Slashdot Mirror
Cyberattacks From WannaCry Ransomware Slow But Fears Remain (bbc.com)
WannaCry ransomware, which has spread across 150 countries, appears to be slowing down with few reports of fresh attacks in Asia and Europe on Monday. A report on BBC adds: However staff beginning the working week have been told to be careful. The WannaCry ransomware started taking over users' files on Friday, demanding $300 to restore access. Hundreds of thousands of computers have been affected so far. Computer giant Microsoft said the attack should serve as a wake-up call. BBC analysis of three accounts linked to the ransom demands suggests only about $38,000 had been paid by Monday morning.
The first 2 steps are the most important. The second one alone should protect you.
Microsoft was whining about this earlier, and they are absolutely right to do so. There is no such thing as 'NOBUS'. There are far more smart people working outside $ORG than inside it and it is hubris to believe that $ORG is the only one smart enough to find any particular exploit.
With that said, Microsoft made a part of this shit sandwich by refusing to patch older, but still active operating systems until their feet were to the fire. Sure, no one should be running XP any longer, but once on a vendor lock-in treadmill it can be very hard and expensive to get off.
Ransomware has been around for ages now. Surely someone can come up with an OS defense rather than tit for tat patches and upgrades. File versioning going back in history that you can't edit, only recover from? Every file modification makes a new file. Sure, disk space gets eaten up very fast but with large Tb drives that should surely give companies some breathing room, and home users too. Why isn't this an easy option to switch on in windows?
Plus the fact that Microsoft pushed people into not updating by turning their fix-the-bug patch update system into a shill-the-hell-out-of-windows-10 advert delivery system.
----------------------------------- My Other Sig Is Hilarious -----------------------------------
Let's say, as an example, there is an ultrasound machine that was based around Windows XP.
Medical devices should be kept on a separate VLAN behind an ACL with a no access to the Internet and a dedicated update server. Exposure to the General VLAN can cause problems. From what I read about the British hospital, there network isn't highly structured.