General

Customer Guidance for WannaCrypt attacks

15 May 2017 > General,

Microsoft solution available to protect additional products

Many Microsoft customers around the world and the critical systems they depend on were victims of malicious “WannaCrypt” software. Microsoft worked throughout the day to ensure they understood the attack and were taking all possible actions to protect customers. This blog spells out the steps every individual and business should take to stay protected. Additionally, we are taking the highly unusual step of providing a security update for all customers to protect Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003. Customers running Windows 10 were not targeted by the attack today.

Details are below.

  • In March, Microsoft released a security update which addresses the vulnerability that these attacks are exploiting. Those who have Windows Update enabled are protected against attacks on this vulnerability. For those organisations who have not yet applied the security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010.
  • For customers using Windows Defender, Microsoft released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt. As an additional “defense-in-depth” measure, keep up-to-date anti-malware software installed on your machines. Customers running anti-malware software from any number of security companies can confirm with their provider, that they are protected.
  • This attack type may evolve over time, so any additional defense-in-depth strategies will provide additional protections. (For example, to further protect against SMBv1 attacks, customers should consider blocking legacy protocols on their networks).

We also know that some of our customers are running versions of Windows that no longer receive mainstream support. That means those customers will not have received the above mentioned Security Update released in March. Given the potential impact to customers and their businesses, we made the decision to make the Security Update for platforms in custom support only, Windows XP, Windows 8, and Windows Server 2003, broadly available for download (see links below).

Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible.

This decision was made based on an assessment of this situation, with the principle of protecting customer ecosystems overall, firmly in mind.

Some of the observed attacks use common phishing tactics including malicious attachments. Customers should use vigilance when opening documents from untrusted or unknown sources. For Office 365 customers we are continually monitoring and updating to protect against these kinds of threats including Ransom:Win32/WannaCrypt. More information on the malware itself is available from the Microsoft Malware Protection Center on the Windows Security blog

Further resources: 

Download English language security updates: Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86Windows XP SP2 x64Windows XP SP3 x86Windows XP Embedded SP3 x86Windows 8 x86Windows 8 x64

Download localized language security updates: Windows Server 2003 SP2 x64Windows Server 2003 SP2 x86Windows XP SP2 x64Windows XP SP3 x86Windows XP Embedded SP3 x86Windows 8 x86Windows 8 x64

General information on ransomware: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx

MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

What can you do? 

Be extra careful about what emails you open, what attachments you open or links inside of emails you click. This is the most likely way that this malware will infect you. 

If its suspicious, do not open it, do not forward it. Contact us for advice. 

Email us on technicalsupport@focus.net.nz or call on 03 211 0099.

Search blog posts

For high quality IT Services, Software Development, Accounting Business Software services I would highly recommend Focus Technology Group and their team who have always gone over and above to deliver me outstanding results.

avatar
Mark Lovell, Real Journeys

I have enjoyed attending the EXO User Community Workshops and find them very helpful. The group is a valuable resource that provides a great opportunity to discuss issues and solutions with other users. It is also great to learn about new products and features available, and promotes continual improvements which make our use of EXO easier and more efficient.

avatar
Graeme Laughton-Mutu, Award Plastics

Thank you Focus Technology Group for great customer service and helping our business understand technology better, your team always has the answers. Big thanks to Garry, we enjoy having you in our building and the team love your input.

avatar
Awarua Synergy

Focus ensures they’re always working smarter. Their greatest contribution is in keeping Presbyterian Support Service’s current. Focus keeps us informed and advises us on what we should be considering and how to get there.

avatar
Presbyterian Support Southland

Focus Technology Group are an impressive team which delivers on their promises and are stand out performers in the IT Services, Software Development, Accounting Business Software sector.

avatar
Southern REAP

Keep up to date with our newsletter