3 ms·
I’m ignorant as to how these attacks are so successful. Seems like they always start with a phishing email, but how does some malware on one employee’s computer
by cmckn 5y ago
I’m ignorant as to how these attacks are so successful. Seems like they always start with a phishing email, but how does some malware on one employee’s computer end up encrypting the “source of truth” for the entire company? Sure, some employees have a lot of access, so obtaining the right person’s credentials will get you a lot of the way there; but it seems like categorically preventing this type of attack should be possible with the right internal security approach. Even just the amount of time it takes to encrypt the data confuses me about this. Do the attackers just choose to launch this on a long weekend?
- deleted 5y ago[deleted]
- inetknght 5y ago> categorically preventing this type of attack should be possible with the right internal security approach Yeah. But many many small/medium businesses have been left behind in understanding how software works and how to be secure. A lot of that is because big businesses offload the cost of it onto others instead of leading the way like they should. Where before you'd have humans interacting which would prevent massive promulgation of bad actors... now a lot of that is automated. So all it takes is one weak link in the chain.
- jdavis703 5y agoWhy don’t small/medium businesses go all in on the cloud? Surely it must be easier for the non-technical SMB order/manager to use Google Drive than run their own file servers?
- everdrive 5y agoA lot of the time it's nothing more complex than owning one Windows box, and then moving around the network using regular SMB and metsploit tactics.
- miohtama 5y agoCould a solution be to remove Windows from the box?
- coldcode 5y agoPeople with 100% of any OS are likely to be more vulnerable than people with heterogeneous systems.
- vb6sp6 5y agoif your business doesn't rely on software that only works on windows, sure. But even companies like apple use windows: https://www.businessinsider.com/apple-uses-windows-xp-in-iphone-testing-facility-2014-9 https://www.businessinsider.com/apple-uses-windows-xp-in-iph...
- vkou 5y agoThat'll cost the typical business way more than the cost and headache of ransomware.
- rightbyte 5y agoKaseya seems to have prioritized support convience over safety. I.e. have a backdoor for all their customers. Who could have figured this could happen?
- deleted 5y ago[deleted]
- tonyb 5y agoThis wasn't a typical "someone clicked a link they shouldn't have" attack. There was a vulnerability in the RMM server software that allowed remote code execution. The attackers used the RCE to push the ransomware out to all of the endpoints connected to the RMM server. The attack is still being researched but it looks like there were two vulnerabilities. The first was an authentication bypass that allowed the attacker to authenticate as if it were an authorised client. That was used to upload the payload. There was as a RCE vulnerability that allowed the attacker to executed the uploaded file. The payload itself modified the SQL database of the RMM software to create a task on the remote endpoints that executed the ransomware.