What IP range / network / protocol / service do we have to block to keep this from even being possible. Where is this coming from? Does anyone know the origin and what you would do to block access to it? Anyone have a solution (other than backing up on the cloud / offline backup) ? To me this is a domain killer. Entire companies will go down and it's just a matter of time. Meanwhile... our government does nothing.
CAN IT FIND HIDDEN SHARES?
What application is this exploiting - Flash?
Even when looking at historical data, one could you not explicitly state which application(s) is being exploited to spread this ransomware or any other malware for that matter. Each exploit kit, exploit kit affiliate, phishing campaign, etc. uses numerous techniques to successfully infect target machines. In the case of CryptoFortress being observed by Kafeine, the Nuclear Pack exploit kit exploited CVE-2013-2551, an exploit in Internet Explorer versions 6 through 10. But that's not say that it isn't being pushed as a payload leveraging other exploits, such as the more common exploits (aside from IE) including those in Flash and Java.
What we've learned over time, especially after the Adobe Flash zero-days, is that we will never be able to prevent exploitation of commonly used software with absolute certainty. This being said, the best defense against these attacks are to deploy security controls in both an administrative and preventive fashion. We must ensure that our users are educated and kept up-to-date regarding current and emerging threats via policies and procedures, i.e. a Security Awareness Policy that mandates end-user education upon onboarding as well as regular time intervals. We must ensure that we adhere to a patch management policy, and enforce compliance within out personal and corporate networks; if a patch is available, it should be either automatically applied or the device should not be able to utilize unpatched, non-compliant software--whether this is ensured either via penalties after an incident occurs, or through the use of a NAC that quarantines devices found to be non-compliant.
We need to learn to be vigilant; the Internet is a dangerous place, and none of us are safe. We need to deploy controls that have been tried-and-true and have been found to successfully mitigate such exploitation attacks with great success. Some security controls that come to mind include, primarily, those that fit the category of host-based intrusion prevention systems (HIPS). McAfee HIPS with custom-written rules, MalwareBytes Anti-Exploit. CryptoPrevent, among various others seem to do the job quite well.
Back to top
