Ransomware attacks.

Apparently several large companies have been attacked recently. The WannaCry attack on the NHS and Honda amongst many others in Russia and around the world made headlines. Peter was puzzled at the time it must take to encrypt files, but it may be honed down to certain file types which are encrypted like .doc or .xls. The encryption software often modifies the filename extension as in nnn.doc.mole for example. Apparently visiting certain websites or even viewing a seemingly harmless graphic can mean that your machine is infected. The encryption may then work away silently in the background without your knowledge until it announces itself and demands payment usually in bitcoin so that it can't be traced. This is a frightening scenario. The ransomware may also have some sort of timeout presented and if you don't pay on time you may never receive the unlock key.

The only real defence seems to be to keep all systems patched and up to date and to keep regular backups. However you might need to trawl back to find a clean backup without the ransomware.

There has also been one attack by Erebus on an Apache server using PHP exploits of Nayana on a Linux server network as reported in trendmicro.com. Nayana were forced to pay over $1M in three instalments in June to recover their systems. It is interesting to wonder how some of these attacks got onto the system. Nayana's website running on Apache 1.3.36 compiled in 2008 and PHP released in 2006 shows the vulnerability of old systems.

38:31

Patching Systems and vulnerable systems

Numbers of XP systems still running percentage of people running on iOS and different generations of Microsoft Windows. Netmarketshare.com shows 25% Windows 10 and 50% still on Windows 7 and nearly 7% on Windows XP. MacOS is at 3.5% by comparison and Linux 2.4%.

Michael thinks people only change systems when they change their machines.

As you will hear in the next meeting on the Creators Redstone 3 update for Windows 10 SMB v1 is now being removed as it is considered too vulnerable and is being replaced by Lazarus SMB 3.1.1 considered to be much more secure. However it means that some older systems will no longer work. Systems like Rapport used by the banks is useful to know you are running a secure connection.

Backup software

Michael favours Veeam endpoint backup software. It will automatically backup as soon as you connect a drive so to be protected you do a backup and then remove a drive. You can backup to several locations.

Using a NAS (Network Application Server) is useful for local backups. For example software and hardware from Synology consisting of a housing for multiple hard drives e.g. from Western Digital may be set up either as a Mirror system or a RAID system so that you can backup your files securely. The mirror principle is that two drives are duplicates of each other. If one fails and is replaced by an empty disk the NAS will automatically copy everything on the other original disk to reform the mirror. More complex arrangements can be set up to spread some data over several disks to increase the security and the redundancy.

Qnap is another company producing such systems.

Of course you can use online systems like One drive, Dropbox, Hubic and iCloud.

Crashplan will backup to another system and also encrypt it. (Good for systems which are left on continuously.)

Mac Software also vulnerable

The updates for "Handbrake for MAC" software for Video Format conversions were compromised with proton OSX.PROTON trojan software during the period May 2nd to May 6th 2017 before it was discovered.

Mac Malware can be protected against with Avast for MAC, Kaspersky and Sophos.

Thanks Michael for all your work on this. I'm sorry if I have left something important out.

Peter