5 ms·

Isn't production data being replicated to backups at a minimum daily? How is ransomware still a thing at big corps in 2020.

unixhero 6y ago
The cancer of our time: Active directory and domain controllers. Ransomware is just the attack vector. At the end of the cyber kill cHain lies AD.
- mikorym 6y ago
  Could you elaborate?
  - unixhero 6y ago
    Attackers fool humans into clicking on URL's leading to malware downloads, or with embedded or attached malware in emails. Then when the payload has been installed on the victim's computer. The next step is to spread and also to get control of as many machines as possible in on the same and neighbouring networks. With the eventual goal of command and control. When unimpeeded, these attacks now take 5-10 minutes. From here they lay low, for months.. Then the shit really hit the fan when they take the domain controller infrastructure through a GOLDEN TICKET using KERBEROASTING attacks. Then Kansas is going bye bye. You better pray your competent IT leadership has taken steps to make IDENTIFY, DETECT, PROTECT, RESPOND, RECOVER dimensions (NIST framework) a reality across the technologies your company relies on. MITRE defines a generic framework for hacking attacks: - INITIAL ACCESS - EXECUTION - PERSISTENCE - PRIVILEGE ESCALATION - DEFENSE EVATION - CREDENTIAL ACCESS - DISCOVERY - LATERAL MOVEMENT - COLLECTION - COMMAND AND CONTROL - EXFILTRATION - IMPACT From here I recommend you read the MITRE ATTACK framework, great reading! https://attack.mitre.org/ https://attack.mitre.org/ https://www.youtube.com/watch?v=bkfwMADar0M https://www.youtube.com/watch?v=bkfwMADar0M https://www.youtube.com/watch?v=b6GUXerE9Ac https://www.youtube.com/watch?v=b6GUXerE9Ac https://www.youtube.com/watch?v=_SsUeWYoO1Y https://www.youtube.com/watch?v=_SsUeWYoO1Y Real talk!
    - mikorym 6y ago
      Is it still done via actual downloads? It's very easy for script kiddies to do that. I would have expected a bit more sophistication, like hidden URLs in emails that autoresolve, at the least. Not my area, though.
      - unixhero 6y ago
        It is done in every possible way. The dumbest form your defenses will allow in is what you get. Can absolutely be done via downloads yes. Because they perform an impersonation attack on you, or use a supplier as an attack vector, and by impersonating a trusted user, they get you to open a file or similar. Better finetune your email security, because humans are a hard problem. Loads of awareness, phishing drills and information sec training is needed.
stu2b50 6y ago
Ransomware attacks will often wait after getting into systems, so that they can also encrypt live backups. Air gapped backups from sufficiently long ago will work, but not only is restoring to those usually a pain in the ass, but would also come with significant business cost... which may be more than the ransom. That's the goal, anyway.
choward 6y ago
That doesn't protect against them threatening to make all the data public.
sfshaw 6y ago
Paying a random is a better user experience than restoring a backup.

unixhero 6y ago

The cancer of our time: Active directory and domain controllers. Ransomware is just the attack vector. At the end of the cyber kill cHain lies AD.

mikorym 6y ago
Could you elaborate?
- unixhero 6y ago
  Attackers fool humans into clicking on URL's leading to malware downloads, or with embedded or attached malware in emails. Then when the payload has been installed on the victim's computer. The next step is to spread and also to get control of as many machines as possible in on the same and neighbouring networks. With the eventual goal of command and control. When unimpeeded, these attacks now take 5-10 minutes. From here they lay low, for months.. Then the shit really hit the fan when they take the domain controller infrastructure through a GOLDEN TICKET using KERBEROASTING attacks. Then Kansas is going bye bye. You better pray your competent IT leadership has taken steps to make IDENTIFY, DETECT, PROTECT, RESPOND, RECOVER dimensions (NIST framework) a reality across the technologies your company relies on. MITRE defines a generic framework for hacking attacks: - INITIAL ACCESS - EXECUTION - PERSISTENCE - PRIVILEGE ESCALATION - DEFENSE EVATION - CREDENTIAL ACCESS - DISCOVERY - LATERAL MOVEMENT - COLLECTION - COMMAND AND CONTROL - EXFILTRATION - IMPACT From here I recommend you read the MITRE ATTACK framework, great reading! https://attack.mitre.org/ https://attack.mitre.org/ https://www.youtube.com/watch?v=bkfwMADar0M https://www.youtube.com/watch?v=bkfwMADar0M https://www.youtube.com/watch?v=b6GUXerE9Ac https://www.youtube.com/watch?v=b6GUXerE9Ac https://www.youtube.com/watch?v=_SsUeWYoO1Y https://www.youtube.com/watch?v=_SsUeWYoO1Y Real talk!
  - mikorym 6y ago
    Is it still done via actual downloads? It's very easy for script kiddies to do that. I would have expected a bit more sophistication, like hidden URLs in emails that autoresolve, at the least. Not my area, though.
    - unixhero 6y ago
      It is done in every possible way. The dumbest form your defenses will allow in is what you get. Can absolutely be done via downloads yes. Because they perform an impersonation attack on you, or use a supplier as an attack vector, and by impersonating a trusted user, they get you to open a file or similar. Better finetune your email security, because humans are a hard problem. Loads of awareness, phishing drills and information sec training is needed.

stu2b50 6y ago

Ransomware attacks will often wait after getting into systems, so that they can also encrypt live backups. Air gapped backups from sufficiently long ago will work, but not only is restoring to those usually a pain in the ass, but would also come with significant business cost... which may be more than the ransom. That's the goal, anyway.

choward 6y ago

That doesn't protect against them threatening to make all the data public.

sfshaw 6y ago

Paying a random is a better user experience than restoring a backup.