Massive Attack WannaCry Update and Prevention. Eric Kwok KL.CSE

Transcription

1 Massive Attack WannaCry Update and Prevention Eric Kwok KL.CSE

2 Wannacry Q: After patch ms17-010, your computer A: YES / NO won't be infect wannacry ransomware

3 Wannacry Q: In order to against Wannacry attack, just A: YES / NO put all file into Recycle Bin.

4 Ransomware Ransomware target any PC users, whether it s a home computer, endpoints in an enterprise network, or servers used by a government agency or healthcare provider

5 Kaspersky Security Awareness Training People are not motivated to learn (only 22% believe they can be targeted by criminals); Employees do not see IT Security as partners and always try to bypass them; There is a lack of measurements on awareness, besides how many people got trained.

6 Kaspersky Security Awareness Training Online training modules Simulated phishing attacks Knowledge assessments Education automation Progress reports

7 What is Wannacry Ransomware Why this is so massive and different from before It is a worm Kill Switch Use NSA backdoor vulnerability to spread Initiated through an SMBv1 remote code DO NOT request user s interaction Automatic discovery & infect windows OS without MS patch

8 Worms + Ransomware Infect other unpatched Windows machines automatically Basically it scans LAN IPS for SMB/445 port open DO NOT request user s interaction (But Wannacry is not the only one) Spora Ransomware (Download or install automatically)

9 Endpoint Firewall + Network Attack Blocker IDS / IPS Function Blocking C&C Server Isolate Infected machine

10 Vulnerability MS : Patched by Microsoft on 14-Mar Vulnerability everywhere

11 Kaspersky Vulnerability and Patch Management Vulnerability Scan & Patch Management Automated distribution of patches and updates for 150+ applications

12 Automatic Exploit Prevention Control of potentially vulnerable applications Monitor pre-launch activities Tracking the origin of code

13 Ransomware is difficult to detect

14 Signature Based Detection The first layer protection Not only for detection

15 Known HIPS & Firewall (network traffic) URL Filtering (web traffic) Anti-Spam ( traffic) Anti-Phishing ( traffic) Blacklisting Unknown Heuristics Whitelisting App Control Advanced BSS AEP Systems Watcher The Kaspersky Lab approach Vulnerability Assessment & Patch Management Kaspersky Security Network 70% 29% 1% File Download File Start File Execution Reactive Technologies Proactive Technologies

16 Known HIPS & Firewall (network traffic) URL Filtering (web traffic) Anti-Spam ( traffic) Anti-Phishing ( traffic) Blacklisting Unknown Heuristics Whitelisting App Control Advanced BSS AEP Systems Watcher The Kaspersky Lab approach Vulnerability Assessment & Patch Management Kaspersky Security Network 29% 1% File Download File Start File Execution Reactive Technologies Proactive Technologies

17 Known HIPS & Firewall (network traffic) URL Filtering (web traffic) Anti-Spam ( traffic) Anti-Phishing ( traffic) Blacklisting Unknown Heuristics Whitelisting App Control Advanced BSS AEP Systems Watcher The Kaspersky Lab approach Vulnerability Assessment & Patch Management Kaspersky Security Network 29% 1% File Download File Start File Execution Reactive Technologies Proactive Technologies

18 The Kaspersky Lab approach Kaspersky Kaspersky Security Security Network Network Over 2.1 Billion Whitelisting Object 1 billion black Object A Urgent Detection System

19 Known HIPS & Firewall (network traffic) URL Filtering (web traffic) Anti-Spam ( traffic) Anti-Phishing ( traffic) Blacklisting Unknown Heuristics Whitelisting App Control Advanced BSS AEP Systems Watcher The Kaspersky Lab approach Vulnerability Assessment & Patch Management Kaspersky Security Network 29% 1% File Download File Start File Execution Reactive Technologies Proactive Technologies

20 The Kaspersky Lab approach Known Virus Signature Log Application Activity UnKnown Heuristics Terminal Malicious Program RollBack Malware action System Watcher Urgent Detection System KSN Kaspersky Unique Feature System Watcher

21 The Kaspersky Lab approach File Server Protection - Anti-Cryptor Protecting shared folder from crypto-malware Blocking access from hosts with suspicious activity Application Startup Control

22 Wannacry Live Demo 表演者曾受專業訓練, 觀眾切勿模仿

23 Questions? Useful Link : Local Support - corp.support@lapcom.com.hk Tel : Thanks You! New virus analysis : newvirus@kaspersky.com Ransomware : noransom.kaspersky.com