Risorse utili per contrastare WannaCry

Ecco alcune risorse e tools utili per contrastare il ransomware WannaCry.

• Bollettino sicurezza Microsoft relativo al bug SMB ms17-010
  • https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
• Scan della propria rete alla ricerca di macchine vulnerabili:
  • nmap -sC -p445 –open –max-hostgroup 3 –script smb-vuln-ms17-010.nse X.X.X.X/X
  • E’ possibile scaricare lo script nse da questo link .
  • Lo script va copiato in /usr/share/nmap/script   (debian)
• WannaCry Decrypt:
  • https://github.com/gentilkiwi/wanadecrypt
  • Ovviamente occorre la chiave privata per poter decifrare i file!!!
• Suricata Signature per riconoscere WannaCry:
  • https://github.com/xNymia/Suricata-Signatures
• Patch per Windows XP (prima patch dopo il 2014):
  • https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
• Kill switch source:
  • https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/
  • https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
• Ntop:
  • http://www.ntop.org/ntopng/detecting-and-fighting-ransomware-using-ntopng-yes-including-wannacry/

Articoli correlati:

Semplici regole per proteggersi da WannaCry Report Rai 3: Wannacry Cybersecurity: Ntop Tutorial @ Workshop Garr 2017 Science Marathon 2017: Insicurezza del mondo Iot