{"id":65,"date":"2017-06-27T22:11:28","date_gmt":"2017-06-27T20:11:28","guid":{"rendered":"https:\/\/www.cyril-bras.fr\/?p=65"},"modified":"2017-06-27T22:41:46","modified_gmt":"2017-06-27T20:41:46","slug":"apres-wannacry-voici-petya","status":"publish","type":"post","link":"https:\/\/www.cyril-bras.fr\/?p=65","title":{"rendered":"Apr\u00e8s WannaCry voici Petya"},"content":{"rendered":"<p>Une nouvelle campagne de Ransomware utilisant Eternalblue affecte des syst\u00e8mes Microsoft Windows d&rsquo;Ukraine mais aussi de France [1] ce mardi 27 juin.<\/p>\n<figure id=\"attachment_71\" aria-describedby=\"caption-attachment-71\" style=\"width: 300px\" class=\"wp-caption alignleft\"><img loading=\"lazy\" class=\"wp-image-71 size-medium\" src=\"https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/Goldeneye-ransomware-161212-300x208.jpg\" alt=\"Bildschirmfoto von Goldeneye Ransomware. Personal decryption code entfernt. Darknet URL teilweise entfernt.\" width=\"300\" height=\"208\" srcset=\"https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/Goldeneye-ransomware-161212-300x208.jpg 300w, https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/Goldeneye-ransomware-161212-768x532.jpg 768w, https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/Goldeneye-ransomware-161212-1024x709.jpg 1024w, https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/Goldeneye-ransomware-161212.jpg 1280w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><figcaption id=\"caption-attachment-71\" class=\"wp-caption-text\">SOURCE WIKIP\u00c9DIA<\/figcaption><\/figure>\n<p>Visiblement il utilise les m\u00eames vuln\u00e9rabilit\u00e9s corrig\u00e9es dans le patch <a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/security\/ms17-010.aspx\">MS17-010<\/a> de Microsoft. Seuls les syst\u00e8mes n&rsquo;ayant pas appliqu\u00e9s les correctifs et expos\u00e9s sur Internet (TCP Port 445) [2] peuvent \u00eatre spontan\u00e9ment contamin\u00e9s. Quid d&rsquo;une pi\u00e8ce jointe \u00e0 un e-mail ou un lien malveillant qui peuvent \u00eatre aussi un autre vecteur de contamination.<\/p>\n<p>Sur les syst\u00e8mes ne pouvant pas \u00eatre patch\u00e9s, il est indispensable que ces machines soient isol\u00e9es d&rsquo;Internet et ne puisse pas \u00eatre atteintes par des machines disposant d&rsquo;un acc\u00e8s Internet.<\/p>\n<p>L&rsquo;ANSSI a \u00e9mis une alerte pour cette nouvelle cyberattaque [3] ainsi que le CERT-FR [4].<\/p>\n<blockquote><p>Le CERT-FR recommande :<\/p>\n<ul>\n<li>l&rsquo;application imm\u00e9diate des mises \u00e0 jour de s\u00e9curit\u00e9 notamment la mise \u00e0 jour de s\u00e9curit\u00e9 Microsoft MS17-010 (cf. section Documentation);<\/li>\n<li>le respect des recommandations g\u00e9n\u00e9riques relatives aux ran\u00e7ongiciels (cf. section Documentation);<\/li>\n<li>de limiter l&rsquo;exposition du service SMB, en particulier sur internet ;<\/li>\n<li>de ne pas payer la ran\u00e7on.<\/li>\n<\/ul>\n<\/blockquote>\n<hr \/>\n<ol>\n<li><a href=\"http:\/\/www.ledauphine.com\/france-monde\/2017\/06\/27\/des-banques-et-entreprises-touchees-par-une-cyberattaque\">Le Dauphin\u00e9 lib\u00e9r\u00e9 du 27\/06\/2017<\/a><\/li>\n<li><a href=\"https:\/\/researchcenter.paloaltonetworks.com\/2017\/06\/unit42-threat-brief-petya-ransomware\/?utm_source=Adobe%20Campaign%20-%20ACS&amp;utm_medium=email&amp;utm_campaign=20170627_Unit42_threat_alert_petya_ransomware\">Un article de Unit42 de chez Palo-Alto<\/a><\/li>\n<li><a href=\"http:\/\/www.ssi.gouv.fr\/actualite\/alerte-campagne-de-rancongiciel-3\/?lipi=urn%3Ali%3Apage%3Ad_flagship3_feed%3BiZyTyYWMSaO1B53jphj0bg%3D%3D\">Alerte ANSSI <\/a><\/li>\n<li><a href=\"http:\/\/www.cert.ssi.gouv.fr\/site\/CERTFR-2017-ALE-012\/index.html\">Alerte CERT-FR<\/a><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Une nouvelle campagne de Ransomware utilisant Eternalblue affecte des syst\u00e8mes Microsoft Windows d&rsquo;Ukraine mais aussi de France [1] ce mardi 27 juin. Visiblement il utilise les m\u00eames vuln\u00e9rabilit\u00e9s corrig\u00e9es dans&hellip; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[10],"tags":[],"_links":{"self":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/65"}],"collection":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=65"}],"version-history":[{"count":8,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/65\/revisions"}],"predecessor-version":[{"id":74,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/65\/revisions\/74"}],"wp:attachment":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=65"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=65"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=65"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}