Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 18 replies
  • Subscribers 3 subscribers
  • Views 36923 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cryptowall 3.0 Prevention

syuusuke
Hello,

I just got hit with Cryptowall 3.0 on Friday and SEP on the infected workstation didn't prevent the attack until it started to detect help_decrypt.txt .png .html files.  The endpoint client was up-to-date so I'm not sure why this happened.  Wasn't Sophos AV suppose to prevent such malware behaviour from fully executing?  Did anyone encounter the same thing?

FYI, Cryptowall managed to delete my shadow copy but luckily I do have backups.

Edit - After reading replies, yes I do use Sophos UTM as well. All the workstations uses Sophos Endpoint Protection.


This thread was automatically locked due to age.
Parents
  • 0
    Or... Endpoint could do its job as well and help prevent infection.

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

  • 0 in reply to Amodin
    Or... Endpoint could do its job as well and help prevent infection.


    it does if you configure your workstation correctly.  If you are running as admin there's nothing anything can do to totally protect you.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

Reply
  • 0 in reply to Amodin
    Or... Endpoint could do its job as well and help prevent infection.


    it does if you configure your workstation correctly.  If you are running as admin there's nothing anything can do to totally protect you.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

Children
  • 0 in reply to William Warren
    it does if you configure your workstation correctly.  If you are running as admin there's nothing anything can do to totally protect you.


    Well obviously, yes.  However, the failure of Endpoint not even catching it or warning about it is bad.  Configured workstations with decent anti-virus can and will still catch things like this.  My point was specifically failure on the virus engine part, not about the configuration of a computer.

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

  • 0 in reply to Amodin
    Well obviously, yes.  However, the failure of Endpoint not even catching it or warning about it is bad.  Configured workstations with decent anti-virus can and will still catch things like this.  My point was specifically failure on the virus engine part, not about the configuration of a computer.


    you are missing the forest for the trees.  If a user is logged in as admin the fact that endpoint missed is not endpoints problem it is the admin/user.  Take admin away then the endpoint protection has better access than the user.  This goes for any a/v not just sophos.  Some endpoints are better than others but all of them suffer badly when you operate as an admin 100% of the time.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0 in reply to William Warren
    I don't understand. The shop is not using the UTM? Did the UTM completely miss crypto also? 

    The way OP is describing the situation, is he using the sophos endpoint protection with the UTM or the Endpoint Security and Control.
Unfiltered HTML