4 ms·

There have been ransomware attacks against vulnerable NAS devices, but yes it's mostly Windows. The biggest reason it's mostly Windows is not just worse securi

by api 3y ago

There have been ransomware attacks against vulnerable NAS devices, but yes it's mostly Windows. The biggest reason it's mostly Windows is not just worse security posture due to complexity but also that Windows is so popular in business, causing it to be the most aggressively attacked platform.

wepple 3y ago
I expect that to change over time. I personally expect man-in-the-browser attacks to start targeting SaaS application data. I suspect a secondary reason is that the way windows credentials and file shares are set up, you can really build one-size-fits-all malware that goes after creds and hashes in a fairly generic way.
Grimburger 3y ago
There's a great Linux hardening guide that really made me question the common refrain about linux being more secure. Out of the box on many distros it's not particularly that safe, it's widespread usage in servers rather than desktops means it's more the sensible firewalling and lack of user installed apps that's giving it the appearance of security. Edit: the guide, first link is their rationale - https://madaidans-insecurities.github.io/guides/linux-hardening.html https://madaidans-insecurities.github.io/guides/linux-harden...
delfinom 3y ago
>but also that Windows is so popular in business, causing it to be the most aggressively attacked platform Yep, ransomware does nothing more than encrypting files users have read/write access to. The OS is not the limiting factor here. The access scope of users does. It really comes down to company IT and how they scope access (and lock down accounts with broader access like they are supposed to).
- hooverd 3y ago
  Solution: Don't let the user read or write files without requesting approval from their supervisor.
  - mr_mitm 3y ago
    Also: prevent privilege escalation. That's the big issue every admin of Active Directory struggles with. I work as a pentester and we get domain admin rights within days (sometimes minutes) in about 95% of all engagements.
    - hooverd 3y ago
      All the coal EDR software is burning, and yet...

by api 3y ago

wepple 3y ago

I expect that to change over time. I personally expect man-in-the-browser attacks to start targeting SaaS application data. I suspect a secondary reason is that the way windows credentials and file shares are set up, you can really build one-size-fits-all malware that goes after creds and hashes in a fairly generic way.

Grimburger 3y ago

There's a great Linux hardening guide that really made me question the common refrain about linux being more secure. Out of the box on many distros it's not particularly that safe, it's widespread usage in servers rather than desktops means it's more the sensible firewalling and lack of user installed apps that's giving it the appearance of security. Edit: the guide, first link is their rationale - https://madaidans-insecurities.github.io/guides/linux-hardening.html https://madaidans-insecurities.github.io/guides/linux-harden...

delfinom 3y ago

>but also that Windows is so popular in business, causing it to be the most aggressively attacked platform Yep, ransomware does nothing more than encrypting files users have read/write access to. The OS is not the limiting factor here. The access scope of users does. It really comes down to company IT and how they scope access (and lock down accounts with broader access like they are supposed to).

hooverd 3y ago
Solution: Don't let the user read or write files without requesting approval from their supervisor.
- mr_mitm 3y ago
  Also: prevent privilege escalation. That's the big issue every admin of Active Directory struggles with. I work as a pentester and we get domain admin rights within days (sometimes minutes) in about 95% of all engagements.
  - hooverd 3y ago
    All the coal EDR software is burning, and yet...