Hypothetical - WannaCry > Sharepoint?

glenimp617 · 26 Jun 2017 at 14:51

Hi Everyone,

Let's say that a company got hit by a new virus (wannacryv2) and all users had a mapped network drive to a company sharepoint site.

In theory, would the data in sharepoint be encrypted by the virus? or would Microsofts servers stop it

Thanks

Emlyn_Dewar · 26 Jun 2017 at 15:31

In the MS webinar they did immediately afterwards, the guy had said that any mapped drives could be compromised, including Sharepoint.

I guess it could be restored I suppose, but it would be a nightmare.

glenimp617 · 26 Jun 2017 at 15:45

Thanks, that's very helpful

nightmare99 · 26 Jun 2017 at 20:48

If its Office 365 I believe you have to request they restore the whole site collection and not individual Files and/or doc libraries.

glenimp617 · 26 Jun 2017 at 21:25

nightmare99 said:
If its Office 365 I believe you have to request they restore the whole site collection and not individual Files and/or doc libraries.

Don't suppose you have a link saying that, just doing a BCP for work and this could be quite critical for us. Thanks.

teaboy5 · 26 Jun 2017 at 21:47

Emlyn_Dewar said:
In the MS webinar they did immediately afterwards, the guy had said that any mapped drives could be compromised, including Sharepoint.

I guess it could be restored I suppose, but it would be a nightmare.

Got a link?

Emlyn_Dewar · 27 Jun 2017 at 13:12

Will have a rake. They did it over Skype for Business, but it was definitely recorded for later.

Edit: This was the one. It was almost amusing but ultimately soul destroying to hear the guy's faith in humanity be slowly eroded by ridiculous questions.

nightmare99 · 27 Jun 2017 at 15:00

glen8 said:
Don't suppose you have a link saying that, just doing a BCP for work and this could be quite critical for us. Thanks.

The only ones I can find at the moment are these but I'm sure there is a more up to date page abut somewhere

https://www.itunity.com/article/limitations-sharepoint-online-backup-restore-3550
https://blogs.technet.microsoft.com/akieft/2012/01/09/restore-options-in-sharepoint-online/

glenimp617 · 27 Jun 2017 at 15:07

Thanks guys

Deleted member 77746 · 28 Jun 2017 at 00:10

A reason to get rid of shared drives. For security sake.

glenimp617 · 28 Jun 2017 at 08:58

mrbell1984 said:
A reason to get rid of shared drives. For security sake.

What about the pointer for onedrive found in explorer? Technically it acts as a folder within the users profile c:\users\username\onedrive. Assume that a virus would look in the profile as well, infecting onedrive and syncing back to the cloud?

nightmare99 · 28 Jun 2017 at 13:07

glen8 said:
What about the pointer for onedrive found in explorer? Technically it acts as a folder within the users profile c:\users\username\onedrive. Assume that a virus would look in the profile as well, infecting onedrive and syncing back to the cloud?

Try to avoid file sync to local workstations where possible.

York · 5 Aug 2017 at 10:34

Having had to do this for 200tb of data; yes it can encrypt and yes its a very complicated support call with MS when you have to roll back 100k+ site collections.

Liquidfox · 11 Aug 2017 at 10:58

TheOracle said:
What about the pointer for onedrive found in explorer? Technically it acts as a folder within the users profile c:\users\username\onedrive. Assume that a virus would look in the profile as well, infecting onedrive and syncing back to the cloud?

Yes viruses do infect stuff like that, we had a client who got hit a while back who had their entire DropBox sync encrypted. They had to use the previous versions function on the web portal. We had advised against syncing personal data on work's machines several times prior so it was on their head. They weren't best pleased when they were told that we were happy to sort it out for them at their usual hourly rate

xxalxx · 21 Aug 2017 at 01:02

Emlyn_Dewar said:
Will have a rake. They did it over Skype for Business, but it was definitely recorded for later.
Edit: This was the one. It was almost amusing but ultimately soul destroying to hear the guy's faith in humanity be slowly eroded by ridiculous questions.

The presenter on that webinar was brilliant and you could easily see him banging his head on his desk at the questions.