{"id":1727,"date":"2017-05-15T14:27:39","date_gmt":"2021-06-02T06:27:39","guid":{"rendered":"http:\/\/10.10.10.99\/wordpress\/?post_type=news&p=1727"},"modified":"2021-08-26T13:16:53","modified_gmt":"2021-08-26T05:16:53","slug":"defend-against-wannacry-wcry-ransomware","status":"publish","type":"news","link":"https:\/\/www.udshk.com\/?news=defend-against-wannacry-wcry-ransomware","title":{"rendered":"Defend against WannaCry\/Wcry Ransomware"},"content":{"rendered":"\n

Due to the WannaCry\/WCRY Ransomware attack around 150 counties, we need to notify how our security product to against this attack.  The following is the information for protect your origination.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

For the Forigatet<\/strong> product:
Update the IPS signature and anti-virus signature
http:\/\/blog.fortinet.com\/2017\/05\/12\/protecting-your-organization-from-the-wcry-ransomware<\/a>
<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

For TippingPoint<\/strong> product:<\/p>\n\n\n\n

Login to the TMC account https:\/\/tmc.tippingpoint.com\/TMC\/<\/a> and download the Ransom_WCRY_i.csw DV toolkit and import to the IPS
 The filters in the CSW are designed to detect the propagation of the malware known as WannaCry\/WCRY by looking for the malware binary download.
<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

For Sophos<\/strong> UTM:
Active the Advanced Threat Protection in the firewall
https:\/\/community.sophos.com\/products\/unified-threat-management\/f\/network-protection-firewall-nat-qos-ips\/91927\/utm-advanced-threat-protection-blocks-kill-switch-url-for-wannacry-also-referenced-as-wcry-wannacrypt-and-wanacrypt0r<\/a>
<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

For Sophos<\/strong> Intercept X:
https:\/\/community.sophos.com\/products\/intercept\/f\/information\/91942\/intercept-x-releasing-any-new-updates-for-wannacry-ransomware\/332939<\/a>
<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

For Lumension<\/strong>:
Apply the latest Windows Patch MS17-010 for all Windows computers by Lumension
https:\/\/www.lumension.com\/vulnerability-management\/patch-management-software.aspx<\/a>

\"\"<\/p>\n\n\n\n

For Splunk<\/strong>:
Steering Clear of the “WannaCry” or “Wanna Decryptor” Ransomware Attack
https:\/\/www.splunk.com\/blog\/2017\/05\/13\/steering-clear-of-the-wannacry-or-wanna-decryptor-ransomware-attack.html


<\/a>\"\"<\/p>\n\n\n\n

On the 2nd Phase of the Infection Chain, the mssecscr.exe will call back to C&C for the key and OpenDNS will terminate the connection between victim the C&C.  This will prevent the exploit of the Wannacry<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

For questions or technical assistance, please contact Bread Wong<\/a> or (852) 28510271 (Office).<\/p>\n","protected":false},"excerpt":{"rendered":"

Due to the WannaCry\/WCRY Ransomware attack around 150 counties, we need to notify how our security product to against this attack.  The following is the information for protect your origination. For the Forigatet product:Update the IPS signature and anti-virus signaturehttp:\/\/blog.fortinet.com\/2017\/05\/12\/protecting-your-organization-from-the-wcry-ransomware For TippingPoint product: Login to the TMC account https:\/\/tmc.tippingpoint.com\/TMC\/ and download the Ransom_WCRY_i.csw DV toolkit and import to the IPS The filters […]<\/p>\n","protected":false},"author":1,"featured_media":2451,"comment_status":"closed","ping_status":"closed","template":"","tags":[],"news-category":[],"class_list":["post-1727","news","type-news","status-publish","has-post-thumbnail","hentry","entry","has-media","owp-thumbs-layout-horizontal","owp-btn-normal","owp-tabs-layout-horizontal","has-no-thumbnails","has-product-nav"],"_links":{"self":[{"href":"https:\/\/www.udshk.com\/index.php?rest_route=\/wp\/v2\/news\/1727","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.udshk.com\/index.php?rest_route=\/wp\/v2\/news"}],"about":[{"href":"https:\/\/www.udshk.com\/index.php?rest_route=\/wp\/v2\/types\/news"}],"author":[{"embeddable":true,"href":"https:\/\/www.udshk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.udshk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1727"}],"version-history":[{"count":0,"href":"https:\/\/www.udshk.com\/index.php?rest_route=\/wp\/v2\/news\/1727\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.udshk.com\/index.php?rest_route=\/wp\/v2\/media\/2451"}],"wp:attachment":[{"href":"https:\/\/www.udshk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1727"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.udshk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1727"},{"taxonomy":"news-category","embeddable":true,"href":"https:\/\/www.udshk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fnews-category&post=1727"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}