Would MBAE have prevented the WannaCry ransomware?

[ikjadoon]

I'm just curious. I didn't get infected (as I'm fully patched on Windows 10), but in the rogue chance that somehow a new WannaCry bypassed MS's March patches (or if an unpatched Windows 7 user was running MBAE)...would MBAE have prevented this ransomware?

Cool beans. Thanks; love the software.

[1PW]

Hello @ikjadoon:

In a word, yes -  and when MBAE is combined with Malwarebytes Anti-Ransomware (MBARW), the protections of course increase.  Better yet, if running MB3 Premium, where MBAE and MBARW are already rolled in as the full-time protections, AE Module and ARW Module, the presently known WannaCry variants are entirely thwarted with additional behavior based detections and defenses.  Thank you.

[cutting_edgetech]

Does MBAE currently block EternalBlue Exploit used to spread WannaCry? I do not think MBAE has a network packet filter, if that's the case then I guess it does not.

[ftballpack]

Malwarebytes anti-exploit is a memory based protection. EternalBlue is a network based attack. Blocking the affected port using a firewall, or an Intrusion Detection System (IPS) (which is almost always running Snort) can stop this attack. Of course patching would completely stop the EternalBlue exploit, used by WannaCry completely.

Malwarebytes anti-ransomware,which is bundled into Malwarebytes 3.0 would also stop the ransomware infection; however, it would not stop a computer for from first being exploited.

This is why the NSA liked EternalBlue, without knowledge of the exploit, IPS is useless to stop this type of attack and Malwarebytes Anti-Exploit, HitmanPro.Alert, and EMET would be useless to stop it. Luckily IPS, such as that included in Symantec Endpoint, which Symantec took from Sygate when they purchased them, would protect users, as the Symantec's Endpoint firewall based on Sygate's firewall, includes Snort.

Malwarebytes anti-exploit on it's own will not stop WannaCry, unfortunately.

[pbust]

Correct, network exploits like SMB/NetBios are outside the scope of MBAE.

Btw IPS/IDS engines would also be blind to it at 0-day without a signature to apply to it.