3 ms·

I'm surprised more people dont use AppLocker, then you wouldnt be able to run random binaries. https://docs.microsoft.com/en-us/windows/security/threat-protect

I'm surprised more people dont use AppLocker, then you wouldnt be able to run random binaries. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...

AnIdiotOnTheNet 5y ago
We tried this at work when the first big ransomware wave hit. Despite our best efforts it just didn't work out. A shocking number of utilities used by various departments did all sorts of strange things like dropping executables in %TEMP% when running some internal process. Not to mention all the different versions of things like GoToMeeting and its ilk. It was a management nightmare to try and keep up and we ultimately determined it wasn't worth the hassle.
- Terry_Roll 5y ago
  Why not "Unity" them in VMware, or sandbox them? Choosing the right software is critical though, just because something is popular doesn't make it the right one to use. WannaCry showed the world how joined up these attacks are, considering it exploited a bug in that old networking protocol. I found it interesting how they hit the crownjewels of many countries, psychologically I think it was a big message sent, asserting their dominance over others.
  - AnIdiotOnTheNet 5y ago
    Then the VM gets compromised instead of their workstation, no real difference. Even if you just mean sandboxing or using a VM for a single application, that interferes with all the integration of those applications. Again, more trouble than it is worth and too confusing for the users. They have a job to do, and it is our job to make sure they can do it with a minimum of fuss. We have implemented a lot of other ransomware mitigations to protect data on servers, which is where the users should be keeping anything important anyway, but if a workstation gets hit we just burn it to the ground and start over with it from a standardized corporate image. We've also implemented mechanisms for early detection with automated triggers to cut any affected users and workstations off until an admin can look at it. And we've altered our backup strategy to make damaging one set of backups from anywhere but a locally connected console as impossible as we can.
    - Terry_Roll 5y ago
      The VM may get compromised, it depends on how you set it up, not all apps need to phone home for a start and dont need anything more than limited network access but thats firewall/IPS/IDS domain. You hint your may be corporate unlike a home user who has less tools and disposable income at their disposal and VMware unity is a quick cheap fix as its free for home use. Its ok to burn an image to the ground, do you check your firmware like your bios with something like Copernicus? https://www.mitre.org/publications/technical-papers/copernicus-2-senter-the-dragon https://www.mitre.org/publications/technical-papers/copernic... or HDD firmware hacking ? https://spritesmods.com/?art=hddhack&page=1 https://spritesmods.com/?art=hddhack&page=1 Your persistence is right there, doesnt matter how often you reinstall an OS then if you have a system running like a sim card working with a smartphone OS but also independently communicating with the hw like a bluetooth/wifi mesh network but you also have network printers/scanners and other HW that connects to a network to check out to check out the firmware for. I loved having to flash the old EEPROM's, physically taking the chip out, removing the sticker over the quartz window, exposing it to UV light, before sticking the label back over the window and then flashing it on a EEPROM flash machine, that physical process made it harder to hack unlike today. So how quickly can you get your backup loaded on blank servers, workstations and switches? Exchange server can take its time if people have GB+ mailboxes. This is an interesting post mortem of how Maersk handled NotPetya. https://gvnshtn.com/maersk-me-notpetya/#notpetya https://gvnshtn.com/maersk-me-notpetya/#notpetya Theres a lot that can be learnt from it.

AnIdiotOnTheNet 5y ago

We tried this at work when the first big ransomware wave hit. Despite our best efforts it just didn't work out. A shocking number of utilities used by various departments did all sorts of strange things like dropping executables in %TEMP% when running some internal process. Not to mention all the different versions of things like GoToMeeting and its ilk. It was a management nightmare to try and keep up and we ultimately determined it wasn't worth the hassle.

Terry_Roll 5y ago
Why not "Unity" them in VMware, or sandbox them? Choosing the right software is critical though, just because something is popular doesn't make it the right one to use. WannaCry showed the world how joined up these attacks are, considering it exploited a bug in that old networking protocol. I found it interesting how they hit the crownjewels of many countries, psychologically I think it was a big message sent, asserting their dominance over others.
- AnIdiotOnTheNet 5y ago
  Then the VM gets compromised instead of their workstation, no real difference. Even if you just mean sandboxing or using a VM for a single application, that interferes with all the integration of those applications. Again, more trouble than it is worth and too confusing for the users. They have a job to do, and it is our job to make sure they can do it with a minimum of fuss. We have implemented a lot of other ransomware mitigations to protect data on servers, which is where the users should be keeping anything important anyway, but if a workstation gets hit we just burn it to the ground and start over with it from a standardized corporate image. We've also implemented mechanisms for early detection with automated triggers to cut any affected users and workstations off until an admin can look at it. And we've altered our backup strategy to make damaging one set of backups from anywhere but a locally connected console as impossible as we can.
  - Terry_Roll 5y ago
    The VM may get compromised, it depends on how you set it up, not all apps need to phone home for a start and dont need anything more than limited network access but thats firewall/IPS/IDS domain. You hint your may be corporate unlike a home user who has less tools and disposable income at their disposal and VMware unity is a quick cheap fix as its free for home use. Its ok to burn an image to the ground, do you check your firmware like your bios with something like Copernicus? https://www.mitre.org/publications/technical-papers/copernicus-2-senter-the-dragon https://www.mitre.org/publications/technical-papers/copernic... or HDD firmware hacking ? https://spritesmods.com/?art=hddhack&page=1 https://spritesmods.com/?art=hddhack&page=1 Your persistence is right there, doesnt matter how often you reinstall an OS then if you have a system running like a sim card working with a smartphone OS but also independently communicating with the hw like a bluetooth/wifi mesh network but you also have network printers/scanners and other HW that connects to a network to check out to check out the firmware for. I loved having to flash the old EEPROM's, physically taking the chip out, removing the sticker over the quartz window, exposing it to UV light, before sticking the label back over the window and then flashing it on a EEPROM flash machine, that physical process made it harder to hack unlike today. So how quickly can you get your backup loaded on blank servers, workstations and switches? Exchange server can take its time if people have GB+ mailboxes. This is an interesting post mortem of how Maersk handled NotPetya. https://gvnshtn.com/maersk-me-notpetya/#notpetya https://gvnshtn.com/maersk-me-notpetya/#notpetya Theres a lot that can be learnt from it.