MS17-010 (aka WannaCry ransomware)
Won't bore you all with media recaps, but it's been an interesting weekend to say the least. Thanks to the way Microsoft issues patches, there are quite a few KBs to look for... So we wanted to share some technical details to help you determine if your endpoints are protected from this ransomware:
Bonus 1: If you're using Webroot, you're already protected.
Bonus 2: Here's a list of the KB for MSPs that aren't using ConnectWise Automate (formerly LabTech):
- KB4019264 - For Windows 7 SP1 / Windows 2008 R2 SP1
- KB4019215 - For Windows 8.1 / Windows 2012 R2 Standard
- KB4019216 - For Windows 2012 Standard
- KB4019472 - For Windows 10 (1607) / Windows 2016
- KB4012598 - For out of date OS - Windows XP/Vista/8/2003
- KB4013198 - For out of date Windows 10 (511)
If you really want to go the extra mile tho, start disabling SMB v1 where possible, as it was used in ~30% of the exploits released by ShadowBrokers last month.
Edit: The KBs referenced are May rollups (which superseded the March + April rollups)
Posted May 15, 2017, 6:19 PM UTC · edited
4419
Public service announcement: Do not blindly trust what the Labtech Patch-manager says and spot check your servers directly. We fought with the patch manager all weekend and spot checked most of our servers we found just a ton of bad data. Many servers that were marked as 100% compliant that had not been patched in months. We also had servers that did not show up in the device deployment list in spite of being in the literal exact same groups as other servers at the same sites. I am sure that it is just something that we are doing wrong and we are just too stupid to use the patch manager correctly but we won't know until labtech gets back to me on our 4 month old patching ticket. We thought we were covered because labtech was reporting 98% compliance, and it was this manual check this weekend that found problems. So again, please spot check your servers. I appreciate u/cjmod posting this update in the community though, it does have some very good information in it.
Yup, we are set to auto approve critical updates and had most PC's showing 100%. Once I started digging in I found not a single PC had the MS17-010 patch despite showing 100% and the patch showing approved. I'm pissed at Labtech. First time in 4 years I'm seriously considering moving to something else. If an RMM can't patch accurately it's worthless.
I had a ticket open with them regarding their patching, its frustrating like hell. I had a patch on a user's system that I wanted to block but it was nowhere to be found in patch manager. None of the LT techs could understand why it could be installed on the machine yet not be listed anywhere in patch manager.
yes we are seeing this on several systems also. or maybe the opposite of it. we find a patch and half the systems it should apply to are not listed.
If you have March, April, and/or May rollup update installed then it includes the MS17-010 patch.
Exactly the same for us. Complete bullshit.
[removed]
Making a note of this for tomorrow! Thanks for the heads up!
Here is a powershell script you can run against a domain.
https://github.com/kieranwalsh/PowerShell/blob/master/Get-WannaCryPatchState/Get-WannaCryPatchState.ps1
It will check the patches installed on online AD joined computers and (eventually) report back telling what it found.
out of 250 servers with MS17-010 we have 2 that are out of compliance on labtech (latest version), and yet in practice 85% of those servers need the update done.
We ran into the exact same situation. Compliance looked great but every machine was missing the patch. I'd love to hear what Labtech tells you was wrong!
I have the exact same problem. Ended up getting into an argument with support who kept telling me that it was working and wouldn't listen to a thing I said.