China, Addicted to Bootleg Software, Reels from Ransomware Attack

Re:China, Addicted to Bootleg Software, Reels from Ransomwar... by nullValue on Monday May 15, 2017 @08:21PM (#14346404)

Has anyone read any article on how this vulnerability is spreading via SMB V1? With the Robert Morris worm/I Love you/Conficker we knew exactly how the worm spread.

From a programmers perspective, what is this thing doing? Is there an nmap filter to find vulnerable clients yet? If not, how do I create one. I'd like to be pro-active with my current customers concerns.

Thanks,

[ Parent | on HN ]

Re:China, Addicted to Bootleg Software, Reels from Ransomwar... by valarauca1 on Monday May 15, 2017 @09:01PM (#14346603)

It uses a buffer overflow in the SMBv1 message block to.

Effectively to filter it you need to block all SMBv1 packets. Which you should do already because the modern SMB is v3

Let alone you shouldn't be listening for AD management commands from the wide internet.

[ Parent | on HN ]

Re:China, Addicted to Bootleg Software, Reels from Ransomwar... by gcb0 on Monday May 15, 2017 @08:39PM (#14346503)

when those hit you probably read about it on slashdot and heard something on the late nite news.

now you get noise coverage everywhere.

[ Parent | on HN ]