Slashdot Mirror
Honda Shuts Down Factory After Finding NSA-derived Wcry In Its Networks (arstechnica.com)
A Honda factory near Tokyo was shuttered for over 24 hours this week after its computers became infected with WannaCry, the same ransomware virus responsible for crippling systems in dozens of countries last month, the car manufacturer said Wednesday. From a report: The automaker shut down its Sayama plant northwest of Tokyo on Monday after finding that WCry had affected networks across Japan, North America, Europe, China, and other regions, Reuters reported Wednesday. Discovery of the infection came on Sunday, more than five weeks after the onset of the NSA-derived ransomware worm, which struck an estimated 727,000 computers in 90 countries. [...] Honda officials didn't explain why engineers found WCry in their networks 37 days after the kill switch was activated. One possibility is that engineers had mistakenly blocked access to the kill-switch domain. That would have caused the WCry exploit to proceed as normal, as it did in the 12 or so hours before the domain was registered. Another possibility is that the WCry traces in Honda's networks were old and dormant, and the shutdown of the Sayama plant was only a precautionary measure. In any event, the discovery strongly suggests that as of Monday, computers inside the Honda network had yet to install a highly critical patch that Microsoft released in March.
Last week we heard how the DPRK was responsible for Wannacry. Today it's back to the NSA. Can we at least keep our talking points consistent?
PS. Sucks for Toyota no matter who did it, and sucks even more if US "intelligence" is at fault for creating these tools and letting them out of a lab. (Intelligence is intentionally quoted because many who work in that area are quite frankly not.)
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
But as usual, criminal activity (and we have at the very least "criminally negligent" on the NSA's part here) by state actors has zero negative consequences for them. One of the corner-stones of a corrupt government that has forgotten that it serves the people.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Hope this doesn't hinder Honda's initiative to improve their Formula 1 engines for McLaren. They've already ruined Alonso's career to date the poor man's car broke in every major race this year including the Indy 500!
Discovery of the infection came on Sunday, more than five weeks after the onset of the NSA-derived ransomware worm
Seriously, WTF were they playing at not applying the security fixes that were released within days of WannaCry.
OK, so with MS's history it pays to be careful and test each fix before widely deploying it, but 5 fucking weeks ??
Microsoft code was the entry point, but if the NSA was actually performing it's function and protecting the citizens of the US they would have notified Microsoft of the problem and perhaps even helped with a fix. The chain would have ended then and there.
Not notifying the vendor of the most widely used OS in the USA, the NSA acted against the interests of US Citizens.
Further, claiming that the Shadow Brokers are Russian fails basic scrutiny. If there was such a group working for the FSB they would have absolutely zero interest in releasing the exploit to the wild for anyone else to access.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
From MS - SMB Ports 445/139 (TCP) & 137/138 (UDP) protection via:
Disable SMBv1 on the SERVER, configure the following registry key:
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
Enable SMBv2 on the SERVER, configure the following registry key:
Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB2
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
---
Disable SMBv1 on the CLIENT, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled
Enable SMBv2 & SMBv3 on the CLIENT, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb20 start= auto
---
* The above is per https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012/
APK
P.S.=> For a SINGLE 'standalone' non-networked PC (no home network/LAN but TCP/IP connected online) turn off Server & Workstation services.
That shuts off any "handles" (port 445) this thing propogates thru + turn off NetBIOS over TCP/IP in your internet connection & uncheck/disable Client for Microsoft Networks + File and Print Sharing. Port 139 & 445 always pop up issues over time. It also makes your packet trains smaller (no encapsulation of LanMan)
I covered all this 11++ yrs. ago in a security guide I wrote for users with a single system & apparently, its advice STILL STANDS THE "TEST OF TIME" https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Google+Search&gbv=1/ vs. even today's threats like this one.
* This effectively makes this threat a non-issue + saves you CPU cycles/RAM & other I/O wasted on services you don't NEED as a single PC user only... & you don't. They're just wastes with a single PC really. Many services are (covered in guide above based on CIS Tool guidance (who took fixes to their ware from "yours truly" too, no less)) & again, no more encapsulated packet bulk.
AND?
Don't be STUPID & click on attachments in bogus malicious emails this thing propogates thru also (Chrome/Opera/Webkit users - BEWARE of the ShellControlFile issue that just popped up (.scf file) noted here-> http://www.theregister.co.uk/2017/05/17/chrome_on_windows_has_credential_theft_bug/ ) ... apk
Im surprised they do t use it.
From experience I can tell you there is some problems in Japanese companies with IT security or Administration. I'm not sure if its a language barrier thing (being isolated) or a cultural thing where IT Admins are too scared of their managers to report issues or ask for funds to improve things.. but there is a tendency in these companies to really drag their heels. They also seem to have poor decision making procedures.. sometimes things drag out years. I have one Japanese corporation still using LTO tape backup system from 10 years ago. They also often take security too far and reduce the functionality to where it impedes the day to day function of users, and the users are often too scared to say anything to their managers. Anyone else notice these things?
This worked LONG prior to MS' patching it (if they have on ALL of their OS' - probably have by NOW @ least, lol) = why...
APK
P.S.=> And, "there ya go"... apk
See subject: I do get a lot of shit, e.g. https://ask.slashdot.org/comments.pl?sid=10771127&cid=54665323/ & that's a MILD case (along w/ "downmod bombings" of my posts & then our 'gracious host' filter tracks my posts blocking the homepage URL for my hosts program's another (he hates hosts as it blocks ads, this much is obvious)).
* I'm only trying to help out by spreading "the good word" on a fix in THIS case (2 ways that worked long before MS issued patches).
(APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ is doing the same, albeit programmatically...)
APK
P.S.=> Takes all kinds to make a world I suppose, but if you're going to 'criticize' me (like that crap in the link above), @ least do it on a valid constructive basis - & again, thank you for your comment BlueStrat - it's truly the thought that counts... apk
> Honda officials didn't explain why engineers found WCry in their networks 37 days after the kill switch was activated. One possibility is that engineers had mistakenly blocked access to the kill-switch domain
Probably not.
Only the early variants had a "kill switch". Later variants had the "kill switch" binary-edited out. After 37 days, we're probably dealing with a later variant...