The past two weeks have been insane thanks to CryptoWall and the many variants that are out in the wild. It started early Monday morning with a UK office, hit the US West coast mid-week and then finally came calling to the US East coast by weeks end. All told we had to restore some 250,000+ files on multiple Windows File Shares from either Shadow Copies or from backups. The bigger issue for us are the Windows File Shares from which the infected clients have mapped drives. So I’ve spent the past 2 days researching CryptoWall and trying to figure out how we can stem the tied and help right the ship. The current solution of re-imaging infected devices and restoring files just isn’t sustainable – we just don’t have the personnel to be playing wackamole every day of the week. So what should we be doing as an enterprise to combat this threat? It turns out you’ll need to really step up your game for this one.
- Windows Software Updates and Patches – I’m hopeful this goes without saying but you never know
- Java Updates – I would highly recommend you remove Java unless you absolutely need it
- Adobe Flash Updates – I would highly recommend you remove Adobe Flash unless you absolutely need it
- Adobe Reader Updates – I’m not sure if Adobe Reader is still the target is used to be but I keep it up-to-date regardless
- Anti-Virus Updates – very important to keep your anti-virus up to date and functional
In my specific case we’re currently using Trend Micro as our anti-virus solution but I don’t believe many of the AV solutions are fairing well in protecting their clients due to the obfuscation.
You could be batting .400 with everything on the punch list above and still end up with CryptoWall / CryptoLocker or some variant infecting your laptop or desktop.
I’ll be firing up a Group Policy configuration to test Software Restriction Policies in my environment over the next week or so. I’ll probably need to-do some live testing by intentionally infecting a machine or two in order to validate that it actually works.
What are you doing to combat the threat? How are you making out? I’d love to hear, it might help save my sanity.
Image Credit: Carolin Chan