Endpoint

11/10/2017
03:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail

New Locky Ransomware Takes Another Turn

A newly discovered strain of Locky ransomware has been discovered masquerading as legitimate Microsoft Word documents.

(Image: Avira)

(Image: Avira)

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
kenomouth64
100%
0%
kenomouth64,
User Rank: Apprentice
11/13/2017 | 8:52:08 AM
Possible Improvised Solution
  • At my company we supported 200 client's IT Infrastructure. Well, at least 1 client a week was getting infected with locky, luckily we had backups in each case. However it was still concerning that locky was slipping past the security controls in place. So we developed a "programmitic Block" which prevents any files from writing to the appdata folder. 
  • So, we figured out that for most strains of locky they will right to the appdata folder for install by default. So we just prevent anything from writing to this folder. It has created a few issues but we irnoed those out. It has been working for the clients for  year now. No New infections since it was implemented.
DaraSingh
33%
67%
DaraSingh,
User Rank: Apprentice
11/11/2017 | 9:28:51 AM
Locky Ransomware attacks
This attack is of very dengerous kind. If your file is locked with locky then your had lost your data and no ways to recover, only the way is if you have the backup of your data then ok.

I faced this situation three times and found that if it enters into your network then only the option is to identify the sytem and remove it immediately form the network else your Network PCs data are going into the dustbin.Sometimes it also encrypt the video and audio files but depending on the programs files formats going to be affecting.

The best way is to use your network safely with proper antivirus and don't install the unnecessary programs and adwares which have the loopholes into its design architecture. If your are a tech giant and want to face the such an problem then you can try locky..... GOOD luck and happy readings.

 

 
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6504
PUBLISHED: 2018-09-20
A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).
CVE-2018-6505
PUBLISHED: 2018-09-20
A potential Unauthenticated File Download vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Unauthenticated File Downloads.
CVE-2018-14796
PUBLISHED: 2018-09-20
Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used to perform a denial of service attack.
CVE-2018-14821
PUBLISHED: 2018-09-20
Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing the RSLinx Classic application to terminate. The user will need to manually restart the software to r...
CVE-2018-14827
PUBLISHED: 2018-09-20
Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP packets to Port 44818, causing the software application to stop responding and crash. The user must restart the software to regain functionality.