防范蠕虫式勒索软件病毒攻击的安全预警通告

 

文章摘要:

 

    1、病毒爆发

    2、漏洞参考

    3、重点:防范措施

       3.1 一般防范措施

       3.2 Win7/8/10 的命令行防护

       3.3 针对XP/2003系统的命令行防护

       3.4 彻底解决办法

 
 
1.病毒爆发

 

5月12日全球爆发勒索软件攻击潮,根据此次攻击软件的传播和危害方式,我们称之为蠕虫式勒索软件病毒。

2017年4月黑客组织Shadow Brokers利用从美国国家安全局(NSA)泄露的多个Windows黑客工具并公布到互联网上,此轮攻击正是利用其中名为“永恒之蓝(EternalBlue)”的黑客工具发起的。被攻击电脑被锁定,文件被加密,攻击者要求受害者付钱才能通过攻击者提供的秘钥恢复访问。

研究发现,目前发现的蠕虫会扫描开放445文件共享端口的Windows机器,用户的主机只要连接到互联网,病毒会自动在有漏洞的电脑和服务器中植入执行勒索程序、远程控制木马、虚拟货币挖矿机等恶意程序。

该由NSA泄露工具所引发的蠕虫攻击事件已经造成非常严重的现实危害,无论个人还是企业内网也已经面临此类威胁。

本次蠕虫病毒的爆发是利用了微软操作系统的MS17-010漏洞,CVE:CVE-2017-0144。

 

2.漏洞参考

 

关于漏洞MS17-010的说明,请参见:

https://support.microsoft.com/zh-cn/help/4012598/title

 

3. 防范措施

 

3.1 一般防范措施

1、备份重要文件

2、打开系统自动更新,并检测更新进行安装

3、开启系统防火墙,利用系统防火墙高级设置阻止向 445 端口进行连接(该操作会影响使用445 端口的服务)

 

3.2 Win7/8/10的命令行防护

1、以管理员权限运行cmd命令行:

 

 

2、复制下面两条命令,每次一条,拷贝到命令行窗口:

netsh firewall set opmode enable

netsh advfirewall firewall add rule name="Deny445" dir=in protocol=tcp localport=445 action=block

以上命令在win7/8/10 ,server 2008 经过测试。

 

3.3 针对XP/2003系统的命令行防护

1、以管理员登录并运行cmd命令行

2、复制下面的四条命令,每次一条,拷贝到命令行窗口:

netsh firewall set opmode enable

net stop rdr

net stop srv

net stop netbt

操作如下图(要回答Y):

 

3.4 彻底解决办法

微软官方补丁地址:

https://support.microsoft.com/zh-cn/help/4012598/title(优先在线更新,如暂停支持请与支持列表中手动下载更新)

重要:先确认已经关闭445端口,再在线更新!(手动更新请与安全网络环境下下载更新包,主机断网后执行更新补丁)

 

其它重要补丁链接:

2017513日微软为已停止服务的XP和部分服务器版操作系统发布了特别补丁,下载地址如下:

winxp特别补丁KB4012598
winxp332 SecurityUpdate for Windows XP SP3 (KB4012598)链接:

http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-custom-chs_dca9b5adddad778cfd4b7349ff54b51677f36775.exe

winxp264 SecurityUpdate for Windows XP SP2 for x64-based Systems (KB4012598)链接:

http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe

 

win2003特别补丁KB4012598

2003SP232 SecurityUpdate for Windows Server 2003 (KB4012598)链接:

http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x86-custom-chs_b45d2d8c83583053d37b20edf5f041ecede54b80.exe

2003SP264 SecurityUpdate for Windows Server 2003 for x64-based Systems (KB4012598)链接:

http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-chs_68a2895db36e911af59c2ee133baee8de11316b9.exe

 

win2008R2补丁 KB4012212KB4012215

March,2017 Security Only Quality Update for Windows Server 2008 R2 for x64-basedSystems (KB4012212)链接:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x64_2decefaa02e2058dcd965702509a992d8c4e92b3.msu

March,2017 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-basedSystems (KB4012215)链接:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/03/windows6.1-kb4012215-x64_a777b8c251dcd8378ecdafa81aefbe7f9009c72b.msu

 

win7补丁 KB4012212KB4012215
win7 32

March,2017 Security Only Quality Update for Windows 7 (KB4012212)链接:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x86_6bb04d3971bb58ae4bac44219e7169812914df3f.msu

March,2017 Security Monthly Quality Rollup for Windows 7 (KB4012215)链接:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/03/windows6.1-kb4012215-x86_e5918381cef63f171a74418f12143dabe5561a66.msu

win7 64

March,2017 Security Only Quality Update for Windows 7 for x64-based Systems(KB4012212)链接:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x64_2decefaa02e2058dcd965702509a992d8c4e92b3.msu

March,2017 Security Monthly Quality Rollup for Windows 7 for x64-based Systems(KB4012215)链接:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/03/windows6.1-kb4012215-x64_a777b8c251dcd8378ecdafa81aefbe7f9009c72b.msu

 

win10 1607补丁 KB4013429

win10 1607 32位

CumulativeUpdate for Windows 10 Version 1607 (KB4013429)链接:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/03/windows10.0-kb4013429-x86_8b376e3d0bff862d803404902c4191587afbf065.msu

win10 1607 64

CumulativeUpdate for Windows 10 Version 1607 for x64-based Systems (KB4013429)链接:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/03/windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu

 

win2012R2补丁 KB4012213KB4012216

March,2017 Security Only Quality Update for Windows Server 2012 R2 (KB4012213)链接:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8.1-kb4012213-x64_5b24b9ca5a123a844ed793e0f2be974148520349.msu

March,2017 Security Monthly Quality Rollup for Windows Server 2012 R2 (KB4012216)链接:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/03/windows8.1-kb4012216-x64_cd5e0a62e602176f0078778548796e2d47cfa15b.msu

 

win2016补丁 KB4013429

CumulativeUpdate for Windows Server 2016 for x64-based Systems (KB4013429)链接:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/03/windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu

 

更多版本的补丁见:https://technet.microsoft.com/zh-cn/library/security/MS17-010

 

本文由北京三思网安科技有限公司网络信息安全专家团队创作,转载或引用请注明出处!

 

三思后行,才能安全无忧

三思网安一个有用的公众号

 

发布者:管理员   点击数:2874   发布时间:2017-05-15 10:23:16   更新时间:2020-12-11 18:11:34