5 ms·

> I am having a hard time imagining how a compromise of a workstation could result in the entire company -- their own apps, their call center -- going down for

> I am having a hard time imagining how a compromise of a workstation could result in the entire company -- their own apps, their call center -- going down for days Can't guess at specifics, but if it's a Windows network, I would be utterly unsurprised if all users had excess permissions to shared drives Many Windows networks just have a giant X: everyone can write to, and it's been like that forever, and it's so deeply baked into everyone's workflow that it never gets fixed

EvanAnderson 6y ago
I would presume that the attacker was able to obtain Domain Admin / Enterprise Admin rights before they deployed the payload, then they just steamrolled over everything. The one of these that I got called-in to clean up after literally had a batch file on Domain Controllers w/ a text file of computer names for a FOR loop launching the malware on computer-after-computer with "psexec". It was decidedly non-sophisticated. The attacker compromised a Domain Admin account and then they were set.
stefan_ 6y ago
Is it common practice to have the servers running your production (not in the manufacturing sense) cloud services join the AD domain that has your office staff in it? Why? That doesn't even make any sense from a convenience PoV. It just seems like an unfathomable level of incompetence required to go from compromising some random Windows workstation all across the hardware that runs your app services. And lest we forget: a ransomware attack is always also a massive data loss attack. Garmin better get to work complying with the law and notifying impacted customers (all of them?).
- ryandrake 6y ago
  If there's one thing I've learned in the computer industry, it's that there is no such thing as an unfathomable level of incompetence. All levels of incompetence are not only fathomable, but repeatedly demonstrated. It's amazing that anything works at all.
  - moepstar 6y ago
    If this wasn't so, so true, it'd be even funny :(
bentcorner 6y ago
> Many Windows networks just have a giant X: everyone can write to, and it's been like that forever, and it's so deeply baked into everyone's workflow that it never gets fixed I've seen this too, and you need to be vigilant with what accesses these kinds of resources (basically anybody with write access to these shares also has execute access to any accounts executing from that share).

EvanAnderson 6y ago

I would presume that the attacker was able to obtain Domain Admin / Enterprise Admin rights before they deployed the payload, then they just steamrolled over everything. The one of these that I got called-in to clean up after literally had a batch file on Domain Controllers w/ a text file of computer names for a FOR loop launching the malware on computer-after-computer with "psexec". It was decidedly non-sophisticated. The attacker compromised a Domain Admin account and then they were set.

stefan_ 6y ago

Is it common practice to have the servers running your production (not in the manufacturing sense) cloud services join the AD domain that has your office staff in it? Why? That doesn't even make any sense from a convenience PoV. It just seems like an unfathomable level of incompetence required to go from compromising some random Windows workstation all across the hardware that runs your app services. And lest we forget: a ransomware attack is always also a massive data loss attack. Garmin better get to work complying with the law and notifying impacted customers (all of them?).

ryandrake 6y ago
If there's one thing I've learned in the computer industry, it's that there is no such thing as an unfathomable level of incompetence. All levels of incompetence are not only fathomable, but repeatedly demonstrated. It's amazing that anything works at all.
- moepstar 6y ago
  If this wasn't so, so true, it'd be even funny :(

bentcorner 6y ago

> Many Windows networks just have a giant X: everyone can write to, and it's been like that forever, and it's so deeply baked into everyone's workflow that it never gets fixed I've seen this too, and you need to be vigilant with what accesses these kinds of resources (basically anybody with write access to these shares also has execute access to any accounts executing from that share).