The Ransomware Outbreak and the Computers That Missed an Update

What happened on Friday

On Friday, ransomware called WannaCry spread to computers in many countries within hours. It locks the files on a computer and demands a payment to release them.

What made it spread so fast is the way it moves: once inside a network, it looks for other Windows computers missing a particular security update and copies itself to them, with nobody clicking anything.

That update was released in March for the versions of Windows still supported. An emergency fix for older versions, including Windows XP, has followed since.

Most small offices were not hit. But the gap it used, computers that missed an update, is common in small offices, and the next outbreak will look for the same gap.

Why one missed update mattered

Most office security advice is about people: suspicious emails, unexpected attachments, fake login pages. That still matters.

But a computer with the March update was protected from the way this outbreak spread between machines, and one without it could be infected by its neighbour.

So the most useful thing an office can do today is not training or new software. It is making sure every Windows computer has installed its updates.

The computers that missed it

• Machines set to ask first, whose update prompts were dismissed for weeks.
• Laptops left in a drawer or switched off since March.
• Computers attached to equipment, such as a till, scanner or printing machine.
• Windows XP and Vista, which no longer receive regular fixes.
• Computers whose updates fail quietly every month.
• Home computers that connect to the office network.

The third is the one most offices forget, because nobody thinks of it as a computer. It runs a machine, it has run it for years, and nobody wants to touch it in case the machine stops.

Check every computer today

List every Windows computer the business uses, including the ones in back rooms and the ones that go home.

On each, open Windows Update, install everything offered and restart. Then check that the update history shows installs succeeding, not quietly failing.

It is under Update and Security in Settings on Windows 10, and in the Control Panel on Windows 7. A machine showing failures month after month needs someone to look at it this week.

The old machines nobody maintains

A computer on Windows XP can now install the emergency fix, and should today. It still gets nothing else, so it remains the weakest machine in the building.

If it cannot be replaced yet, usually because it runs equipment whose software never moved on, take it off the network: unplug the cable, turn off its Wi-Fi, and move files to it some other way.

Vista stopped receiving fixes last month. A Vista machine that installed the March update is covered for this outbreak, and for nothing that comes after it.

A worked example

A camera store with a photo printing counter has five computers: two tills, the owner's office machine, a laptop used at weekend workshops, and the computer that runs the printing machine.

That last one runs Windows XP, because the printer's software was never updated for anything newer, and it shared a folder with the counter till.

On Saturday the owner checked them all. The tills were set to ask before updating and had installed nothing since February. The laptop had been switched off since a March workshop.

The backup was an external drive permanently plugged into the office computer, so anything that locked that computer's files would have locked the backup too.

Nothing had been infected. By Sunday evening the tills and laptop were updated, and the XP machine had its emergency fix and was off the network, with photos carried to it on a dedicated USB drive.

From this week, a second backup drive goes home with the owner each Friday, swapped for the one that comes back, so one copy is always away from the store.

Backups the ransomware cannot reach

Ransomware locks every file it can reach: drives plugged into the infected computer, shared folders on the network, and folders that sync to online storage, which then sync the locked copies.

So at least one copy needs to be somewhere the infected computer cannot touch: a pair of drives swapped weekly, one always unplugged and away, or an online backup that keeps older versions for weeks.

And a backup nobody has restored from is an assumption. Restore one file from last month to a different folder; if that takes an afternoon of hunting for passwords, better to learn it now.

File sharing and the office router

The outbreak spread through the feature Windows uses for shared folders and printers. An old version of it, which most offices no longer need, can be switched off by whoever looks after your computers.

Share folders only with the computers that need them, and make sure the office router does not expose file sharing to the internet.

If a screen demands payment

Unplug that computer from the network at once, cable and Wi-Fi, and call whoever looks after your computers. Do not connect a backup drive to it.

Paying does not guarantee the files come back. With a backup kept separately, the answer is to wipe the machine, reinstall, update it and restore.

The counter-case

An office with a couple of recent Windows 10 laptops updating automatically, and files in a service that keeps old versions, is in reasonable shape. Today's check takes ten minutes.

Macs were not affected by this outbreak, though the backup advice applies to them too.

And none of this calls for buying security software in a hurry. The protection that mattered on Friday was an update that cost nothing.

Update every Windows computer, deal with the old ones, and keep one backup out of reach.

Today

1. List every Windows computer the business uses.
2. Run Windows Update on each, then restart.
3. Switch on the machines that were off and update them.
4. Install the emergency fix on any XP computer.
5. Unplug old machines from the network where possible.
6. Keep one backup copy disconnected and off site.
7. Restore one file to prove the backup works.

Step three is the easiest to miss. A computer switched off for weeks has missed every update in that time, and until it catches up it is the one machine in the office without the fix.

Finding the office computers on versions that no longer get regular fixes is covered in Windows Vista stops getting updates today.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.