8

Is it possible, or will this only spread via a Windows machine serving over SMB?

If Linux serving over SMB can spread wannacrypt, what's the approach to take?

unor
  • 246
  • 2
  • 19
fredrik
  • 671
  • 14
  • 20
  • I'd challenge the assumption, that Wine is not affected. AFAIK Wine is using the provided DLLs, so this should be thoroughly checked. – byteborg May 15 '17 at 11:55
  • WanaCrypt0r has been successfully executed in Wine by an Ask Ubuntu mod: https://askubuntu.com/a/914954/271 – Andrea Lazzarotto May 16 '17 at 09:44

3 Answers3

8

In general any ransomware can encrypt anything the infected user has access to, like any other malware can write to anywhere using the permissions of the account running it. That doesn't equal it becoming active for other users, but it can affect all shares the user has access to.

Countermeasures:

  • Prevent with virus protection & firewall, as usual.

  • Force all clients to install updates regularly.

  • Backups is the most powerful way to handle all ransomware after infection. Eventually some of your users will have one that wasn't yet recognized by your virus protection. Have a backup that your users don't have write access to. Otherwise the backups are useless, because the ransomware has equal access to write over the backups, too.

    An offline backup is the most safe way to achieve this, but might not be very practical as you need to do more manually, and remember to do it regularly.

    I usually have an independent machine that uses separated credentials to access the locations to be backed up. There, I have incremental backup that can store any changes over weeks or months. It's good against both ransomware and user errors.

WannaCry is using a vulnerability in Windows implementation of SMB: the protocol itself isn't vulnerable. From a news article on MalwareLess:

The WannaCry attacks are initiated using an SMBv2 remote code execution in Microsoft Windows OS. The EternalBlue exploit has been made publically available through the Shadowbrokers dump on April 14th, 2017 and patched by Microsoft on March 14. However, many companies and public organizations have not yet installed the patch to their systems.

The patch mentioned is MS17-010, Security Update for Microsoft Windows SMB Server (4013389):

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.

Therefore, it doesn't affect Linux. Windows is also safe after installing the update. However, if there still is a client computer with a non-patched Windows, the data on a share might not be in safe.

Esa Jokinen
  • 43,252
  • 2
  • 75
  • 122
  • By "in general" I mean you shouldn't concentrate on what a single ransomware is able to do currently. Ransomware evolves and your users may get infected with some other ransomware. – Esa Jokinen May 13 '17 at 08:06
  • Thanks - although you are right, this did not really answer my initial question on whether wannacry spreads only through SMBv1 on Windows. – fredrik May 15 '17 at 05:34
  • If you found an answer, you can add the citation as an answer instead of editing original question. Still, even if the worm part of the malware wasn't able to spread using other than Microsoft's implementation, meaning the protocol itself isn't the problem, the data cannot be considered safe. – Esa Jokinen May 15 '17 at 05:45
1

Found this, although no source was provided to back up the claim:

WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol. Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems are immune. This is true regardless of if the systems are running Samba, Wine, or any other Windows-emulation layer.

https://security.stackexchange.com/a/159405

fredrik
  • 671
  • 14
  • 20
0

No, but if you're worried...

Another thing to do is disable clients ability to connect outgoing ports TCP 137, 139 and 445, and UDP 137, 138 to WAN on your router.

This way you prevent your PCs connecting to non-LAN SMB servers. You should also use Windows firewall to prevent public / private SMB and allow domain-only communication for your subnet ranges if you can.

Finnally install the update and disable SMB 1.0 if possible. You shouldn't have anything to worry about if you do this.

NotoriousPyro
  • 260
  • 1
  • 5