How are you all handling the malware ambush

egrizzly

at work we had to stay overtime for two hours to deal with the massive malware that broke out on Friday (March 16). Our company has a lot of remote users who had to call in and wait on hold forever to be patched.

was there a working auto-patch deployment that you all implemented for remote user.

Mike7

Some suggestions and random thoughts.

In a previous engagement, we had users who for various reasons ignore Windows's notification to reboot PC for security updates; they either never logoff or just put laptop to sleep or hibernate mode. Some of them require local administrator access due to nature of their work. We had laptops that were almost a year behind for security patches. We ended up using group policy to enforce automatic updates and force their PCs to reboot after applying.

Wannacry uses a Mutex. If you create the mutex say via PowerShell, it will not encrypt. Some tools have been released that does this, e.g. https://www.renditioninfosec.com/2017/05/wanacry-because-your-organization-is-slow-to-patch-stop-the-tears-with-tearst0pper/ and https://www.minerva-labs.com/post/immune-yourself-from-wannacry-ransomware-with-minervas-free-vaccinator


You can disable SMB1 to prevent worm from infecting those that are not patched. In my previous job, we disabled SMB 1 for all our production servers as a preventive measure. Windows Vista/Server 2008 and higher supports SMB2. If you have Linux boxes, SAMBA 3.6 and higher supports SMB2. And that was in 2015. Even Microsoft gave the same advice in 2016.

Usual disclaimer applies: The above are suggestions; you need to test and I am not responsible.