Can we stop WannaCry from being spread across network?

Ondrej Lepa
Rank
Userlevel 6
WannCry ransomware worm gets through SMB and other protocols.
There is a possible way to block these commands using ACL rule as follows:

ip access-list BROADCAST-MULTICAST-CONTROL
  • permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
  • permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
  • deny tcp any eq 445 any eq 445 rule-precedence 17 rule-description "deny SMB Traffic"
  • deny tcp any eq 139 any eq netbios-ssn rule-precedence 18 rule-description "deny SMB Traffic"
  • deny tcp any eq 137 any eq netbios-ns rule-precedence 19 rule-description "deny SMB Traffic"
  • deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
  • deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
  • deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
  • permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
Some lines are already there but some shall be added.
IP ACL shall be then used on every WLAN in outbound direction and optionally on physical interfaces also.

Some more details on web

Regards,
Ondrej

10 replies

Brandon Clay
Rank
Userlevel 7
Great article, Ondrej!
T
Userlevel 4
Hi,
thank you for the information. Any idea, if Windows CE / Windows Mobile devices also effect? I think based on the different hardware architecture maybe not, but can't find any information about it.
BR Timo
Ondrej Lepa
Rank
Userlevel 6
Hi,
thank you for the information. Any idea, if Windows CE / Windows Mobile devices also effect? I think based on the different hardware architecture maybe not, but can't find any information about it.
BR TimoHey Timo,

I cannot be official in answer, but doing some research you might find this document on CERT.EUROPA.EU website.
See page 3, Products Affected

Regards,
Ondrej
T
Userlevel 4
Hi,
thank you for the information. Any idea, if Windows CE / Windows Mobile devices also effect? I think based on the different hardware architecture maybe not, but can't find any information about it.
BR TimoHi, Thank you. I also get some feedback from ZEBRA, that Windows CE / Mobile not affected. BR Timo
M
Nice thank you 🙂
Alexandr P
Userlevel 6
Hi, all!

Some question from my colleagues:
- how is feel AD and Exchange authentication (user login) in domain-based network after deny all SMB traffic?

Thank you!
Alexandr P
Userlevel 6
Hi, all!

Some question from my colleagues:
- how is feel AD and Exchange authentication (user login) in domain-based network after deny all SMB traffic?

Thank you!Update:

Find some explanation, example:
Client A (XP) connects to Server B (2K8) over port 445. Since it's a TCP connection, Server B needs to be able to contact Client A over a port...the port used will be an ephemeral port (1025-5000 for WinXP & 2K3, 49blah-65535 for Vista & 2K8+). RPC also happens to use these ports. Client A connects to Server B over port 135 (the RPC endpoint mapper). Server B then connects to Client A over it's ephemeral port (lets say 1134) and tells it to use port 49278 for this RPC connection. All future communications between Server B and Client A will be over port 49278 going to the server, and 1134 going to the client.

So ports 137-139 and 445 is blocked only "outbound direction" because in this direction AD use higher ephemeral ports?

Am I right or not?

Thank you!
Ondrej Lepa
Rank
Userlevel 6
Hi, all!

Some question from my colleagues:
- how is feel AD and Exchange authentication (user login) in domain-based network after deny all SMB traffic?

Thank you!Hi Alexandr,

as ACL blocks it only outbound, means that client will be able to get to the server and, if above description is correct, server will be able to get back to client.

Honestly, we are shooting a fly with a bazooka, but if GPO are loose enough not to block SMBv1, then this might be very quick remedy to prevent worm from excessive spread. Not saying it is perfect though...

I cannot speak officially so for confirmation I strongly advise you to contact Microsoft support to get this correctly answered.

Regards,
Ondrej
Alexandr P
Userlevel 6
Hi, all!

Some question from my colleagues:
- how is feel AD and Exchange authentication (user login) in domain-based network after deny all SMB traffic?

Thank you!OK.

You wrote that we have to put this ACL in outbound direction, BUT.
Client talk with server by ports 445, 137-139.
(By Wireless_User_Guide - outbound traffic in ACL is from Client to Network, inbound traffic is from Network to client)

So, we have to put this ACL in inbound direction? Isn't it?

Thank you!
Ondrej Lepa
Rank
Userlevel 6
Hi, all!

Some question from my colleagues:
- how is feel AD and Exchange authentication (user login) in domain-based network after deny all SMB traffic?

Thank you!Alexandr,

Could you advise what particular guide you refer to?
In WiNG systems the direction respects the radio point of view





Direction outbound means Tx on radio.
Usin ACL in OUT direction will be then used to block outgoing traffic.
We usually use it to limit VLAN bcast.

Regards,
Ondrej

Reply