Wannacry update

What a whirlwind few days this has been. I wanted to start off by saying I have been really impressed by how so such of the security community have really come together to combat this latest cyber attack. The NCSC combined with security researchers and security professionals have been working solidly since Friday keeping Wannacrypt at bay. The first round has been slowed down by the activation of the Kill Switch by Malwaretech on Friday there has also been another version found that resolves to a different domain and that has also been registered and sinkholed. 

 I am hoping most individuals and companies have been patching and updating their systems over the weekend but for those who have not had the chance to do so yet please see the recommended guidance below. 

 It is imperative that any organisations that have not patched their systems do so A.S.A.P.

• If you are using a supported version of Microsoft Windows make sure you have MS17-010 patch applied which can be found here
• If you are using unsupported versions including XP, Microsoft have been fantastic and created an out of support patch which can be downloaded here.  
•  If the patches provided do not cover your systems, disable SMBv1, further information can be found here
• You could also block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445]
• The mainstream antivirus and malware vendors have updates their signatures so please do make sure that your AV products are up to date. 
• Systems that become infected need to be able to resolve and connect to one of the following domains to activate the kill switch

www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com

www[.]ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com

Please make sure individuals in your organisations are extra vigilant and do not click on links and attachments from unknown senders.