3 ms·
The common components in the ransomware attacks is Windows and AD. Some leverage known exploits against elements like LSASS, so if the person infected has cred
by 6c696e7578 6y ago
The common components in the ransomware attacks is Windows and AD.
Some leverage known exploits against elements like LSASS, so if the person infected has credentials for another computer, why not slurp up all the credential tokens on remote computers that you can log into too.
If you use Linux/Unix on the other hand, you can do descent things to contain access. Firstly, elevated management accounts can restrict login sources, either by ssh authorized_keys or deny rules in sshd_config. Secondly, and very importantly, you can contain what applications can access through SELinux.
Running Windows these days is like walking around with "Kick me" hung around your neck.
- lostmsu 6y agoNone of what you mentioned requires a lot of effort on Windows. Exploits in LSASS are no different from exploits in Linux kernel, and if you stay up to date and configure everything correctly you should be fine.
- user5994461 6y agoLSASS is a system process, need SE_DEBUG_PRIVILEGES to read its memory (full system administrator). As far as I am aware, the last time there was an actual exploit in LSASS was in Windows XP.
- viraptor 6y agoI think your generalisation doesn't work once you get to sites with advanced staff and budget. For example this will stop all but extremely targeted attacks: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro... but it requires a lot of time managing and the more varied things you do, the more annoying it will be to manage. (+ It's probably impossible for devs)
- lrnStats 6y agoThis needs to be flagged