RE: Please run windows update now

2017-05-12 Thread Keith Medcalf
Not to mention of course that the version of Windows 10 that actually has all Microsoft's wonder-dunder-touted-all-and-fro security features is the one that most mere mortals cannot buy. I wunder. When there are these wunderful fluffings of the security of Windows 10, should one be suing Mic

Re: Please run windows update now

2017-05-12 Thread Joe
One word. Linux. After this we'll probably see (yet more) additional processes running on windows boxes safe guarding against issues like this, forcing windoze users to upgrade memory/processor/disk space. I, for one, am not looking at Windoze 10 S as it locks too many applications needed for work

RE: Please run windows update now

2017-05-12 Thread Keith Medcalf
Well, this one was patched (or more accurately, undone). Perhaps. Maybe. How many other "paid defects" do you estimate there are in Microsoft Windows waiting to be exploited when discovered (or disclosed) by someone other than the "Security Agency" buying the defect? Almost certainly more t

Re: Please run windows update now

2017-05-12 Thread Nathan Brookfield
Well it was patched by Microsoft of March 14th, just clearly people running large amounts of probably Windows XP have been owned. Largely in Russia. Nathan Brookfield Chief Executive Officer Simtronic Technologies Pty Ltd http://www.simtronic.com.au On 13 May 2017, at 14:47, Keith Medcalf wro

RE: Please run windows update now

2017-05-12 Thread Keith Medcalf
The SMBv1 issue was disclosed a year or two ago and never patched. Anyone who was paying attention would already have disabled SMBv1. Thus is the danger and utter stupidity of "overloading" the function of service listeners with unassociated road-apples. Wait until the bad guys figure out that

Re: Please run windows update now

2017-05-12 Thread Karl Auer
On Fri, 2017-05-12 at 10:30 -0800, Royce Williams wrote: > - In parallel, consider investigating low-hanging fruit by OU > (workstations?) to disable SMBv1 entirely. Kaspersky reckons the exploit applies to SMBv2 as well: https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in -wi

Re: Please run windows update now

2017-05-12 Thread Josh Luthman
MS17-010 https://technet.microsoft.com/en-us/library/security/ms17-010.aspx Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 On Fri, May 12, 2017 at 2:35 PM, JoeSox wrote: > Thanks for the headsup but I would expect to see some references to the >

Re: Please run windows update now

2017-05-12 Thread JoeSox
Thanks for the headsup but I would expect to see some references to the patches that need to be installed to block the vulnerability (Sorry for sounding like a jerk). We all know to update systems ASAP. -- Later, Joe On Fri, May 12, 2017 at 10:35 AM, Ca By wrote: > This looks like a major worm

Re: Please run windows update now

2017-05-12 Thread Royce Williams
My $0.02, for people doing internal/private triage: - If your use of IPv4 space is sparse by routes, dump your internal routing table and convert to summarized CIDR. - Feed your CIDRs to masscan [1] to scan for internal port 445 (masscan randomizes targets, so destination office WAN links won't s

Weekly Routing Table Report

2017-05-12 Thread Routing Analysis Role Account
This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, MENOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-st...@lists

Re: Please run windows update now

2017-05-12 Thread Alexander Maassen
Hail backups, and whoever keeps those ports accessible to the outside without a decent ACL in the firewall, or restricting it to (IPsec) VPN's should be shot on sight anyways. On Fri, May 12, 2017 7:35 pm, Ca By wrote: > This looks like a major worm that is going global > > Please run windows upda

Please run windows update now

2017-05-12 Thread Ca By
This looks like a major worm that is going global Please run windows update as soon as possible and spread the word It may be worth also closing down ports 445 / 139 / 3389 http://www.npr.org/sections/thetwo-way/2017/05/12/528119808/large-cyber-attack-hits-englands-nhs-hospital-system-ransoms-de