Hacker News Reader

Comment by cmckn | Hacker News Reader

I’m ignorant as to how these attacks are so successful. Seems like they always start with a phishing email, but how does some malware on one employee’s computer end up encrypting the “source of truth” for the entire company? Sure, some employees have a lot of access, so obtaining the right person’s credentials will get you a lot of the way there; but it seems like categorically preventing this type of attack should be possible with the right internal security approach. Even just the amount of time it takes to encrypt the data confuses me about this. Do the attackers just choose to launch this on a long weekend?

View on HN

This wasn't a typical "someone clicked a link they shouldn't have" attack.

There was a vulnerability in the RMM server software that allowed remote code execution. The attackers used the RCE to push the ransomware out to all of the endpoints connected to the RMM server.

The attack is still being researched but it looks like there were two vulnerabilities. The first was an authentication bypass that allowed the attacker to authenticate as if it were an authorised client. That was used to upload the payload. There was as a RCE vulnerability that allowed the attacker to executed the uploaded file. The payload itself modified the SQL database of the RMM software to create a task on the remote endpoints that executed the ransomware.

A lot of the time it's nothing more complex than owning one Windows box, and then moving around the network using regular SMB and metsploit tactics.

Could a solution be to remove Windows from the box?

People with 100% of any OS are likely to be more vulnerable than people with heterogeneous systems.

if your business doesn't rely on software that only works on windows, sure. But even companies like apple use windows: https://www.businessinsider.com/apple-uses-windows-xp-in-iph...

That'll cost the typical business way more than the cost and headache of ransomware.

> categorically preventing this type of attack should be possible with the right internal security approach

Yeah. But many many small/medium businesses have been left behind in understanding how software works and how to be secure. A lot of that is because big businesses offload the cost of it onto others instead of leading the way like they should.

Where before you'd have humans interacting which would prevent massive promulgation of bad actors... now a lot of that is automated. So all it takes is one weak link in the chain.

Why don’t small/medium businesses go all in on the cloud? Surely it must be easier for the non-technical SMB order/manager to use Google Drive than run their own file servers?

Because that same phishing email will expose those services too. It is not a location issue.

Sure the phishing email could cause a data breach. But this is about ransomware.

Kaseya seems to have prioritized support convience over safety. I.e. have a backdoor for all their customers. Who could have figured this could happen?

Reply on news.ycombinator.com