Tag Archives: Microsoft SMB

Responding to Wana Decrypt0r / WanaCrypt0r Infections

As I am sure you are aware earlier this week a new variant of ransomware named WanaCrypt0r began to infect many systems worldwide using the vulnerability patched in March 2017. The infections were especially severe in the UK (hospitals were affected), Spain (banks, the ISP Telefonica and gas/electricity providers) among many others. The infections were spreading in a worm (defined) like fashion.

The ransomware uses the vulnerability exploited by the “Eternal Blue” exploit patched by Microsoft in Mach by their MS17-010 update. This exploit uses the SMBv1 (defined) protocol to enter a vulnerable system over port 445 (when that port is accessible from the internet). In some instances the CERT of Spain have observed the exploit installing the DoublePulsar malware on the already infected system. A live map of this malware’s global infections is available here. Once the malware obtains access to your system it installs the WanaCrypt0r ransomware to encrypt your files. As detailed by BleepingComputer it also terminates active databases and email servers so that it can encrypt them also.

On the 12th of May, the spread of the malware was temporarily halted by the actions of the malware researcher known as MalwareTech. They registered a website domain the malware checks if it exists while installing itself on your system. If it exists, it halts its installation and doesn’t encrypt your data (acting like a “kill switch”). I use the word temporary above since as the researcher points out all the malware authors need to do is to choose a different domain and re-release the updated malware (or worse they could use a domain generation algorithm (DGA)(defined) to make registering the websites by researchers even harder). The purpose of the malware checking if this domain was registered is to check if it is running inside a malware sandbox (defined).

How can I protect myself from this threat?
If you have not already done so, please install the MS17-010 security update (released in March 2017) on your Windows based servers and workstations. Researchers are simply saying “patch your systems” and that is what they mean. Microsoft discusses this advice in more detail in their MSRC blog post.

=======================
Note:
=======================
A full list of the versions of Windows affected by vulnerabilities patched within MS17-010 is provided at the end of this post.

If you are not sure how to update your systems, the following links below will assist if you are consumer/small business. Larger corporations should check with their IT team/system administrators install this update. If you can, please install all other remaining security updates:

Windows Vista
http://windows.microsoft.com/en-us/windows-vista/Turn-automatic-updating-on-or-off

Windows 7
http://windows.microsoft.com/en-US/windows7/products/features/windows-update

Windows 8.1
http://windows.microsoft.com/en-us/windows-8/windows-update-faq

Windows 10
http://pcsupport.about.com/od/keepingupwithupdates/f/windows-updates.htm

Microsoft have since released the MS17-010 update for all other remaining out of support Windows systems namely Windows XP, Windows Server 2003 and Windows 8.0. They are available as direct downloads from their MSRC blog post. I checked earlier today and these updates were not being offered by Windows Update and Automatic Updates for those older versions of Windows, please obtain the updates directly from their MSRC blog post.

While the “kill switch”for this malware was used (as mentioned above), it is very likely to return in the future. The steps below will better prepare you now and for the future.

I am aware Windows Vista is out of support at this time but it was supported when the MS17-010 update was released.

=======================
Update: 15th May 2017:
=======================
It is appears a new variant (Uiwix) of this threat is now circulating which does not have a kill switch. This variant does not appear to spread using a different vulnerability. Other variants are currently in-progress.

=======================
Update: 18th May 2017:
=======================
As mentioned above, newer variants of this malware are being made available. They exploit the same vulnerability as WannaCry but don’t spread in a worm like fashion.

I would suggest installing the MS17-010 as soon as possible since further ransomware is likely to capitalise on many devices (approximately 1 million still exposing the SMB protocol to the internet, with roughly 800k being Windows devices).

Moreover, the ShadowBrokers may release more exploits next month (and continue to do so on a regular basis) but this time we are unlikely to have security updates ready for them. My advice is to be prepared in June.

Thank you.
=======================

=======================
Update: 21st May 2017:
======================
The Eternals Rocks worm is now also spreading by exploiting exposed systems over SMB. The advice below to block installation of WannaCrypt should prevent infection of your systems. At this time, the worm is not carrying out malicious actions with infected devices. Instead it is setting up a C&C (C2)(defined) infrastructure and may leverage this for malicious actions in the future.

=======================
Bayer healthcare equipment was confirmed affected by WannaCry but service was restored in less than 24 hours. Other manufacturers have also issued security advisories:

Siemens

Smiths Medical

Medtronic

Johnson & Johnson

=======================
The US ICS CERT have issued an alert with recommendations for critical infrastructure devices. Affected vendors include those mentioned above and GE, Philips, Tridium, Emerson Automaton Solutions, Schneider Electric (among others).

Please note the above link for the ICS CERT advisory is https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-135-01D If this advisory is updated it will become https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-135-01E Further updates will change the final letter to F, G and so on.

=======================
ICS CERT also issued an FAQ on WannaCry which you may find useful.
=======================

Additional advice/considerations:
At this time there is no known way to decrypt your files if you have been effected by the WanaCrypt0r ransomware. If you have the option of restoring your files from a backup, please do so. Your only other option is discussed by BleepingComputer at the end of this article.

If you followed the advice earlier in the week and turned off your systems before they were infected, that was a wise precaution. However when you power them back on you will need to avoid them becoming infected before you can secure them. A French security researcher had a honeypot (defined) of theirs infected 6 times in 90 minutes.

If you can segregate your vulnerable devices (including devices within your network perimeter) so they don’t expose the following ports:

  • TCP port 445 with related protocols on UDP ports 137-138
  • TCP port 139
  • Also disable SMBv1 (it’s a deprecated protocol)
  • Please also block the Remote Desktop Protocol (RDP) port 3389 (defined) at the entry point to your corporate to prevent the spread of this malware as recommended by the US CERT.

Once you have updated your Windows devices against this vulnerability, please by all means resume normal operations but follow the advice of the US CERT and avoid having the SMB port exposed to the internet going forward as a defense in-depth measure (defined)(PDF).

Other recommendations are as follows:

  • It’s important to understand, installing the update mentioned in this post will protect your Windows systems from spreading the ransomware to other systems. If you click on a link in a suspicious email (or another source) the ransomware may still be downloaded but will only encrypt/effect your system.
  • For any critical systems, ask if they really need to be connected to the internet or not? Avoid unnecessarily connecting them.
  • Provide your staff with security awareness training (defined)(PDF). This will prevent this malware infecting your systems by means of phishing (defined) (which can still encrypt your data even if you have installed the above recommended security update, that update only blocks the spreading of the infection). According to the US CERT and HelpNetSecurity this advice isn’t confirmed but it will not reduce your protection.
  • Verify your organization can recover from a ransomware attack like this as part of your Business continuity process (BCP)(defined)(PDF).
  • If you have an incident response team, verify their standard response process against a ransomware attack like this to ensure it is fit for purpose.

Thank you.

 

=======================
Affected Windows versions:
=======================
While the MS17-010 security bulletin lists which versions of Windows are vulnerable to this ransomware, I have listed them all below (this applies to all 32 and 64 bit versions of Windows listed below):

Windows XP (with Service Pack 3)

Windows Server 2003 (with Service Pack 2)

Windows Vista (with Service Pack 2)

Windows Server 2008 (with Service Pack 2)

Windows Server 2008 (with Service Pack 2)(Server Core installation)(defined)

Windows 7 (with Service Pack 1)

Windows Server 2008 R2 (with Service Pack 1)

Windows Server 2008 R2 (with Service Pack 1)(Server Core installation)

Windows 8.0

Windows 8.1 (with 8.1 Update (April 2014))

Windows Server 2012

Windows Server 2012 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 R2 (Server Core installation)

Windows RT 8.1

Windows 10 Version 1507

Windows 10 Version 1511

Windows 10 Version 1607

Windows Server 2016

Windows Server 2016 (Server Core installation)

May 2017 Security Updates Summary

Today Microsoft and Adobe made available their expected monthly security updates.

Microsoft’s updates address 57 vulnerabilities more formally known as CVEs (defined). These are detailed within Microsoft’s new Security Updates Guide.

At the time of writing there are no Known Issues for this month’s Microsoft updates. The IT Pro Patch Tuesday blog while now updated since last month doesn’t contain this months updates yet.
====================

Before continuing with this months updates I wanted to provide information on a critical out of band (un-scheduled) update made available by Microsoft yesterday to address a vulnerability responsibly disclosed (defined) by Google Project Zero researchers Natalie Silvanovich and Tavis Ormandy within Microsoft’s Malware Protection Engine. The full list of affected products is listed within their security advisory. The exploit code for this vulnerability was later published within a tweet (which will not exploit the vulnerability).

I recommend updating your version of the Malware Protection Engine as soon as possible to version 1.1.13704.0 (or later) since this vulnerability when exploited by an attacker will lead to them obtaining system level access (NT AUTHORITY\SYSTEM)(defined)(namely the highest level of privilege within a Windows system) over an affected system.

====================
Also today Adobe issued two security bulletins to updates for the following products:

Adobe Experience Manager Forms (1x priority 2 CVE)
Adobe Flash Player (7x priority 1 CVEs)

The priority ratings are explained in this link. Depending on which version of Flash Player you have, please review the Adobe security bulletin or Microsoft bulletin as appropriate and apply the recommended updates. Google Chrome users will have the updated version installed automatically later this week.

If you use any of the above-mentioned Adobe products, please review the security bulletins linked to above and apply the necessary updates. As always the Flash update should be installed as soon as possible since exploit kits (defined) tend to take advantage of newly disclosed vulnerabilities very quickly.

You can monitor the availability of security updates for most your software from the following websites (among others) or use Secunia PSI:
—————
US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

A further useful source of update related information is the Calendar of Updates. News/announcements of updates in the categories of General Software, Security Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.

—————
If you use any of the above software, please install the appropriate updates as soon as possible. Steps for installing updates for Windows are provided on the “Protecting Your PC” page.

=======================
For the Microsoft updates this month, I will prioritize the order of installation for you below:
====================
Critical severity:
Microsoft Malware Protection Engine
Microsoft Office
Microsoft Edge
Internet Explorer
Microsoft SMB (CVE-2017-0277, CVE-2017-0278, CVE-2017-0279)
====================

Install the remaining updates at your earliest convenience.

As always you can find detailed information on the contents of each security bulletin within ComputerWorld’s Patch Tuesday Debugged column.

Another security pre-caution that you may wish to take if you have Microsoft EMET (please ensure your version of EMET is the most recent version 5.52) installed is to use it to protect you from Adobe Flash being used to exploit vulnerabilities when you open a Microsoft Office document or Adobe PDF file. I provide recommendations of how to do this at the end of the July 2015 Update Summary. Please note that Microsoft EMET will be out of support on the 31st of July 2018.

As usual; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

Thank you.

=======================
Update: 10th May 2017:
=======================
I wish to provide information on other notable updates from May 2017 which I would recommend you install if you use these software products. I only choose a small number of products to list here since it can easily become too many and I wish to highlight the security benefits of installing the latest version of applications many of us use everyday:

=======================
Mozilla Firefox:
=======================
Firefox 53.0.2

=======================
Mozilla Firefox ESR:
=======================
Firefox ESR 52.1.1

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, please update it as soon as possible to resolve these security issues.

=======================
Google Chrome:
=======================
Google Chrome: includes 1 security fix.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 stacked small horizontal lines, sometimes called a “hamburger” button) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the update to take effect.
=======================

=======================
Nvidia Geforce Drivers:
=======================
This update applies to Linux, FreeBSD, Solaris and Windows and resolves up to 15 security vulnerabilities. The steps to install the drivers are detailed here.

I detailed where Nvidia list their security advisories in a previous blog post.

=======================
Malwarebytes:
=======================
This update to Malwarebytes 3.1 (specifically v3.1.2.1733) resolves more than 1 security vulnerability (exact numbers and further details are not available).

Malwarebytes typically roll out updates in waves meaning it may be sometime before you receive this update. If the update is not automatically downloaded and installed in a timely manner, it is available from this link. Manual installation and general troubleshooting steps are available here.

=======================
Apple security updates:
=======================
Updates were made available by Apple on the 15th of May for iTunes for Windows, Safari, macOS Sierra, El Capitan and Yosemite, iOS, watchOS, tvOS, and iCloud for Windows.

Please see these links from Apple for advice on backing up your iPhone and iPad. Advice for updating tvOS is available here.

For advice on how to install updates for Apple devices, please see the steps detailed at the end of this Sophos blog post as well as this link (from my “Protecting Your PC” page). This link details how to update your Apple Watch.

Further information on the content of these updates is available this blog post.

=======================
Hitman Pro:
=======================
As recommended on my Tools and Resources page, Hitman Pro (now part of Sophos Security) has been updated to version 3.7.20 (Build 286). This update resolves 3 important vulnerabilities relating to the driver the tool uses for scanning. Any previous version of the tool should update automatically when opened to the most recent version.

=======================
VideoLAN VLC:
=======================
Late last week VideoLAN released version 2.2.5.1 of VLC. This update is available for Linux, Apple Mac OS X and Windows. It addresses (at least) 13 security issues mentioned here (I’ll explain my numbering using the list below). This update is available for download for the above operating systems from this page.

If you use VLC, please update as soon as possible to address the above mentioned security vulnerabilities as well as the general software bugs that were resolved.

1. Security hardening for DLL hijacking environments
2. Fix potential out-of-band dereference in flac decoder
3. Fix potential out-of-band reads in mpeg packetizers
4. Fix incorrect memory free in ogg demuxer
5. Fix potential out-of-band reads in subtitle decoders and demuxers
6. Fix ADPCM heap corruption (FG-VD-16-067)
7. Fix DVD/LPCM heap corruption (FG-VD-16-090)
8. Fix possible ASF integer overflow
9. Fix MP4 heap buffer overflows
10. Fix Flac metadata integer overflow
11. Fix flac null-pointer dereference
12. Fix vorbis and opus comments integer overflows and leaks
13. The plugins loading will not load external DLLs by default. Plugins will need to LoadLibrary explicitly.

=======================
Notepad++:
=======================
On the 14th of May, Notepad++ made available a new version updating it to version 7.4. While it is not a security update it includes a security related improvement namely: Improve certificate verifying method.

This version has since been updated to version 7.4.1 to resolve a number of non-security issues. If you use Notepad++, please consider updating to the most recent version to benefit from the security improvement and the bug fixes it includes.

Please note, the 64 bit version of Notepad++ became available in September 2016. It allows the opening of larger files and includes High Entropy ASLR (Address Space Layout Randomization (defined)) on a 64 bit version of Windows. I have discussed HEASLR on this blog before and it’s an excellent security measure/control/mitigation (defined). Further information on HEASLR can be found on Alex Ionescu’s blog.

=======================
GIMP (photo editor):
=======================
The open source ((the source code (human readable code) is free to view and edit by the wider IT community) photo editor GIMP has made available version 2.8.22 which resolves one security vulnerability. If you use this editor, please update it to this version (or later).

DoublePulsar exploit: victim devices are widespread

Last month the hacking group known as the Shadow Brokers made available a set of exploits (this appears to be their last remaining set). These exploits allegedly came from the NSA. A full list of the exploits is available here. Microsoft’s analysis of the exploits made which applies to their products and which security updates resolve them are available here.

What is DoublePulsar and how does it affect a system?
The exploit from this recently released collection which targets the Windows SMB Server component of Windows is known as DoublePulsar. It is a kernel mode (or ring zero (defined)) exploit which provides an attacker with full control over an affected system as well as providing a backdoor (defined).

It is also allows the execution of shellcode (defined) and the downloading of further malware. A complete list of it’s capabilities is available from Symantec’s analysis.

This threat is being called similar to the MS08-067 vulnerability from October 2008 which lead to widespread installation of the Conficker malware (which still persists today). That article estimates this vulnerability will be with us for many years to come. In my professional career I still see large numbers of servers and workstations not patched against the MS08-067 vulnerability even after all these years. The exploits made available by the Shadow Brokers have been made easy to use by others posting YouTube videos and documentation of how to use them. Security researchers are tracking the spread of this malware here , here and here.

How can I protect myself from this threat?
Preventing a compromise by this threat:

If your servers or workstations have Windows Server 2008 or Windows Vista (respectively) or newer installed, please install Microsoft’s security update MS17-010 as soon as possible. As a defense in-depth measure (defined)(PDF), please also consider blocking port 445 from being accessed externally (since this is unlikely to be the last SMB exploit we see).

Please note, Windows Vista systems are also no longer supported and you should consider upgrading (if you are not already in the process of doing so). Windows Server 2008 will be supported until the 13th of January 2020.

=======================
Update: 19th May 2017:
=======================
With the rapid propagation of the WannaCry ransomware, Microsoft made available the MS17-010 update for Windows XP, Windows Server 2003 and Windows 8.0. The updates for these out of support operating systems are available from Microsoft’s blog post.

Once the update is installed, if your servers or workstations have Window Server 2003 or Windows XP (respectively) installed, please block port 445 (the Windows SMB protocol port) from being accessed from an external network (as previously recommended by US-CERT and mentioned in a past blog post of mine).

In addition to blocking port 445 as mentioned above, I would also suggest the following:

If you can, segregate your vulnerable devices (including devices within your network perimeter) so they don’t expose the following ports:

  • TCP port 445 with related protocols on UDP ports 137-138
  • TCP port 139
  • Also disable SMBv1 (it’s a deprecated protocol)
  • Please also block the Remote Desktop Protocol (RDP) port 3389 (defined) at the entry point to your corporate to prevent the spread of this malware as recommended by the US CERT.

To check if your system has been compromised by Double Pulsar, you can use this tool.

Removing the threat from a compromised system:
You can remove the infection simply by shutting the system down since the malware does not persist after a reboot. You can then patch the vulnerability and block access to port 445 to prevent the malware from returning (both as mentioned above).

Thank you.

March 2017 Security Updates Summary

As you know Microsoft and Adobe released their scheduled monthly security updates. For Microsoft this release was anticipated especially since last month’s set was delayed.

Within the above linked to post I predicted Microsoft would make a large number of updates and they did just that. 17 bulletins in total are now available. These updates address 138 vulnerabilities listed within Microsoft’s new Security Update Guide. These vulnerabilities are more formally known as CVEs (defined).

Once again; there are no Known Issues listed within their March summary page. At the time of writing the IT Pro Patch Tuesday blog does not list any Known Issues. However, please check it before deploying your security updates just to be sure. As always, if any issues do arise, those pages should be your first places to check for solutions.
====================

Adobe issued two security bulletins today. One affecting Adobe Flash and the other for Adobe Shockwave Player. The Flash Player bulletin resolves 8x priority 1 vulnerabilities. While the Shockwave bulletin resolves 1x priority 2 vulnerability. These priority rating are explained in the previous link.

Depending on which version of Flash Player you have, please review the Adobe security bulletin or Microsoft bulletin as appropriate and apply the recommended updates. Google Chrome users will have the updated installed automatically alongside the updated version of Google Chrome which was made available last week.

If you use Flash or Adobe Shockwave, please review the security bulletins linked to above and apply the necessary updates. The Flash update should be installed as soon as possible since exploit kits (defined) tend to take advantage of newly disclosed vulnerabilities very quickly.

You can monitor the availability of security updates for most your software from the following websites (among others) or use Secunia PSI:

—————
US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

A further useful source of update related information is the Calendar of Updates. News/announcements of updates in the categories of General Software, Security Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.
—————
If you use any of the above software, please install the appropriate updates as soon as possible. Steps for installing updates for Windows are provided on the “Protecting Your PC” page.

=======================
Update: 22nd March 2017:
=======================
I wish to provide information on other notable updates from this month which I would recommend you install if you use these software products:

Notepad++ version 7.3.3

VideoLAN VLC Media version 2.2.5 (release currently in progress)

Malwarebytes Anti-malware version 3.0.6 CU3 (with Component package version: 1.0.75):
It is unknown how many vulnerabilities this addresses but this forum post mentions their resolution.

Malwarebytes Anti-malware version 3.0.6 CU4 addresses further vulnerabilities.

More details of the vulnerabilities resolved by Malwarebytes 3.0.6 CU3 have emerged. Researchers responsibly disclosed a technique which uses Microsoft’s Application Verifier to hijack an anti-malware application. More details of this vulnerability are available here and here.

Mozilla Firefox 52.0.1 (more details in this post on Pwn2Own 2017)

VMware Workstation 12.5.4 (relevant security advisories are here and here)

VMware ESXi, Fusion and VMware Workstation 12.5.5 (the relevant security advisory is here). This advisory resolves the vulnerabilities disclosed during Pwn2Own 2017 for the above listed products.

Wireshark 2.2.5 and 2.0.11

Putty 0.68 (while released in February; it contains important security changes)

Apple Security Updates: updates are available for iTunes, iTunes for Windows, Pages, Numbers, Keynote (for macOS and iOS), Safari, macOS Sierra, El Capitan and Yosemite, iOS, watchOS, tvOS, macOS Server, iCloud for Windows.

Please see these links from Apple for advice on backing up your iPhone and iPad. Advice for updating tvOS is available here.

For advice on how to install updates for Apple devices, please see the steps detailed at the end of this Sophos blog post as well as this link (from my “Protecting Your PC” page). This link details how to update your Apple Watch.

=======================

For the 17 Microsoft bulletins this month, I will prioritize the order of updates for you below:

====================
Critical severity:
Windows Graphics Component

Windows SMB Server

Microsoft Edge

Internet Explorer

Windows Hyper-V

Windows PDF

====================
Important Severity
====================
The update for Microsoft Office should be installed next due to it’s criticality. With the follow updates after it:

Microsoft Exchange

Microsoft IIS

Active Directory Federation Server

As always you can find detailed information on the contents of each security bulletin is published each month within ComputerWorld’s Patch Tuesday Debugged column.

Another security pre-caution that you may wish to take if you have Microsoft EMET (please ensure your version of EMET is the most recent version 5.52) installed is to use it to protect you from Adobe Flash being used to exploit vulnerabilities when you open a Microsoft Office document or Adobe PDF file. I provide recommendations of how to do this at the end of the July 2015 Update Summary. Please note that Microsoft EMET will be out of support on the 31st of July 2018.

As is my standard practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

Thank you.

US CERT Warns of Possible SMB Zero Day Vulnerability

Earlier this month saw the end of operations for a group known as the Shadow Brokers (who were responsible for the disclosure of critical security vulnerabilities in enterprise networking infrastructure). Their online auction of exploits remains open.

Among the exploits for sale is a possible zero day (defined) SMB (defined) exploit for Windows. With the potential use of this exploited predicted, the US-CERT issued a security advisory, which suggested disabling SMB version 1 and disabling the use of SMB version 2 at the network perimeter (preventing external access or internal traffic reaching outside of the corporate network). As previously noted on this blog, securing the use of SMB version 2 in this manner will also protect against the Redirect to SMB vulnerability.

These recommendations should better secure your corporate network against this exploit as well as future vulnerabilities.

Thank you.

Badlock: What You Need to Know

Yesterday as scheduled the Samba project and Microsoft made available their security updates to resolve the issue that was previously announced and named “Badlock.”

Why Should These Issues Be Considered Important?
While this issue is important (it affects a lot of Windows version from Server 2008/Vista up to and including Windows Server 2016/Windows 10), it’s severity was exaggerated in it’s announcement last month. Microsoft have assigned it an important severity rather than critical. They have done so since it is an elevation of privilege (EoP) (defined) issue that would allow an attacker to increase their privileges (which would allow them to cause even more harm) once they have already exploited another vulnerability to become present on your device in the first instance.

This vulnerability could allow an attacker to listen/analyse the traffic on your network; this technique is known as a man-in-the-middle-attack (MITM, defined). If your login credentials happened to be within the traffic the attacker gathers and analyzes there is a possibility they could obtain the unencrypted username and password used to access your device/account upon that device (even though your sensitive information is encrypted). Further discussion of this issue is available here.

How Can I Protect Myself from These Issues?
Updates from the Samba project and Microsoft are available to resolve this security issue. Please download and install them as soon as possible if you are affected by this issue.

=======================
Update: 13th April 2016:
Further information and advice for mitigating the Badlock issue is provided by US CERT in this vulnerability note. The Samba project also discusses its updated software releases in this release news post.
=======================

While there are no known issues with these updates at this time, as always I would recommend backing up the data on any device for which you are installing updates in order to prevent data loss in the rare event that any update causes unexpected issues.

Thank you.

Removing Conficker in 2015

In early August a research paper was published by a team of Dutch researchers trying to determine the reasons why there are more than 1 million computers worldwide still infected with variants of the Conficker malware (others known as Downadup) more than 6 years after it began spreading.

The reasons appears to be that the infections are present on systems that are no longer maintained or are embedded systems that cannot easily be accessed to carry out the removal of the malware. In addition, ISPs (Internet Service Providers) around the world have worked with their customers to remove this malware. However while their efforts have paid off, when the malware is removed efforts are not made to patch the now cleaned up systems and they quickly become infected again.

The research paper also points out that 15% of the systems infected with GameOverZeus are also infected by Conficker. The security vulnerability (CVE-2008-4037, CVE defined) exploited by Conficker in order to propagate itself affects the following versions of Windows:

=======================
Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Service Pack 3
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
Windows Vista (32 bit and 64 bit) with or without Service Pack 1
Windows Server 2003 (32 and 64 bit) Service Pack 1 and Service Pack 2
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems
Windows Serer 2008 (32 bit and 64 bit)
Windows Server 2008 for Itanium-based Systems
=======================

This security vulnerability was resolved by Microsoft with this security bulletin.

In order to assist with removing this malware from any systems I would like to offer the following advice:

=======================
For single computers used for home or small business use (up to a maximum of 5 computers):
=======================

  • If you don’t wish to continue using your old computer:
    Back up your important data to external media e.g. a USB jump/flash drive, an external hard disk or recordable CD/DVD. Computers than can run these above mentioned older versions of Windows should still have all that you need to back up your data e.g. USB ports and CD/DVD recording (burning) drives.
  • Responsibly dispose of your old computer and upgrade to a new computer. Follow the advice on the “Protecting Your PC” page to keep it free from malware.

=======================
If you want to continue using your old computer:
=======================

  • Disconnect the infected computer from the internet.
  • Using a malware free computer (e.g. a friends or a computer at an internet café) to download the Conficker Removal tool from Symantec. Bring the tool to the infected using an external hard drive, USB jump/flash drive, or CD/DVD. Run the tool by double clicking it.

The tool will remove all traces of the infection from the computer. I tested this tool on a Windows XP SP3 computer (disconnected from the internet) and it took just over 5 minutes to complete a full scan of the system.

  • If you suspect any other malware may be present on the infected computer, I would suggest using another computer to download any of the following free tools and transfer those tools as described above to the infected computer. Complete a full system scan with any of these tools.

I tested all of these tools using a Windows XP SP3 system not connected to the internet. All tools were able to complete scans without the assistance of an internet connection:

Microsoft Safety Scanner
Sophos Virus Removal Tool
Malwarebytes Anti Malware (free edition)

For Malwarebytes, the included definitions dated from June 2015 since no internet connection was available. Updating using this MBAM rules tool appeared to succeed but had no effect. The Microsoft and Sophos tools did not have this limitation.

  • Once the computer is free of malware, ensure the Window Firewall is turned on, re-connect the computer to the internet.
  • Visit Microsoft Update (for Window 2000, Windows XP and Server 2003 systems) to download and install all necessary security updates. Windows Vista and Windows Server 2008 systems can use the built-in Windows Update to download all necessary security updates.
  • Install anti-malware software that is compatible with your computer. Free and paid for software products are listed on this page. Corporate anti-malware software is listed here. Contact the manufacturer/vendor of the software to check it’s compatibility with your version of Windows if you are purchasing a paid for version. If an anti-malware product is not available for your version of Windows, disconnect the computer from the internet (to significantly reduce the possibility of malware infection) and consider purchasing a new computer sometime in the future at a time convenient to you.
  • If you wish, disconnect the computer from the internet (see the bullet point above about available anti-malware software). Continue using your computer as normal.

Update: 7th September 2015:
Please note that my suggestion to disconnect a Windows computer (that no longer receives security updates on a monthly basis) from the internet is an effective suggestion to reduce it’s risk of infection however air-gapping (defined) a device is not perfect solution.

If a device such as an external hard disk or USB flash/jump drive is connected to a computer not connected to the internet, it can still become infected if an infected file is present on this storage device and that file is transferred and loaded/opened on that computer.

To attempt to address some of the pitfalls of air-gapping I would recommend scanning all files that you intend to transfer using an up to date malware scanner or use VirusTotal.com (only for single or a small numbers of files, don’t upload files that contain private/sensitive data) before using files on older Windows systems to minimize the risk of malware infection. The link referenced above referring to air-gapped systems includes further advice which you may or may not decide to implement.

=======================

=======================
For computers for small businesses or larger businesses (more than 5 computers):
=======================
While the above steps to remove malware can be applied to any number of computers, the process becomes tedious and time consuming when more than 5 computers are infected. I would recommend seeking the assistance of qualified corporate IT security companies in your locality to perform a malware clean-up. Such companies generally offer a network security assessment and can provide on-going assistance to keep your network safe from security threats.

US-CERT has written an in-depth easily to follow guide with advice on how to remove the Conficker malware and prevent it from spreading further.
=======================

I hope that the above advice and resources are assistance to you in removing the Conficker malware from any Windows devices that you may have.

Thank you.