I read an article about ransomware affecting the public transportation service in Kansas, and I wanted to ask how this can happen. Wikipedia says these are “are typically carried out using a Trojan, entering a system through, for example, a malicious attachment, embedded link in a phishing email, or a vulnerability in a network service,” but how? Wouldn’t someone still have to deliberately click a malicious link to install it? Wouldn’t anyone working for such an agency be educated enough about these threats not to do so?
I wanted to ask in that community, but I was afraid this is such a basic question that I felt foolish posting it there. Does anyone know the exact process by which this typically can happen? I’ve seen how scammers can do this to individuals with low tech literacy by watching Kitboga, but what about these big agencies?
A classic is to just drop of 2 or 3 infected USB sticks, maybe with bait labels, on the parking lot before the first employees arrive. repeat a few times and just wait until someone plugs it in to investigate.
another good trick is to infiltrate the cleaners.
the cleaners
What do you mean by “the cleaners”?
Facility management nowadays is outsourced to third party agencies. Usually the pay and working times are shit and they are consistently understaffed. At the same time they usually get access to most regular offices and they work before or after the offices fill.
For a more concerted effort finding out which companies clean at which offices and enrolling there is not much of a thing. And voila you get access to all physical computers, can plant key loggers or other tools, or just malicious USB Sticks or similiar on the site.
Not in the context of IT security, but for instance in Berlin Germany a group of robbers that stole the 100 kg gold maple leaf coin, hired someone a few month earlier with the security guard agency of the museum it was presented at.
Oh, I see! So they could literally pay a member of the cleaning staff to install such a thing. I hadn’t even considered this!
Or just get the job yourself.
Most cleaning crews aren’t as rigorously checked as r&d even though they have more physical access than r&d
Janitors and custodians get way more unrestricted access than most people realize.
I used to deliver pizzas on a military base, and the amount of restricted areas I got in with no more than a pizza and a uniform shirt is ridiculous.
Social hacking is the way to do it
I did a hardware upgrade for a hospital a few years ago. People let me in all kinds of sensitive areas just because I had a PC in my hands and knew someone in their department’s name. The only time anyone bothered to verify I was supposed to be there was when I was doing an install in the maintenance guys’ office.
That must be nice. My company does a lot of work for one of the world’s largest chip manufacturers and getting access to some of their facilities is like pulling teeth. Somebody forgot to submit the right paperwork, it didn’t go to the correct department or project manager, this facility is always locked down on the third Tuesday of every month, for reasons, you name it I’ve encountered it.
I wish our military bases were that secure
This is always a fun experiment when you are doing contracted IT work. In my experience in large organizations with multiple facilities where everyone does not know everyone, looking the part and having confidence when you ask someone to let you in the server room is all it takes to get in. They aren’t surprised you don’t know where it is. Helps to have a Catalyst switch in one hand.
For physical security though, badged entry to the building especially with a foyer where guests wait on a routine basis, and a strong anti-tailgating culture where everyone must badge in, will go a long way to getting normal people to pay attention. Not as easy in publicly accessible places like a hospital or some of the places I was working.
That’s how we were at my last job.
The tailgating thing was only allowed if you could see their badge, and with the exception of being on a clean suit, your badge was to be visible at all times, and we were trained and told to check for badges as we were walking around the facility.
Forgetting your badge was a bitch though, there was literally only one door that could be opened from the outside without a badge and that was the front desk.
The people who do the cleaning
What do you mean by “the cleaners”?
The people who push the brooms and empty the trash bins.
Probably the literal cleaners who come in to clean the building before/after hours.
Oh, okay. I forget that large businesses and agencies like schools can have their own cleaning staff with access to technology.
I once heard this story about a company, that had a server room. The room was locked so no-one could get in without permission, which is a good practice. At some point, they started to wonder why one of their servers becomes unreachable every Friday at X o’clock. Eventually, they figured out that their new cleaner entered the server room every Friday and unplugged one of the power cables to plug the vacuum cleaner in to the outlet.
How the fuck
Attackers have to be right once. Defenders have to be right every time.
Also, user.
“i wonder whats on this flashdrive”
When I was in secondary school, I basically did exactly that with a random flash drive I found in the park. I’m blaming my school for never giving us that network security talk lol. Fortunately nothing came of it and it was a pretty boring flash drive but still. Would never ever do that now.
Wouldn’t anyone working for such an agency be educated enough about these threats not to do so?
Ahahhahhahha. Ahem. Hahahahahaha. Give me a moment to compose myself.
Thank you for that moment.
Anyway, the assumption is very reasonable. And, oh how I wish it were so.
But the answer is no, they’re human, and even high tech organizations need specialists in other subjects (law, finance, book-keeping, etc) who aren’t at all technology savy.
To be clear, education is such subjects is often mandatory. It just doesn’t always take. Largely because many staff watch the educational video, and think they understood it, but don’t really have any context for it. For example, they might learn it and still think, “Well, it clealy doesn’t apply to an email from our CEO. He wouldn’t send something nasty!”
Edit: The solution I’ve seen is a lot of education. It’s not enough to say “don’t click suspicious links”, there’s got to be ongoing training on the definition of “suspicious”.
The security team at the company I work for sends out test phishing emails and if you fall for it they make you change your password. I think this annoyance helps people learn to pay attention. It doesn’t seem like we have had to do as many resets due to these as time goes on.
This works IMO. Our company used to do this. Hell, I even fell for one once, which is some shameful shit considering I work in the tech industry. That shame enough though has kept me more on toes ever since.
I almost fell for the last one they did. It was disguised as a link to a shared item on teams that that asked for your creds and I assumed it was another shitty half baked Microsoft thing that single sign in wasn’t working on. The only reason I didn’t log into it was because I was like “fuck it I’ll just open it from teams instead” only to find that it wasn’t in Teams.
I’ve flagged several suspicious looking but actually legit emails that were originated by internal groups but used very scammy sounding language (warning of dire consequences, extreme urgency, links to external websites as reference to something claimed to be internal process…)
Hopefully those departments sending emails like that get some education too…
Stay suspicious. As a security guy, i’d way rather respond to 1,000 false positive reports than have an employee that doesn’t think about it and just clicks.
Yes, this makes sense. I can also say from observing co-workers at different jobs, any training that’s provided virtually (e.g., you just watch a video and answer some questions), is mostly a waste of time. I can say that I and some others took these trainings seriously, but most people did not and would jump through the hoop as mindlessly as possible.
I saw this a lot when I worked as a CNA. People would just answer the questions right, “pass” the training, and then continue doing things in the same wrong way they’d always done things.
Edit: After reading some of the responses, it’s made me realize why IT often wants to heavily restrict what you can do on a work PC, which is frustrating from an end user perspective, but if people are just clicking links in emails and not following basic internet safety, then damn.
I… I… 🥲 thank you.
People are by far the biggest security risk. I have seen personally tailored phising scams that were even able to fool experienced secops staff.
Company I used to work for got hit fairly bad. Am email came in from the contract agency to the accounts payable clerk, personally addressed to her and signed off all informal like, to the effect of “hey Marion, our local bank branch is closing so we’ve had to move our accounts, can you update the IBAN to the following for me?”
€150,000 down a black hole, that wasn’t even noticed until a phone call came in a week later.
My favorite personal anecdote was when one of our security educators send an email explaining how he managed to click a phishing link, log in and then realize it was a fake website login.
Apparently he got an email telling him that the local scanner in the office had send him some material and he needed to authorize the transfer into his inbox by logging in.
Because some fucker working there clicked on some email he shouldn’t have.
Can totally tell you, that most people do not care. They do get training and notifications but they don’t try to learn. The only people that actually care about it are some techies and the CFO.
With that it also lacks sensibilization, as to why it is such an integral issue.
At my workplace we had it become part of a mandatory once a year presentation on all sorts of security issues. So you get a 3 hour presentation, about how to use a ladder, when not to use electrical appliances, what to do in case of fire, how to behave if the police shows up… and in there is also something about IT security.
The thing is, that it is also important to know what to do if there is a fire, or how not to fall from your turning chair and breaking your neck, because the way to the ladder was too far.
So what we do need, is regular testing and interaction with these issues to build routine. But more importantly we need a work environment, where people have the space and time to think before doing something, if this has any security risks worth paying attention to.
Through the holy trinity of gaping holes: Windows, Office, and Exchange. And add lazy or stupid sysadmins on top who don’t care to update their stuff, they make break-ins even easier.
Lots of sysadmins are also overworked and burnt out by stupid requests too.
It’s a different kind of scam from the ones you see on kitboga. Those are generally confidence scams meant to leverage tech illiteracy. Ransomware attacks are more like stepping on a landmine. They are these nasty payloads that are just out there on the internet, usually with some kind of passive social engineering like a website that mimics a familiar site and/or phishing emails to get that payload into the network.
So just clicking the link unleashes the beast, so to speak? It would install itself without any further action from the user?
Generally you have to download and run an executable file. So they will try to make it look like the installer for some software you might need.
Also, infected office documents - spreadsheets being the most common. Get the user to download it, open it, and enable macros and you’re in. Microsoft has kinda done what they can to prevent end user idiocy, but you can’t stop a determined moron.
I mean they could end VBA support and disable makros alltogether. Problem is that many companies have a bunch of excel sheets, with poorly crafted VBA code from 20 years ago, that runs crucial company functions. So they probably have to announce it ten years before and make very big, very loud, very strong marketing, so all the execs in the world realise that yes they need to migrate to dedicated software instead.
Hey mom, look! I’m in this post!
one of the primary tenets of IT is that end users do not read. they click things like crazy, even shit they shouldnt.
the bigger the company the worse this is because volume.
its almost always an attachment bomb, or a link to malicious packages on teh web.
I’m in somewhat of a leadership position in an agency. I feel like I should talk to those above me about having more training for my co-workers. This is a nightmare scenario.
If you want more information on what your company can do to help protect against ransomware, CISA’s stop ransomware site has good advice:
You should have max the plain text to cisa but the actual URL to a failed phishing website. Lol
the way we deal with this in my org is testing our own staff… we use a service that sends very well faked emails. They can look like they are from our own vendors/staff even… but they contain invalid links that an end user should know are not valid… these emails are technically ‘compromised’. when an end user clicks a link, they are informed they failed, and automatically enrolled in one of our mandatory security training classes. every time they click a bad link.
the best part is we silently rolled this out and something like 80% of c-levels failed. they were soooo pissed… but what could they do?
I’ve worked for places that do this, and I’ve seen the same people having to do the same training every time these emails went out. I feel like they never learned from it. They’d even get pissed that they had to keep retaking the training, but I feel like it never occurred to them that they should maybe change their own behavior.
I suspect the appropriate response is to revoke their email….
I mean, you know. If you could trust them to not go create a “mynamemycompany@evenworsethangmaildotcom”
The problem is a big portion of their work relied on email
Sounds like they’re not qualified :)
(I’ll just leave that to somebody else,)
we do have an HR component attached to this. if youre consistently under-performing you will eventually be fired. hipaa and all that.
keeping every user to minimum required access also helps a bit.
You have an office hippo that fires people?!?
That’s metal
It always amazed me that she could just keep doing it and then go to the training, yeah. I feel like that was a glaring flaw in our system.
No hr component, no reason for her to take it seriously except for the annoyance of the training. Give her a little scare and maybe she doesn’t have to be terminated, or she’s just an idiot.
Unfortunately a lot of companies treat IT as an annoying afterthought, so it isn’t uncommon for there to be no real enforcement mechanism.
I don’t work there anymore, but there were a lot of other problems with that place, so it doesn’t exactly surprise me that there was no teeth in their policy
Wish you could get our IT to make ours good fakes instead of coming from “whatever@cityname.securitytrainingcompany.blog.com” or some shit. It feels like they’re not even trying. Although I do work with one of the single dumbest people I’ve ever met, so maybe that’s to give her the teeeeniest chance at identifying it.
good fakes instead of coming from “whatever@cityname.securitytrainingcompany.blog.com” or some shit. It feels like they’re not even trying.
Then again, targeting the first wave of training to the low hanging fruit who fall for such obvious scams is a good place to start.
Sometimes because we’ve conditioned them to.
Confirm dialogs are a perfect example of UI intertia.
You hit confirm on a close dialog so many times that it doesn’t matter what it says. By the time you’ve registered what it is muscle memory has done it’s thing
It doesn’t matter how strong your defenses are and how skilled your IT team is, when fucking Linda in accounting opens EVERY SINGLE GODDAMN ATTACHMENT SHE GETS!!!
She’s had poor training I guess. SEBKAC! Security exists between keyboard and chair
Linda has a standing desk. Checkmate, hackers!
SEBSAC (security exists between shoes and computer, or socks and computer, or soles and computer, or sprostherics and computer, or smagic carpet and computer)
Jokes on you she doesn’t have legs or arms for that matter.
Anybody and anyhead can ride a magic carpet, they don’t discriminate.
Security exists between keyboard and chair
In theory
Theory doesn’t match reality.
PEBKAC is reality.
Some people aren’t trainable.
Then the IT department sends everyone a Honeypot email and schedules more training and a meeting with a manager for anyone who clicks any links in the email.
It is a great step but it’s rare to have enough buy in from upper managent to enforce any real consequences for repeat offenders. I’ve seen good initial results from this kind of phishing testing, but the repeat offenders never seem to change their habits and your click rate quickly plateaus.
The MGM attack originated with calling their help desk pretending to be somebody inside. They found enough info on LinkedIn to be convincing enough to get credentials https://www.vox.com/technology/2023/9/15/23875113/mgm-hack-casino-vishing-cybersecurity-ransomware
People.
This society would be so great if it weren’t for all these damn people smh
FOR REAL
I once did a Phishing test for a customer during an internship. We had 50% of all employees click the Phishing link, and 30% of all employees input their login info.
What was the form? A new data protection agreement (which was the current one copied from the firm’s site) which required a login to accept.
These employees all got regular cybersecurity training, and yet they still fell for such an obvious fake login
When these tests are conducted are they typically sent from an email with a non-company domain? I ask because a few months ago my partner received a test which she failed because it was sent from an email under her company’s normal domain name. I’m not in IT but I am in software dev and I thought this was pretty unreasonable, since in that scenario (AFAIK) either the company fucked up their email security or the attacker has control over the Exchange server in which case all bets are off anyway.
Usually a domain gets rented for the test, using the in-house domain isn’t normal. But you can change the display name of an email adress to appear as if it was sent from a reputable source
Do you mean something like “Legitimate Company hacker@malware.net”? In this case the company domain was in the actual sender address and not just the display name. Anyhow, ty for the insight!
All it takes is one email account to be compromised via spearphishing, and the attacker can send domain wide emails to everyone, with proper DKIM, SPF and all.
They just clicked it from within the email? Damn.
Do you have any insight into how to make people more informed? I feel like everyone sees the average training as just a hoop to jump through.
Regular Phishing tests is the only way I know how. GoPhish is an open source tool to automate them, and I have had great experiences with it.
Thank you so much! I’ll ask our IT person if we can do something like this.
One of my co-workers has been scammed so many times in her personal life that I feel anxious thinking of her clicking a malicious link in her email at work.
Yep, same here, including colleagues in security. “You haven’t claimed your giftcard yet, log in here…”. Some were ‘smart’ enough to forward the link home and open it there (no direct internet access from the desktop) and the organizers of the test canceled the test as it was such a great success. (Almost everybody failed) Alas they killed the test before the email arrived in my mailbox, as I would have loved to see it. ;)
In my case the employer got so angry that he personally delivered invitations to a “Cybersecurity in the workplace”-course
We already have an annual test and still… people will be people. This is the main reason the webbrowsers are sandboxed and everything that is downloaded is scanned. (An no direct acces to internet, never, ever)
Smart people do dumb things. Some are also highly skilled in some areas but terrible in others. My uncle was a heart surgeon, but he was terrible at driving
