Ransomware Forces Two Chemical Companies to Order ‘Hundreds of New Computers’

I don't think this is an honest question. You've pushing your agenda.

Linux has a big ransomware problem and with inexperienced users running it, it can be easy to attack.

See: https://www.scmagazine.com/home/security-news/new-b0r0nt0k-r...

and

https://www.bleepingcomputer.com/news/security/b0r0nt0k-rans...

And Mac is certainly not immune:

https://www.cultofmac.com/416299/stealthy-malware-will-hold-...

Imagine you're making a game that targets desktop and you can only target one platform. Do you launch on Windows, Mac, Linux, or something else? If you put personal ideology aside, it'd be Windows every time because that's where the users are. Exact same thing for malware devs.

Malware targets Windows because that's where the users are. If the majority of people swapped to e.g. Mac or whatever else, then you'd see the majority of malware start to target Mac. You even see this as smaller players increase marketshare. E.g. in 2015 Macs ran into more malware than in the 5 previous years combined. [1] There was no major discovery or anything happening. The only thing that happened was that Macs gained a decent clip of marketshare, and so became more worthwhile to target.

[1] - https://www.documentcloud.org/documents/2459197-bit9-carbon-...

I can't speak to this authoritatively, but Macs are typically more expensive than Windows machines. They might have run the numbers, and decided that

    (cost of malware) * (risk of malware) < (cost of macbooks)

But really, I'd wager that Windows is just the standard solution, and more people probably use Windows than Mac.

There are many reasons why companies decide to buy/stay with a certain operating system, I will list a few:

* Industry norm - In some cases, certain operating systems become a norm. Requesting someone to implement X solutions to a different operating system can cost more, have unexpected risks, etc.

* Adaptability - It is easier to hire someone to do a job in X operating system/tool if that person has a similar system at home or used it in a previous company.

* False sense of security - Transitioning to based on your rationale can mean that the business and its users will feel overconfident of their security. This can lead to increased careless mistakes.

When the program you use to run certain machines only runs on windows, what choice do you have?

I'd say desktop Linux is more insecure than Windows, and the only reason we don't see malware is that nobody uses it. So if high profile targets, like energy companies, started using Linux on the desktop, it may end up being worse than Windows.

Anecdote: In the 90s California, there was a chemical science research company, perhaps formed in the late 70s. Many scientists there had PhDs or quality Master in Chemistry, and they set out to write software to support the drug discovery, pesticide and industrial chemicals industry. The company was well-managed, and it grew. Into the 90s, the Macintosh computer got a lot of attention for graphics, while Windows was stuck at 3.x, and many of the scientists had DEC associations.

So the company had a plural, cross-platform code base in C for some of its core IP. Scientists may not write the best code, but they can write a lot of it, so the core libraries grew and grew.

In the 1997 or so time, Internet grows, VAX declines, Windows improves and pushes hard. The senior management are being tempted by the huge (at the time) money for valuation. Someone decides to take the Microsoft point of view.

There was a "global rollout" effort conceived and implemented, to switch every working piece of code to Windows , backed by fanfare and the sort of content-less cheerleading you find at an ordinary school.. matching t-shirts and good looking people there to "help" you with the transition (!) to port the code ! There was tons of it, there were build chains, there was network code. But it was the MONEY at the top, and the relentless pressure from Microsoft and affiliates, directly, at golf courses and at hotels and at the airport and in the money meetings, that greased the wheels to decide for everyone, that Windows was the standard, end of story.

Many working, carefully built products, were retired, and the team management was required to change over or else be retired also. The change happened. Within a few years (before 2000) the entire company was sold to Elsivier for three-digit millions.

postscript - a small few senior scientists did find Java when it was released, and led an effort to port certain things to Java. The web was a cacophony, and Java might have over-represented itself as far as a web-GUI and also backend. No news about the fate of that, but it was a minority effort, amongst a few who had discretionary budgets to allocate for that.

Guessing they're not competent enough to purge their email systems of the original malware attachments nor have procedures sufficient to keep new computers from being re-encrypted.

New email domain means old emails aren't accessible.

Depends on the level of trust you place into the compromised systems and your threat model.

Basically they are going down the "nuke it from orbit" route, lets say they miss a system that reinfects the rest somehow.

As for formatting windows, sadly these days that is no longer enough to be sure with a "well crafted" malware. Lets take the industry favourite laptop tracking platform CompuTrace (now named Lo-Jack iirc).

The BIOS/UEFI Module that is its heart is a small EXE that gets executed by windows on every boot (Just like the Superfish incident, though that did use a diff way to get executed on windows launch, lo-jack gets executed by windows, superfish replaced a file that would get executed).

In Lo-Jack case its a small dropper exe that then fetches the real tracking payload once the laptop connects to the internet but it can be (iirc) tricked into downloading and running any exe it likes with system priv's. A BIOS flash of a fixed BIOS is the only "fix".

But in my past I've had fun injecting stuff into and modifying BIOS's (Mainly just to unlock extra options or remove whitelists for wifi cards) and most BIOS/UEFI's these days can be flashed from within Windows. Sure to save bricking the machine you would need to get the correct BIOS for that machine but if a company puts in a purchase order for 100 office machines they are not going to differ too much.

If you have a payload running on a machine you could call home with its motherboard make, model and revision. Download the bios from the vendor, inject a payload into it, send it back to the machine, have the machine flash it in the background and using the same methods Superfish / Jo-Jack use have malware that persists though a format or even a replacement of the drive.

I'm sure we have already seen malware using these techniques already in the wild. Signed BIOS updates will protect to some degree but their have been a fair few cases of being able to bypass the sig check (which is often only done during the the read of the bios before the flash takes place).

Is it overkill? is it paranoia? Probably. It might just be simply the case that the machines were due to be replaced at some point in the near future anyway so 2 birds, one stone.

EDIT: It might of not been Lenovo's use of superfish that was installed via bios on reinstall of Windows, but their own bloatware. It replaced Microsoft's copy of autochk.exe with its own that installs other pieces of Lenovo software. After the shit hit the fan in that case, Lenovo quickly issued BIOS Updates to remove the "feature". But it goes to show how abusing the Windows Platform Binary Table can be used to inject unwanted software into a system.