[anti-abuse-wg] [cooperation-wg] WannaCry Ransomware

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In message , ox <andre at ox.co.za> writes

>WannaCry: Advice to consumers should place a lot more focus on Web Browsers 
>(than
>on email - although email transports links, sometimes the payload, etc
>as well - this is well known...- What is not known is that the
>consumers favorite PORN website also installs 'monitor ware'...) 

by all means proffer advice to consumers ... but Wannacry spreads
entirely over the network (sending traffic to open tcp/445 ports to
exploit CVE-2017-0145)

<http://cert.europa.eu/static/SecurityAdvisories/2017/CERT-EU-
SA2017-012.pdf>

No-one (and a lot of folk have been looking very hard) has found any
examples of it being spread by email. Early reports suggested this was
the initial vector, but they were just guessing -- and the large amount
of Jaff being sent at the end of last week added to the confusion.

So linking advice about email or web browsers to Wannacry just invites
laughing and pointing :(

- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBWRw3WTu8z1Kouez7EQLYbwCgrsBVY3yAlOPO9pnybJehZNGimcUAoPMa
LGjtHZdnvqKsq2OJGQ/W/3Mp
=MOKd
-----END PGP SIGNATURE-----