Advisories

MyCERT is aware of the outbreak of a ransomware called as WannaCry. This ransomware is also referenced online under various names – WCry, WanaCryptor, WannaCrypt or Wana Decryptor. Ransomware is type of malware that infects computing platform and restricts users’ access until an amount of ransom is paid in order to unlock it. Once the ransomware infected a system, the malware scans and infects other vulnerable systems within the same network.

 

It exploits a vulnerability found in Windows, known as EternalBlue, that Microsoft patched in March (MS17-010). The vulnerability is in the Windows Server Message Block (SMB) service.

• https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

 

 

• Files on infected computer are encrypted and the owner is unable to access the files until a ransom of $300 worth of Bitcoin is paid.

• Individuals and organizations are discouraged from paying the ransom, as this does not guarantee access will be restored. Figure 1 shows the ransomnote found on infected computer. Figure 2 shows the text file created by the ransomware that explaining what has happened and instructions on how to pay the ransom.

• WannaCry encrypts files with the following extensions, appending .WCRY to the end of the file name:

 

 

 

Figure 1: WannaCry ransomnote (source: Securelist.com)

 

Figure 2: A text file dropped by the ransomware (Source: http://www.cyberswachhtakendra.gov.in)

 

 

• Unpatched Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, Windows 2016.

 

 

Users of this product are advised to review and patch the vulnerability described in MS17-010: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

 

 

Users are advised to take the following preventive measures to protect their computer from ransomware infection:

 

 

Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

 

For further enquiries, please contact MyCERT through the following channels:

E-mail: [email protected] or [email protected] â€¨

Phone: 1-300-88-2999 (monitored during business hours)


Fax: +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)


SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888


Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT


Web: https://www.mycert.org.my

Twitter: http://www.twitter.com/mycert

Facebook: http://www.facebook.com/mycert.org.my

Cyber999 Mobile Apps: IOS Users or Android Users

 

[10] https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

[11] https://isc.sans.edu/diary/22420