As you undoubtedly know, the WannaCry/WannaCrypt ransomware attack has spread throughout the world. Some reports indicate the attack has been slowed but there are fears we haven’t seen the last of the damage.

We bring you an updated briefing from EC-Council on standard precautions you and your organizations can take to protect your systems. Please also do your research as situations vary.

As you may have heard, in last few days a massive cyber attack has infected machines around the world. The attack, called “WannaCry”, locks users out of their own systems and demands a ransom payment to release files.

What is wannacrypt? (WannaCry / Wcry)

A new ransomware attack, perhaps the largest so far, was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems. 200,000 machines have been infected in just a few days.

What is the infection process?

Arrives via phishing email (pdf) and spreads like a worm using covert channels and exploiting the Windows SMB vulnerability (aka EternalBlue), which was fixed by Microsoft in March (MS17-010)

  • Payload delivered via exploit running as a service
  • It performs encryption in the background, with key-built in (no contact to C2 necessary)
  • Uses tor to stay anonymous
  • Drops ransom notes in 25+ languages
  • Encrypts shared and local files (176 types of files)

Ransom note demands $300 within 3 days or $600 within 6 days or lose files. There is no guarantee of recovery of files.

Wannacrypt-wanncacry-briefing-2b

WannaCry has so far has impacted over 120 countries (and counting) and a large number of computers. In this heightened situation, we request you to stay vigilant while using your computers. While dealing with any emails from any unknown email address, do not click any link or open any unknown attachments. We request you to follow the best practices outlined below while performing your daily operations:

  • Do not open attachments in unsolicited e-mails, even if they come from people in your contact list.
  • Do not click on any URLs contained in an unsolicited e-mail.
  • Report any suspicious emails or attachments to the IT/IS team.
  • Follow the Computer Usage policy.
  • Do not download software, videos, MP3s, etc.
  • Check that your antivirus is updated and running in any machine you are using.
  • Backup your critical data periodically.

If you believe your computer has been infected, immediately disconnect your machine from the network by pulling the LAN cable out of the port in your computer and call the information security team. Do not try to restore any data on your own.

Click here to download the E-Council report.

Summit Consulting Limited is the Authorized Training Centre for EC- Council in Uganda. Enroll for EC-Council courses at our Training Institute, click here for details