Topic: Wannacry/Wannacrypt SMB flaw - checking SME 9.x not vulnerable, please confirm

[stabilys]

Your user was an idiot, but that doesn't mean there was an SME vulnerability.  A file server is going to do whatever the connected client tells it to...

It's safer to assume ALL users are idiots, including oneself, because it is at some time true. I've seen brilliant people - in their area - commit barbarities in mine. And I've done them too!

So we put in place what protections we can and a way of backing out of disaster if feasible.

And as far as the WannaCry/SMB vulnerability is concerned, assuming the SME is NOT vulnerable to the SMB attack, that in NO WAY protects against an encryptor being run by any user. Thinking it does is a confusion of themes. For example:

Usual scenario:

- company gets 200 bona-fide UPS messages a day
- new UPS message comes in, user opens it
- nothing happens, user shrugs and moves to next message
- fileserver encrypted 30 min later

I've had to deal with this in the past. The only solution was for them to pay the ransom as their backup was not up to date and it would have taken days + $$$$ lost business to restore. Not nice.

And was the user really an idiot? Would I have opened that email? Probably. I might have been more suspicious about the result...

[guest22]

Don't forget, the Wannacry is just the to key to open the door which is Windows flaws. An end user may expect he is provided with safe company assets and systems. So that brings us to the IT department.... The IT department has the 'difficult task' to ask for budget and explain why security on email is required.... and training.....

[guest22]

At the end, very few understand what email actually is and what it was designed for... So now that some get bitten in the behind, they start blaming everybody except themselves... So the general public got 'educated' by fancy MTA's like Outloook, and added 'functionality' was added, but nobody questioned the security aspects except for spam and viruses. There is a lot more to it.

[stabilys]

...
3. The end user opens the email attachment
...
5. The malicious code is aware it has local network access and can do its thing by itself, and no longer needs a carrying agent such as email and a unaware user to open an attachment
...

RequestedDeletion, slight misapprehension here, there's some evidence the infection was spreading directly from network to network using SMB and ports that were open on firewalls (ie 445). This is not definitive. It no doubt spreads by email too.

Readers might like to check this analysis and consider their ports:

https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/

MeJ

[guest22]

Good that we are all interested in this issue.

I've read the article, but see no way the virus can get to a network without a user opening malicious attachments. So to me it seems my 1 through 5 still stands, where maybe 5 is more sophisticated.

[Stefano]

I found an article that explains a (quite) simple workaround

https://www.ossramblings.com/Detecting-And-Stopping-Cryptolocker-Type-Viruses

it is not perfect, but may help

[guest22]

Another way is to simply shut down samba and use webdav instead for sharing files. Don't forget, samba is a proprietary protocol, webdav is not. Hence the popularity of systems like Nextcloud.

[Stefano]

true but unworkable in 99% of offices

it's like "simply don't use windows" (I don't use it).. it would solve many problems, but will arise many others..
so we must face windows and try to make it work in the safer environment we can

[stabilys]

Another way is to simply shut down samba and use webdav instead for sharing files. Don't forget, samba is a proprietary protocol, webdav is not. Hence the popularity of systems like Nextcloud.

I too am not in any way fond of Microsoft. I started out on IBM 360 system at CDC as a programmer/system analyst, and moved to Novell in micro systems later. I moved all our clients from Novell 4 when WfW 3.11 was released and beat Novell in every way for our client's needs.

I stopped using Microsoft on MY desktop in '99 after:

1. MS Word ate my thesis the day before I had to present it (23 hours of rewriting and reassembly from backups) and
2. MS Windows got a virus. I had all protections running, am extremely careful (I've had an internet email account since 1988) and it did not matter - the virus exploited a coding flaw and infected my system.

I still use it for my music workstations and playing games, but that's all.

UNIX-style OS's have won everywhere except the desktop. It's worth remembering that UNIX-style systems have never been particularly secure and were originally and briefly single user (that's the Un in Unix!) - the very first internet worm, the Morris worm, exploited flaws in UNIX networking code.

But Windows still rules the desktop in business and government and always will.

My colleagues have convinced me that with this I have up to put.

So, while I agree with your proposals in principle, it ain't going to happen. We have to protect the infrastructure that is there. There is no way that users who barely can scratch their IT arses will ever learn to use anything other than drive letters.

MeJ

[guest22]

true but unworkable in 99% of offices

Maybe that is because 99% of the offices do not think. Sharing files is one of the oldest IT mechanisms, just like e-mail. Nothing to do with Microsoft of PC OS used. Maybe we should build in an option into SME Server for people to choose a technology and protocol.

[stabilys]

I found an article that explains a (quite) simple workaround

https://www.ossramblings.com/Detecting-And-Stopping-Cryptolocker-Type-Viruses

it is not perfect, but may help

Interesting, thanks...

[Stefano]

Maybe that is because 99% of the offices do not think. Sharing files is one of the oldest IT mechanisms, just like e-mail. Nothing to do with Microsoft of PC OS used. Maybe we should build in an option into SME Server for people to choose a technology and protocol.

I would like to offer something different but:
- how many users out there will use it? I mean: almost nobody will be interested in something that need some tricks to work on their workstations.. samba is there, it works.. even if not safe, it will always be the preferred tool
- how much work does it need? have you got any idea about a (workable and sustainable) solution?

[brianr]

I would like to offer something different but:
- how many users out there will use it? I mean: almost nobody will be interested in something that need some tricks to work on their workstations.. samba is there, it works.. even if not safe, it will always be the preferred tool
- how much work does it need? have you got any idea about a (workable and sustainable) solution?

This would have to work WS to WS (Windows, Apple and Linux) as well as WS to Server, and allow printers to be shared...

[stabilys]

Just to finish off this thread and in reference to the opening question, Charlie Brady kindly pointed me to this:

https://access.redhat.com/articles/2243351

and pointed out that SME-server systems updated post March 2016 will have the fixes.

MeJ

[brianr]

From here:

https://nakedsecurity.sophos.com/2017/05/17/wannacry-the-ransomware-worm-that-didnt-arrive-on-a-phishing-hook/

It would appear that this did not start at with an unfortunate clicking on a link or executing an attachment in a phishing email, but directly through an open SMB port.

<smug mode on> So, those of us with networks of workstations protected by an SMEServer in server-gateway mode would be completely protected <smug mode off>

Actually even if we did have SMB ports open, they would normally only terminate on the SMEServer, and still be safe!