SIARAN PERS KEMENTERIAN KOMUNIKASI DAN INFORMATIKA
NO. 55/HM/KOMINFO/05/2017
Tentang
Himbauan Agar Segera Melakukan Tindakan Pencegahan Terhadap Ancaman Malware Khususnya Ransomware Jenis WannaCRY
Seperti yang diberitakan di beberapa media baik di dalam ataupun luar negeri, telah terjadi fenomena serangan siber di beberapa negara, termasuk Indonesia. Direktur Jenderal Aplikasi Informatika, Semuel A. Pangerapan menyampaikan serangan siber ini bersifat tersebar dan masif serta menyerang critical resource (sumber daya sangat penting), maka serangan ini bisa dikategorikan teroris siber.
Di Indonesia, berdasarkan laporan yang diterima oleh Kominfo, serangan ditujukan ke Rumah Sakit Harapan Kita dan Rumah Sakit Dharmais. Dengan adanya serangan siber ini kami minta agar masyarakat tetap tenang dan meningkatkan kehati hatian dalam berinteraksi di dunia siber.
Semmy menjelaskan serangan siber yang menyerang Indonesia berjenis ransomware. Ransomware adalah sebuah jenis malicious software atau malware yang menyerang komputer korban dengan cara mengunci komputer korban atau meng-encrypt semua file yang ada sehingga tidak bisa diakses kembali. Tahun ini sebuah jenis ransomware baru telah muncul dan diperkirakan bisa memakan banyak korban. Ransomware baru ini disebut Wannacry. Wannacry ransomware mengincar PC berbasis windows yang memiliki kelemahan terkait fungsi SMB yang dijalankan di komputer tersebut. Saat ini diduga serangan Wannacry sudah memakan banyak korban ke berbagai negara. Oleh karena itu penting untuk melakukan serangkaian tindakan pencegahan dan juga penanganan apabila terjadi insiden.
Infeksi dan Penyebaran :
Wannacry menginfeksi sebuah computer dengan meng-enkripsi seluruh file yang ada di komputer tersebut dan dengan menggunakan kelemahan yang ada pada layanan SMB bisa melakukan eksekusi perintah lalu menyebar ke computer windows lain pada jaringan yang sama. Semua komputer yang tersambung ke internet yang masih memiliki kelemahan ini apalagi komputer yang berada pada jaringan yang sama memiliki potensi terinfeksi terhadap ancaman Wannacry. Setiap komputer windows yang sudah terinfeksi akan mendapatkan tampilan seperti gambar page di atas.
Dari tampilan diketahui bahwa Wannacry meminta ransom atau dana tebusan agar file file yang dibajak dengan enkripsi bisa dikembalikan dalam keadaan normal lagi. Dana tembusan yang diminta adalah dengan pembayaran bitcoin yang setara dgn 300 dollar amerika. Wannacry memberikan alamat bitcoin untuk pembayarannya. Disamping itu juga memberikan deadline waktu terakhir pembayaran dan waktu dimana denda tebusan bisa naik jika belum dibayar juga.
Tindakan Pencegahan sebelum infeksi :
Lakukan beberapa langkah berikut untuk tindakan pencegahan dari terinfeksi malware ransomare jenis wannacry,
- Cabut Kabel LAN/Wifi
- Lakukan Backup Data
- Update Anti-Virus
- Update security pada windows anda dengan install Patch MS17-010 yang dikeluarkan oleh microsoct. Lihat : https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
- Jangan mengaktifkan fungsi macros
- Non aktifkan fungsi SMB v1
- Block 139/445 & 3389 Ports
- Ulangi, selalu backup file file penting di komputer anda dan di simpan backupnya ditempat lain
Tindakan Setelah Infeksi :
Saat ini belum ada solusi yang paling cepat dan jitu untuk mengembalikan file file yang sudah terinfeksi wannacry. Akan tetapi memutuskan sambungan internet dari komputer yang terinfeksi akan menghentikan penyebaran wannacry ke komputer lain yang rentan vulnerable.
Sebagai tambahan yang sangat penting, ID-SIRTII menghimbau agar pada hari Senin besok dan kantor akan buka, mohon diwaspadai ancaman ini dan melakukan hal-hal sebagai berikut :
- Agar PC-PC dan bentuk Komputer Personal dan Jaringan lainnya jangan terhubung ke LAN dan Internet dulu,
- Terlebih dahulu lakukan backup data penting,
- Pastikan software anti virus sudah update serta security patch yang disarankan oleh microsoft dilakukan terlebih dahulu.
Untuk konsultasi secara online bisa diakses ke : https://www.nomoreransom.org . Juga, apabila diperlukan informasi dan saran teknis, dapat diemail : incident@idsirtii.or.id .
Kontak Person apabila diperlukan,
Direktur Keamanan Informasi : Aidil Cenderamata 0817758377
Wakil Ketua ID-SIRTII : Salahuddin (Didin) 0816945022
Jakarta, 13 Mei 2017
Microsoft solution available to protect additional products
Today many of our customers around the world and the critical systems they depend on were victims of malicious “WannaCrypt” software. Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful. Microsoft worked throughout the day to ensure we understood the attack and were taking all possible actions to protect our customers. This blog spells out the steps every individual and business should take to stay protected. Additionally, we are taking the highly unusual step of providing a security update for all customers to protect Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003. Customers running Windows 10 were not targeted by the attack today.
Details are below.
- In March, we released a security update which addresses the vulnerability that these attacks are exploiting. Those who have Windows Update enabled are protected against attacks on this vulnerability. For those organizations who have not yet applied the security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010.
- For customers using Windows Defender, we released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt. As an additional “defense-in-depth” measure, keep up-to-date anti-malware software installed on your machines. Customers running anti-malware software from any number of security companies can confirm with their provider, that they are protected.
- This attack type may evolve over time, so any additional defense-in-depth strategies will provide additional protections. (For example, to further protect against SMBv1 attacks, customers should consider blocking legacy protocols on their networks).
We also know that some of our customers are running versions of Windows that no longer receive mainstream support. That means those customers will not have received the above mentioned Security Update released in March. Given the potential impact to customers and their businesses, we made the decision to make the Security Update for platforms in custom support only, Windows XP, Windows 8, and Windows Server 2003, broadly available for download (see links below).
Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible.
This decision was made based on an assessment of this situation, with the principle of protecting our customer ecosystem overall, firmly in mind.
Some of the observed attacks use common phishing tactics including malicious attachments. Customers should use vigilance when opening documents from untrusted or unknown sources. For Office 365 customers we are continually monitoring and updating to protect against these kinds of threats including Ransom:Win32/WannaCrypt. More information on the malware itself is available from the Microsoft Malware Protection Center on the Windows Security blog. For those new to the Microsoft Malware Protection Center, this is a technical discussion focused on providing the IT Security Professional with information to help further protect systems.
We are working with customers to provide additional assistance as this situation evolves, and will update this blog with details as appropriate.
Phillip Misner, Principal Security Group Manager Microsoft Security Response Center
Further resources:
Download English language security updates: Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86,Windows XP SP2 x64, Windows XP SP3 x86, Windows XP Embedded SP3 x86, Windows 8 x86,Windows 8 x64
Download localized language security updates: Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86, Windows XP SP2 x64, Windows XP SP3 x86, Windows XP Embedded SP3 x86, Windows 8 x86, Windows 8 x64
General information on ransomware: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx
MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
How does the malware work and who is behind it?
The infections seem to be deployed via a worm – a program that spreads by itself between computers.
Most other malicious programmes rely on humans to spread by tricking them into clicking on an attachment harbouring the attack code.
By contrast, once WannaCry is inside an organisation it will hunt down vulnerable machines and infect them too.
Some experts say the attack may have been built to exploit a weakness in Microsoft systems that had been identified by the NSA and given the name EternalBlue.
The NSA tools were stolen by a group of hackers known as The Shadow Brokers, who made it freely available in April, saying it was a “protest” about US President Donald Trump.
At the time, some cyber-security experts said some of the malware was real, but old.
A patch for the vulnerability was released by Microsoft in March, which would have automatically protected those computers with Windows Update enabled.
Microsoft said on Friday it would roll out the update to users of older operating systems “that no longer receive mainstream support”, such Windows XP (which the NHS still largely uses), Windows 8 and Windows Server 2003.
The number of infections seems to be slowing after a “kill switch” appears to have been accidentally triggered by a UK-based cyber-security researcher tweeting as @MalwareTechBlog.
He was quoted as saying he noticed the web address the virus was searching for had not been registered – and when he registered it, the virus appeared to stop spreading.
But he warned this was a temporary fix, and urged computers users to “patch your systems ASAP”.
Apa itu Ransomware ? toton videonya disini : https://www.youtube.com/watch?v=NfwM4i4Y26M dan di https://www.youtube.com/watch?v=C7f56DAMxfY
