4 ms·
The attack was usually introduced via a phishing attack and then spread through SMB vulnerabilities. It generally wasn't that SMB endpoints were open to the int
by dhd415 9y ago
The attack was usually introduced via a phishing attack and then spread through SMB vulnerabilities. It generally wasn't that SMB endpoints were open to the internet.
- ufmace 9y agoCertainly possible, but if it was spread with an ordinary phishing attack, I gotta wonder why all of these organizations got hit so hard in such a short timeframe. We've had lots and lots of conventionally spread ransomware attacks go out, but I don't know of any that have had this kind of effect in this timeframe.
- y_u_no_rust 9y agowindows defender exploit though or a preexisting nsa implant
- joelhaasnoot 9y agoCould it be organisations sharing data by SMB infecting each other?
- jsz0 9y agoThe irony of this is SMB servers are often setup with insecure configs exactly because it's so rarely used over public networks. Too many people assume public networks will be their Maginot Line against SMB attacks.