News broke today of follow-up worm to the WannaCry malware was used in a global cyber-attack last Friday. WannaCry used a pair of NSA hacking tools to spread and install malware, EternalRocks has a further five NSA tools in its malicious toolbox, making a total of seven. This makes it more dangerous in terms of being able to potentially infect more PCs in an even swifter manner than WannaCry managed. IT security experts from One Identity, FireMon and Comparitech.com commented below.
Andrew Clarke, EMEA Director at One Identity:
“As with all the challenges facing interconnected business infrastructures, a new worm is no surprise and is to be expected; a diligent and pro-active IT team will already have controlled and managed open communication ports; scanned their managed computer systems for dormant malware and patched everything they can – but a reality is that that is always going to be an element of risk; the unforeseen and unexpected. Continuing to improve; looking at access policies; considering who has access and how they access their systems; is one step to keep ahead. Managing privileged accounts for example is one practice that enables an IT team to gain better control over their environments and keep malicious threats at bay. Getting to a position which defends their own domain as effectively as they can; will cause the threats to go elsewhere.”
Paul Calatayud, Chief Technology Officer at FireMon:
“EternalRocks in many ways is a more traditional advisory when it comes to malware defense. Unlike WannaCry, which used some of the NSA leaked exploits to encrypt and ransom the infected machine, EternalRocks operates in the shadows, both on the machine and in the darkweb. Infected machines will not easily be detected with a friendly pop-up asking for bitcoins, rather, this use of exploits leaked will infect machines gathering information such as credentials, passwords used when accessing web-sites such as personal banking and personal e-mail accounts.
“How to detect EternalRocks? Most malware operates in three key stages: 1) exploitation, 2) command and control, 3) data removal. In the case of EternalRocks, it downloads Tor and beacons its C&C (command and control) server located on the Tor network, in the dark web. To prevent this malware from taking full control, it’s important that you configure your network to prevent TOR network communications. Most Next-Generation firewalls are capable of being configured to block TOR. Network Security Policy Management (NSPM) is a great way to quickly audit your next-generation firewalls to assess if TOR is accessible and more importantly being used which may indicate EternalRocks is already on your machines.”
Lee Munson, Security Researcher at Comparitech.com:
“EternalRocks is big, bad and ugly. It’s also here right now and, without a kill switch, it seems pretty scary. But it shouldn’t.
Given how recently WannaCry hit the news, every business worth its salt should already have reviewed its policies, processes and collection of legacy networked devices to minimise the risk of ransomware such as this taking hold.
Staff should have been informed of the myriad ways in which ransomware can find itself onto a system and SMB should no longer be the issue it was.
Home users and businesses alike should have heeded the wakeup call and backed up all their important information onto drives and other media that do not stay connected to their networks, or even individual machines.
So, everything should be rosy in the ransomware defence garden.
Only we know it won’t be because us humans always were, and always will be, the most fragile point in the chain of information security.”
