,
10 tweets,
2 min read
Read on Twitter
1/ This "Lessons from Crippling Ransomware Attack" gives no lessons. It's like:
me: My friend just died in the hospital.
them: He should've dieted and exercised more.
me: He was hit by a bus.
me: My friend just died in the hospital.
them: He should've dieted and exercised more.
me: He was hit by a bus.
2/ The lesson to learn from "crippling ransomware" is "fix your Windows permissions". That's it. That's ONLY it. There is no other lesson.
3/ Ransomware attacks are common, usually as part of a phishing attack. It's a regular task of IT departments everywhere to wipe an infected user's machine and reinstall Windows. That's non-crippling ransomware.
4/ "Crippling" ransomware is when it gets network/admin privileges and spreads to every desktop and server in the organization. That's what happened with notPetya when it took down Maersk and they had to fly in a backup server from Africa that was turned off when the worm hit.
5/ In my experience, municipal governments are particularly bad with Windows permission. For example, users almost always have admin rights on their own computers so they can install whatever software they want.
6/ Likewise, admin users tend to have have full admin rights to do whatever they want, rather than rights restricted to only what's necessary to do their jobs. Sometimes admins don't have separate accounts for admin duties, and it's their user accounts that have the rights.
7/ And, horrors upon horrors, admins browse the Internet and read email from their admin accounts.
8/ So it's not the things mentioned in that article that lead to crippling ransomware. It's not IoT. It's not a patchwork of legacy systems. It's not lack of cyber hygiene.
It's Windows network/admin rights.
It's Windows network/admin rights.
8+1/ I wanted to end it there, but there's this comment. Also this: network segmentation. It could mean firewalls, but it also mean how you configure your Active Directory forest.
8+2/ In the city of Atlanta attack, the airport wasn't affected, though it's on the same network, because their active directory was separate and was not configured to trust the rest of the city. The rest of the city where AD domains trusted each other was crippled.
