5 ms·
> The initial infection vector is still unknown. Reports by some of phishing emails have been dismissed by other researchers as relevant only to a different (un
by Macuyiko 9y ago
> The initial infection vector is still unknown. Reports by some of phishing emails have been dismissed by other researchers as relevant only to a different (unrelated) ransomware campaign, called Jaff. There is also a working theory that initial compromise may have come from SMB shares exposed to the public internet. Results from Shodan show over 1.5 million devices with port 445 open – the attacker could have infected those shares directly.
I think this is an important take-away. I found it strange that so many media outlets and IT departments were jumping on the "do not open suspicious emails" bandwagon even although there hasn't been a lot of evidence of such phishing emails. That is: screenshots of infected devices have been popping up all across the world, but almost no examples of a particular entry email have been shown.
Of course, it might be easier for an IT dep. to state: "it must have been unleashed by someone clicking on some email they got" rather than "oops, we still had unpatched Windows machines exposed to the public internet". Why go through the trouble of sending out emails when your worm already contains a replication/infection mechanism. Just use a botnet to scan those 1 million IPs and see if SMB is open.
That being said, it does not surprise me to see yet again an issue in SMB. This has been a particularly weak point in Windows for decades now. I remember "hacking tutorials" from 15 years ago where you'd just go out and nmap public IP ranges to see if you could access hidden shares (e.g. like so: http://www.madirish.net/59 http://www.madirish.net/59). Also there was this issue of Windows keeping weak NetBIOS password hashes around which could be trivially unhashed (https://vuldb.com/?id.13824 https://vuldb.com/?id.13824), years ago.
- tomlong 9y agoA fair amount of ransomware is distributed via email, so it's not such a bad idea when this issue is front and centre and all over the news to reinforce good behaviour amongst users. It's not like 'stop clicking random shit in emails' is bad advice.
- Piskvorrr 9y agoI do remember when ILOVEYOU was making the rounds...and to paraphrase, it's not like 'stop clicking random shit in emails' is useful advice. Yes, it would help - but do you see fewer people clicking random shit? Me neither: "Ugg click attachment for dancing hampsters, now Ugg virus, halp!" is still the prevalent vector, two decades later.
- paulddraper 9y agoWhy the hell can't I click shit in random emails? It's a friggin email and data transfer for crying out loud. Stop blaming users.
- Piskvorrr 9y agoOh, you can. Just like you can inject any random substance given to you by a stranger. Being aware that both are high risk activities is the point, methinks.
- sp332 9y agoThere's absolutely no reason that sending a link to someone should be able to pwn their box. There's no reason to make such fragile email systems.
- ihattendorf 9y agoWhat if they click the link, run the downloaded invoice.EXE, and enter their password when prompted? At a certain point, the user needs to be educated enough to avoid this. PDF/Office macros are a whole other topic though.
- sp332 9y agoThere's a really big gap there. Look at chromeOS - you can click a lot more email links on that OS without getting ransomware'd.