Skip to content

WannaCryptor爆發至今，已屆滿三年，卻仍然威脅全球

2017年5月12日，WannaCryptor（也稱為WannaCry和WCrypt）對全球電腦系統造成了前所未有的嚴重破壞，其利用Windows SMB的漏洞進行類似蠕蟲的主動式傳播行為，導致只要在區域網路中有一台主機中勒索病毒，會主動掃描區域網路中其他主機是否開啟445通訊埠，然後利用先前遭到外洩的美國NSA攻擊程式EternalBlue進行弱點滲透攻擊。

根據2020年第一季的ESET資安威脅報告，WannaCryptor依舊活躍並位居最常檢測到的勒索軟體之榜首，佔勒索軟體檢測到的40.5％。儘管它比上個月下降了不到一個百分點，但它在榜首的主導地位也沒有在4月消停。自2017年5月最大的爆發以來，至今已屆滿三年，其活躍程度著實令人十分不安，在2020年第一季的大部分時間裡，WannaCryptor的檢測歸因於廣泛認可的樣本，而這些樣本分佈於存在可能大量未更新設備的地區，例如土耳其，泰國和印尼。

圖1. 2020年1月至2020年4月前十名的勒索軟體排行榜（勒索軟體檢測的佔比）

導致整個WannaCryptor危機的漏洞：EternalBlue，在2020年第一季呈下降趨勢，但即便如此，EternalBlue仍具威脅，據Shodan稱，仍有大約一百萬台Windows設備使用SMBv1協議（請參考圖2），而這也意味著可能這一百萬台電腦將受到EternalBlue漏洞的攻擊。
*Shodan 是一個網路搜尋引擎，專門用來搜尋連上網際網路的各種裝置。Shodan 可搜尋的裝置和系統包括：網路攝影機、嬰兒監視器、醫療設備、工業控制系統 (ICS) 裝置、家用電器，以及資料庫等等。Shodan 會蒐集、彙整連網裝置所公開的一些基本資料和資訊，讓任何人都能輕易搜尋。

圖2. Shodan數據（截至2020年5月4日）

根據<圖2>顯示，今年美國依舊是擁有易受攻擊設備數量最多的國家，而俄羅斯則超過日本位居第二，值得關注的是南非，因為去年(2019年)它並沒有出現在名單上，現今卻排名第四。

除了WannaCryptor外，Diskcoder.C（又名Petya，NotPetya和ExPetya）和BadRabbit也都是利用EternalBlue漏洞進行攻擊的勒索軟體，但其實該漏洞早在WannaCryptor全球爆發前59天(2017年3月14日)，微軟就已公佈了Windows系統修復修補程式，請用戶更新；儘管您可能認為WannaCryptor應該給大家提供了很寶貴的教訓，但不幸的是，事實並非如此….從去年(2019年)年中開始，網路安全專家就開始對BlueKeep發出警報，BlueKeep是遠端桌面協定（Remote Desktop Protocol，簡稱RDP）中發現的一個遠程代碼執行（RCE）漏洞，也提醒用戶應盡快修補漏洞、進行更新，而同年11月更爆發了針對BlueKeep漏洞的系統之首波攻擊。

結論
三年過去了，面對勒索病毒或資安威脅，擁有資安危機意識及積極的解決是很重要的，預防措施永遠更勝於後續補救，ESET資安產品及企業解決方案能主動偵測已知(如WannaCryptor、Petya)、未知病毒及勒索軟體，抵禦網路攻擊或資安威脅，協助您打造良好的資安環境。

原文出處：www.welivesecurity.com/2020/05/12/wannacryptor-remains-global-threat-three-years-on/

  

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴，Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區，客戶來自各行各業，包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於ESET
ESET成立於1992年，是一家面向企業與個人用戶的全球性的電腦安全軟件提供商，其獲獎產品 — NOD32防病毒軟件系統，能夠針對各種已知或未知病毒、間諜軟件 （spyware）、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少，偵測速度最快，可以提供最有效的保護，並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”（Deloitte’s Technology Fast 500）公司，擁有廣泛的合作夥伴網絡，包括佳能、戴爾、微軟等國際知名公司，在布拉迪斯拉發（斯洛伐克）、布裏斯托爾（英國 ）、布宜諾斯艾利斯（阿根廷）、布拉格（捷克）、聖地亞哥（美國）等地均設有辦事處，代理機構覆蓋全球超過100個國家。

MENDEL 3.6 NOW AVAILABLE

GREYCORTEX has released the latest version of its MENDEL network traffic analysis solution. Version 3.6.0 brings important features, improvements, and bug fixes. The main features in MENDEL 3.6.0 include automatic plugin execution for faster response, more efficient storage for longer data retention, improved incident management, including generating incident reports, and many others.

MAIN FEATURES

Incident management 
Improves the ability to work with incidents, providing an easier way to define and describe security incidents and their management, and provide tools to export them into a final printable report (PDF) suitable for presentation and reporting

Automated Threat Response
MENDEL allows the automatic blocking of traffic on firewalls or sending notifications to external systems through custom scripts. The execution of the script is based on predefined event filter plugins.

Application Detection 
Enhanced flow detection, which can now recognize up to 4,000 commonly used applications to improve better visibility into specific services.

Multitier storage for longer data retention
A change in the way MENDEL stores data, with the goal of saving disk space and providing more effective storage for machines, with data retention over three months.

Parsing new RDP protocol and enhance existing parsers
Many improvements have been implemented for SMB, SNMP, SIP, SMTP, Modbus (TCP/UDP), and many other protocols.

JA3S support
Enhanced support for the JA3 fingerprint method, making it possible to fingerprint the entire cryptographic negotiation between a client and it’s server by combining JA3 + JA3S (server side fingerprinting).

Enhanced detection of malicious encrypted communication
MENDEL is able to detect malicious TLS certificates, malicious clients, or servers using JA3 fingerprints.

ENHANCEMENTS

Processing Cisco ASA NetFlow
Appliances are now able to process NetFlow data from Cisco ASA solutions in the NetFlow Secure Event Logging format.

Cloning MENDEL instances from VM templates
Allows the cloning of existing MENDEL instances in a virtual environment for faster deployment without installation. 

DB Optimizations and maintenance processes
Optimization and improvement for faster processing in user interface response for large networks. 

Extended protocol detection
Improvements in flow processing, with better flow direction for greater accuracy as well as support for dealing with asynchronous flows.

Samba backup
Enhanced configuration and password handling of data backup to Samba share, including a better connection error handling and consistency check for more reliable backup in the event of a backup error.

OTHER IMPROVEMENTS

Removed deprecated IDS signatures from Proofpoint
Added a certificate valid date into TLS protocol
Added the option to cancel data requests to most pages
Added support for Citrix Xen virtualization platform
Enhanced processing for false positives for external networks
Improve the processing of network statistics on a huge number of subnets in the User Interface
Enhanced reporting for Active Directory errors during processing logs
Enhanced port filter with full text
Added IPv4 Link-local subnet (APIPA) to default subnets
Updated Dell hardware monitoring tools to the latest version
Upgraded to latest Intel 10Gbits network cards drivers
Removed deprecated blacklisted sources

FIXED ISSUES

In general, our development team focused on improving user experience and reporting, as well as more improvements to user experience, system stability, and performance.

MENDEL PRODUCT SUPPORT

Full support is provided for the new released version 3.6.0 and previous version 3.5.x. Limited support is provided for previous version 3.4.x. Versions 3.3.x and older are no longer supported, end-users with valid support and maintenance or active SW subscription can upgrade to the supported version(s).

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

ESET Performs Best in Inaugural Test of Android Security Apps for Corporate Users

BRATISLAVA – May 27, 2020 – The enterprise version of ESET’s Android mobile security app, ESET Endpoint Security for Android, reached the best score in the first edition of the Android Security Apps for Corporate Users test by AV-TEST, a respected independent testing organization.

“Requirements of businesses differ from those of consumers, so it’s a step in the right direction by AV-TEST to design the Android test specifically for corporate use cases,” says Jiří Kropáč, Head of Threat Detection Labs at ESET.

In the first edition of the new test, three security solutions were tested, including ESET Endpoint Security for Android. In two of the three key parts of the test – Usability and Performance – all three solutions reached the best possible score. In the Protection part of the test, arguably the crucial one, ESET Endpoint Security for Android was the only app to detect 100% of the 3,100-strong sample set.

“This test shows ESET Endpoint security for Android is the right security solution for mobile devices allowed in corporate networks,” comments Kropáč.

The test of corporate Android security apps differs from the test for consumer apps in two main areas.

First, the set of samples for detection reflects the specifics of the business use of Android devices. For example, instead of infected game apps, the testing set contains threats known to target corporate users. Apps for the corporate version of the test were taken exclusively from the official Android app store, Google Play. This eliminates the need for tuning up the protection to also cover obscure types of threats that a corporate user will rarely encounter.

Second, the manageability of the security solution is also considered.

Besides that, the design of the performance test has been slightly adjusted so the new test evaluates the impact on website loading, document reading, or network traffic.

The testing of corporate Android apps was long overdue, according to Kropáč. “Nowadays, corporate internal systems tend to be accessible from mobile devices. Additionally, those devices are often also used for personal purposes. This combined means that the need for reliable corporate mobile security solutions is imminent. And where there is a need for reliability, there is also a need for independent tests.”

The results of the first edition of the test of Android security apps for corporate users can be found on AV-TEST’s website.

Head to ESET’s official Corporate blog, to read an interview with Jiří Kropáč.

Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers

Bratislava, Montreal – ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim’s central MS SQL Server database containing the organization’s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla’s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.

The fact that the attackers try to evade security software is concerning. “This shows the level of sophistication of this group and its intention to stay on the same machines for a long time,” explains Matthieu Faou, who has investigated the infamous group for several years. “Additionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn’t rely on any malicious domain,” says Faou.

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.“

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,” says Faou.

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper From Agent.BTZ to ComRAT v4: a ten year journey on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Bratislava, Montreal – ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim’s central MS SQL Server database containing the organization’s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla’s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.

The fact that the attackers try to evade security software is concerning. “This shows the level of sophistication of this group and its intention to stay on the same machines for a long time,” explains Matthieu Faou, who has investigated the infamous group for several years. “Additionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn’t rely on any malicious domain,” says Faou.

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.“

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,” says Faou.

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper From Agent.BTZ to ComRAT v4: a ten year journey on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×