Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 632015" data-attributes="member: 32260">After reading some technical analyses of EternalBlue &amp; DoublePulsar worm (used in the WannaCry attack) I should change my opinion, and admit that it cannot be stopped by SRP or anti-exe.It is still true that Hard_Configurator with recommended settings (SRP + &lt;Run As SmartScreen&gt; = Administrator) will stop Wannacry execution by the user, due to forced SmartScreen. Furthermore, home users are still well protected, because the home networks are typically under the NAT, and the worm uses port 445 that is closed by default.The problem arises when the computer is connected to the big local network. See also :<a href="https://malwaretips.com/threads/is-that-true-that-default-deny-security-solutions-can-stop-the-eternalblue-doublepulsar-attacks.71722/" target="_blank">Is that true, that default deny security solutions can stop the EternalBlue &amp; DoublePulsar attacks?</a>EDITThe users that frequently update the system, are also protected, because Microsoft released the patch, many days before the EternalBlue &amp; DoublePulsar worm attack (in the wild).</blockquote>

[QUOTE="Andy Ful, post: 632015, member: 32260"] After reading some technical analyses of EternalBlue & DoublePulsar worm (used in the WannaCry attack) I should change my opinion, and admit that it cannot be stopped by SRP or anti-exe. It is still true that Hard_Configurator with recommended settings (SRP + <Run As SmartScreen> = Administrator) will stop Wannacry execution by the user, due to forced SmartScreen. Furthermore, home users are still well protected, because the home networks are typically under the NAT, and the worm uses port 445 that is closed by default. The problem arises when the computer is connected to the big local network. See also : [URL='https://malwaretips.com/threads/is-that-true-that-default-deny-security-solutions-can-stop-the-eternalblue-doublepulsar-attacks.71722/']Is that true, that default deny security solutions can stop the EternalBlue & DoublePulsar attacks?[/URL] EDIT The users that frequently update the system, are also protected, because Microsoft released the patch, many days before the EternalBlue & DoublePulsar worm attack (in the wild). [/QUOTE]

Verification