What is Ransomware
It's an attack on your system, desktop, server, your online accounts or even mobile phone that involves hackers taking control of all the data files or in some cases complete computer making it completely inaccessible until a ransom is paid.
Current Threat of Wanna Cry is actually a ransomware which is developed to Encrypt users computer and lock the access, which also demands $300 from user to Decrypt the code.
Who are Infected Most.
This Ransomware already infected more than 200,000 Users across 150 Countries in the World Most affected areas include Europe and UAE. Most of the Machines which don't have windows security patches installed are affected most.
How can you safeguard your self from this Ransomware.
1) Visit Microsft Web site to install Security Patch MS17-0101. Click on link below do download the patch.
2) Disable SMBV1.0, (Use following link to disable SMB V1.0)
** note please open Windows Powershell in Administrator Mode.
3) Download the Tool from Malware Bytes Which Claims that it can stop the Ransomware from infecting your machine.
(Above Link is suggested by Computer emergency response team – India Team)
4) Make sure you update your Antivirus Software to the latest AntiVirus or Malware Database. If you dont have any Anitivirus please make sure you install one.
5) Take Offline Backup of your Data, We will prefer to take backup on CD/DVD Drive. Taking Backup on HDD or PenDrive might not be good idea as when you connect this devices back to restore the data, its data might also get Infected.
6) Dont Open any Email Attachment even if its from trusted resource. confirm with the sender that he / she has sent mail and then only open the attachment. Never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization"s website directly through browser.
For Organizations / SMEs
7) Establish a Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
8) Restrict execution of powershell/WSCRIPT in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
9) Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP%
paths. Ransomware sample drops and executes generally from these locations. Enforce application white listing on all endpoint workstations.
9) Deploy web and email filters on the network. Configure these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.
10) Disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running.
11) Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.
12) Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst| cmd|com|bat|dll|dat|hlp|hta|js|wsf
Finally : If your machine is infected and you are seeing the screen for Ransom.
Immediately take this machine off the network. Dont try to make any payment. There is no report that the attacker have removed the Virus from machine after payment.
We would like you to wait for few more days so that Companies like Quick Heal, Microsoft or other such organizations will develop tools to decrypt and clear you data.
*** Note this data is compiled from Computer Emergency Response Team India Web Site.