data will be lost unless you also are running constant backups of critical files
This is only true if your OS and your data are in the same partition. Having separate partitions is a much better arrangement.
1 user thanked author for this post.
-
@Volume-Z
Confusion is being created by referring to the security-only patches as “rollups”.Please note the “rollup” is not security only:
Microsoft delivers the “Security Monthly Quality ROLLUP for Windows” through Windows Update to the PC. It contains both Security and non-security updates and is cumulative. Cumulative means that this month’s ROLLUP contains the previous month’s ROLLUPS. It is available to all Windows Users.
For those people who do not want the non-security, Microsoft provides the “Security Only Quality UPDATE for Windows.” It contains only the security patches
1 user thanked author for this post.
-
@Volume Z
Your information is incorrect.The “Security Only Quality UPDATES for Windows” are NOT CUMULATIVE.
To receive all security patches, you must install EVERY individual month’s security-only UPDATE. They are NOT offered through Windows Update. They have to be downloaded and manually installed.Only the “Security Monthly Quality ROLLUPS for Windows” offered through Windows Update are cumulative.
If anyone is running outdated AV software versions, now is the time to upgrade them to the latest release, as well as ensuring definitions are regularly kept up to date. i.e.:
1 user thanked author for this post.
Woody, on the main post/blog about one page down, this section was (I suspect) written before we knew a wave 2 was coming:
IMPORTANT details about WannaCrypt:
It clobbered lots of sites and many computers, but it’s no longer a threat. The folks at Malwaretech.com enabled a sinkhole that’s blocking WannaCrypt. No more infections.
Italics added . . . I feel fairly strongly that anyone newly arriving and seeing those italicized words will relax and not follow through on getting the March patch checked. Perhaps a revision of that section? 😀
Thanks!
~ Group "Weekend" ~
-
Never mind. I solved my own problem. Turns out that disconnecting from the internet, turning off all McAfee services (and every other program) and removing all USB accessories from their ports allows it to work properly. I disconnected the mouse right after I clicked on the agreement so that port would be empty as well.
When it completed, the USB ports were all dead, but pressing ENTER re-booted the system without need for a mouse, and when the system re-booted, the USB drives were all functional again.
So, thanks anyway!
1 user thanked author for this post.
-
Windows 7 KB4019264 was updated to KB4019265 new patch on 16th May 2017.
KB4019264 is the 2017-05 Security Monthly Quality Rollup for Win7. It is cumulative and contains three parts: security, non-security, and IE11 updates. It contains the patches from previous months’ Rollups. It is delivered through Windows Update as a CHECKED IMPORTANT update.
KB4019265 is the 2017-05 Preview of Monthly Quality Rollup for Win7. It contains previous months’ Rollup plus the non-security patches that will become part of the June 2017 Rollup. It is delivered through Windows Update as an UNCHECKED OPTIONAL update. It is unchecked because it is not meant to be installed by the general User. It is there for IT people and other similar individuals to test before it is released as part of the following month’s Security Monthly Quality Rollup.
The fix for MS17-010 was part of the March Monthly Rollup and has been a part of the Monthly Rollups since then.
Edit to add content
1 user thanked author for this post.
-
-
There is no problem leaving KB4019265 installed. The non-security patches for June that are included will be rolled into the June Rollup along with June’s security and IE11 patches.
Just realize, if you install the Preview patches each month, you are helping vet next month’s non-security updates.1 user thanked author for this post.
-
-
-
-
From nakedsecurity.sophos.com | 25 May 2017:
During testing, SophosLabs found that XP wasn’t the effective conduit for infection via the EternalBlue SMB exploit that many thought it was, while Windows 7 was easily infected. The research showed that WannaCry ransomware can affect XP computers – but not via the SMB worm mechanism, which was the major propagation vector for WannaCry.
…
Early in the outbreak, researchers determined that both SMBv1 and SMBv2 packets were used in the attack. Since both versions of SMB were in play, it could be theorized that Windows XP proved hard to infect because it does not include SMBv2, which was introduced in Windows Vista. But so far, it’s hard to reach that conclusion with 100% confidence.
…
The bottom line: if you use older versions of Windows, you’re at greater risk for attacks like these.
From theverge.com: Russell Brandom | May 30, 2017
Windows XP isn’t as vulnerable to the WannaCry ransomware as many assumed, according to a new report from Kryptos research. The company’s researchers found that XP computers hit with the most common WannaCry attack tended to simply crash without successfully installing or spreading the ransomware. If true, the result would undercut much of the early reporting on Windows XP’s role in spreading the globe-spanning ransomware.
The core of WannaCry is a vulnerability in a Windows file-sharing system called SMB, which allowed WannaCry to spread quickly across vulnerable systems with no user interaction. But when Kryptos researchers targeted an XP computer with the malware in a lab setting, they found that the computers either failed to install or exhibited a “blue screen of death,” requiring a hard reset. It’s still possible to manually install WannaCry on XP machines, but the program’s particular method of breaking through security simply isn’t effective against the older operating system.
“The worst-case scenario, and likely scenario,” the Kryptos report reads, “is that WannaCry caused many unexplained blue-screen-of-death crashes.”
1 user thanked author for this post.
Reporting on InfoSec 2017:
Was there a silver lining in WannaCry ransomware attack?“If there was a silver lining to wannacry, it’s that it [grabs] people’s attention” in regards to ransomware. What was once an obscure threat for a private individual, though an obsession for the security industry, is now a real and present danger in the minds of many more.
Ransomware, it should be said is far from dead. In fact, it appears to be in rude health: There were 246 new families of ransomware in 2016, compared to just 29 in 2015. A recent PhishMe report revealed that 97 percent of all phishing emails contain crypto ransomware and another report from Infoblox recorded a 35-fold increase in ransomware domains in 2016.
As awareness of the problem increases, ransomware’s astounding success may turn out to be a weakness, too. “This rate of expansion and investment won’t continue,” Ferguson said. “It will plateau.”
Read the full article on scmagazine.com:
By Max Metzger | June 8, 2017From EternalPot — Lessons from building a global Nation State SMB exploit honeypot infrastructure (May 28, 2017):
“Then I placed the systems live, deploying 7 Nodes into datacenters worldwide, opening up port 445 on the firewall for the first time, and made a brew while I waited for traffic to arrive.
By the time I returned back to my desk with my brew, most of the honeypots were already owned, or blocking things.
The reality is malicious SMB using MS17–010 exploits arrives at a Node every minute or so. If you think back to the Blaster worm from ten years ago, we’re back to that.”
1 user thanked author for this post.
Viewing 55 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Tracking content block list GONE in Firefox 138
by 4 hours, 55 minutes ago
-
How do I migrate Password Managers
by 4 hours, 18 minutes ago
-
Orb : how fast is my Internet connection
by 9 hours, 17 minutes ago
-
Solid color background slows Windows 7 login
by 10 hours, 37 minutes ago
-
Windows 11, version 24H2 might not download via Windows Server Updates Services
by 9 hours, 8 minutes ago
-
Security fixes for Firefox
by 8 hours, 37 minutes ago
-
Notice on termination of services of LG Mobile Phone Software Updates
by 21 hours, 21 minutes ago
-
Update your Apple Devices Wormable Zero-Click Remote Code Execution in AirPlay..
by 1 day, 6 hours ago
-
Amazon denies it had plans to be clear about consumer tariff costs
by 21 hours, 26 minutes ago
-
Return of the brain dead FF sidebar
by 8 hours, 37 minutes ago
-
Windows Settings Managed by your Organization
by 7 hours, 45 minutes ago
-
Securing Laptop for Trustee Administrattor
by 8 hours, 46 minutes ago
-
The local account tax
by 9 hours, 58 minutes ago
-
Recall is back with KB5055627(OS Build 26100.3915) Preview
by 1 day, 19 hours ago
-
Digital TV Antenna Recommendation
by 1 day, 11 hours ago
-
Server 2019 Domain Controllers broken by updates
by 2 days, 7 hours ago
-
Google won’t remove 3rd party cookies in Chrome as promised
by 2 days, 8 hours ago
-
Microsoft Manager Says macOS Is Better Than Windows 11
by 2 days, 12 hours ago
-
Outlook (NEW) Getting really Pushy
by 1 day, 14 hours ago
-
Steps to take before updating to 24H2
by 1 day, 5 hours ago
-
Which Web browser is the most secure for 2025?
by 1 day, 19 hours ago
-
Replacing Skype
by 1 day, 7 hours ago
-
FileOptimizer — Over 90 tools working together to squish your files
by 2 days, 6 hours ago
-
Excel Macro — ask for filename to be saved
by 1 day, 3 hours ago
-
Trying to backup Win 10 computer to iCloud
by 1 day, 7 hours ago
-
Windows 11 Insider Preview build 26200.5570 released to DEV
by 4 days, 12 hours ago
-
Windows 11 Insider Preview build 26120.3941 (24H2) released to BETA
by 4 days, 13 hours ago
-
Windows 11 Insider Preview Build 22635.5305 (23H2) released to BETA
by 4 days, 13 hours ago
-
No April cumulative update for Win 11 23H2?
by 3 days, 1 hour ago
-
AugLoop.All (TEST Augmentation Loop MSIT)
by 4 days, 14 hours ago
Remembering Woody
