NSA Exploit Strikes Again

[Ben]

The Petya ransomware is infecting much of Europe, including Maersk shipping. I'm curious how far that actually affects their worldwide shipping and what backups they have for something like that.

Petya is using the same exploit as Wannacry did, which was developed by the NSA to poke into everybody's business. Thanks NSA.

http://www.foxnews.com/tech/2017/06/27/huge-ransomware-attack-hits-europe-sparks-mass-disruption.html

[Regolith]

Anyone who hasn't patched that vulnerability by now almost freaking deserves it. 

[agricola]

Anyone who hasn't patched that vulnerability by now almost freaking deserves it. 

you mean the virus or the NSA?

[Perd Hapley]

you mean the virus or the NSA?

Well played.

[Fitz]

Anyone who hasn't patched that vulnerability by now almost freaking deserves it. 

This

so far as we can tell, the kill switch found and used during the last one made tons of IT people say "Oh ok, we're safe now"

... so they were still unpatched.

[RevDisk]

This

so far as we can tell, the kill switch found and used during the last one made tons of IT people say "Oh ok, we're safe now"

... so they were still unpatched.

 

It's not the 90's anymore. Any business these days at a minimum needs monthly patching, reporting, enterprise grade AV and malware/baddie checking at multiple points all over the network. Plus you know, employee training. My email gets filtered three times before a user sees it, and we still sometimes get new stuff. Then you have the desktop AV just in case.

Morons. If it can't be patched, draw up a business plan for scheduled replacement. Or put them behind dedicated firewalls with very tight whitelists.

[Fitz]

It's not the 90's anymore. Any business these days at a minimum needs monthly patching, reporting, enterprise grade AV and malware/baddie checking at multiple points all over the network. Plus you know, employee training. My email gets filtered three times before a user sees it, and we still sometimes get new stuff. Then you have the desktop AV just in case.

Morons. If it can't be patched, draw up a business plan for scheduled replacement. Or put them behind dedicated firewalls with very tight whitelists.

We even patched old OS's that we said we were done patching, and people still got hit.

[RevDisk]

We even patched old OS's that we said we were done patching, and people still got hit.

In fairness, some blame lies on lots of vendors who screw up and do not keep up with security. I've seen quite a few legacy systems labeled "DO NOT PATCH, OR WILL BREAK COMPLETELY". I've always made it conditional that max of one year or we yank the cable. That's not as easy with say, a CNC router that's a couple million bucks. Embedded computer folks are generally the absolute stone cold worst, and charge insane pricing for support that's terrible.