Reason:
https://www.bleepingcomputer.com/news/security/new-smb-worm-uses-seven-nsa-hacking-tools-wannacry-used-just-two/
https://heimdalsecurity.com/blog/bluedoom-worm-eternablue-nsa-exploits/
https://blog.varonis.com/eternalrocks/
Refs for ExternalRocks / MicroBotMassiveNet:
https://blog.joshlemon.com.au/wannacry-fact-from-fiction
https://github.com/stamparm/EternalRocks/
https://github.com/fabrimagic72/malware-samples/tree/master/EternalRocks
https://otx.alienvault.com/pulse/5921c641f6d89f5d69168fd6/
https://blog.varonis.com/eternalrocks/
Recommendations:
* Scan for SMB in your environment.
- If your use of IPv4 space is sparse by routes, dump your internal routing table and convert to summarized CIDR.
- Feed your CIDRs to masscan:
https://github.com/robertdavidgraham/masscan
... to quickly scan for internal SMB ports. Masscan randomizes targets so that destination office
WAN links won't saturate - but local/intermediate might if you're not careful, so tune:
sudo masscan -p137,139,445,U:137,U:138 --rate=[packets-per-second safe for your network] -iL routes.list -oG masscan-smb.list
- Feed that list of SMB-speaking hosts to a scanner that scans for the vulnerability.
Option 1: https://github.com/cldrn/nmap-nse-scripts/blob/master/scripts/smb-vuln-ms17-010.nse
sudo nmap -T5 -p137,139,445,U:137,U:138 --script smb-vuln-ms17-010.nse -iL masscan-smb.list -oA nmap-smb-vuln
NOTE: You will need a modern nmap, 7.40+ is best
Option 2: https://github.com/RiskSense-Ops/MS17-010/tree/master/scanners (the python2 one, or
the Metasploit one if you can use that internally) to detect vuln. the python one is *not*
a parallelized script, so consider breaking it into multiple parallel runners if you have a lot of scale)
- If you're using SCCM/other, verify that MS17-010 was applied - but be mindful of Windows-based
appliances not centrally patched, etc. Trust but verify.
- In parallel, consider investigating low-hanging fruit by OU (workstations?) to disable SMBv1 entirely.
* Apply IOCs to all systems that support them. Potential sources:
https://github.com/stamparm/EternalRocks/
https://www.virustotal.com/en/file/cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30/analysis/
* Block both Tor exit nodes and web/Tor gateways, on all firewalls (pfSense,Check Point,ASA,Sonicwall,Palo,etc.)
* Per Blue Coat docs, "an SSL license is required to effectively block Tor"
* Fast-alert (email-to-SMS?) on any attempts to avoid proxy controls (by DNS, web filtering category, etc.)
* SIEM, snort, DNS monitoring, full-packet-capture systems, etc.
* Verify blocks with antivirus vendors and prioritize AV updates
* Uses default (wide open) install of DOUBLEPULSAR backdoor, so continue scanning for DOUBLEPULSAR
https://nmap.org/nsedoc/scripts/smb-double-pulsar-backdoor.html
https://github.com/countercept/doublepulsar-detection-script
* Consider spawning a process that locks this mutex: BaseNamedObjects \ {8F6F00C4-B901-45fd-08CF-72FDEFF}
----------------------------------------------------------------------
Blocking exit nodes:
Getting lists: two different methods:
1. https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1
2. wget -q https://check.torproject.org/exit-addresses -O- | grep ExitAddress | cut -f 2 -d ' ' | sort -n > exit-nodes.txt
----------------------------------------------------------------------
Palo:
http://www.whodoesitforyou.com/?p=180
----------------------------------------------------------------------
ASA:
https://www.hacktheplanet.tips/topics/2571
Prerequisites : ASA botnet Traffic licence for ASA. For more information: Botnet ASA license
Example configuration:
(config)# dns domain-lookup outside
(config)# dns server-group DefaultDNSServers
(config)# name-server 8.8.8.8
(config)# name-server 8.8.4.4
(config)# domain-name pc.local
(config)# dynamic-filter updater-client enable
(config)# dynamic-filter use-database
(config)# access-list dynamic-filter_acl extended permit ip any any
(config)# dynamic-filter enable interface outside classify-list dynamic-filter_acl
(config)# class dynamic-filter_snoop_class
(config-cmap)# match port udp eq domain
(config-cmap)# exit
(config)# policy-map dynamic-filter_snoop_policy
(config-pmap)# class dynamic-filter_snoop_class
(config-pmap-c)# inspect dns dynamic-filter-snoop
(config-pmap-c)# exit
(config-pmap)# exit
(config)# service-policy dynamic-filter_snoop_policy interface outside
Blue Coat
http://bluecoat.force.com/knowledgebase/articles/Solution/000011275
Note: an SSL license is required to effectively block Tor.
Other refs:
BlueDoom:
https://www.virustotal.com/en/file/cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30/analysis/
WannaCrypt Map
https://intel.malwaretech.com/botnet/wcrypt/?t=24h&bid=all
Return to The Story So Far (list of notable security events)