What is the state of ransomware at the moment? Do you think it's gone down, stayed up, stayed
the same in the age of COVID-19 and people being in decentralized locations and working
from home and things like that? Does that make people more or less susceptible, do you
think?
I know, unfortunately it's gone up to an extreme level and probably the highest jump we've
seen in the last three years has happened in the last three months. That stems from
various things. One is the perimeter is now gone. Whereas, it was nearly gone before,
but the people who were outside of the perimeter tend to be more technical savvy, sales guys
who use laptops and used to dealing with technology and the threats.
Now we've taken call centers outside of the perimeter. We've taken people who are paid
lower salaries outside of the perimeter. They've lost all of their perimeter security and we've
seen massive amounts of increase in things coming through, but more importantly, things
being executed.
The other huge contributing factor is nobody knows what the norm is anymore. Nobody knows,
is it normal to get an e-mail from my CEO asking me to open something? Because normally,
the CEO or the call center manager was sitting across away from us. Now when people are at
home, they're not necessarily the most tech savvy people. They get these e-mails, asks
if you want to enable this macro, do you want to click this file to download this file?
“Oh, you need to update Adobe to get access to this site. I’m clicking update Adobe
and it's not actually Adobe.”
We're seeing more and more people get tricked into doing things that they wouldn't traditionally
do. In addition to that, we're also seeing more and more of those good applications used.
The latest example of course is virtual box, where people are sending out portable virtual
boxes, which aren't malware, so to speak. When a user opens those boxes, virtual boxes,
which is the application is signed by Oracle, it's a legitimate application, it opens and
it spins up a malicious virtual machine inside your environment. We're seeing a whole load
of new attack vectors that are coming in in terms of people using those legitimate applications.
Then being able to bypass things, because we're on a Zoom conversation now, if I send
you a link over Zoom, we've just bypassed all our corporate security.
Right. Yeah, now tell me a little more about that virtual box. I don't really know. What
people within the company would be getting something like that that they'd have to open
up and then make themselves potentially vulnerable?
It's not specifically targeted at individuals and that obviously people who aren't used
to – who are less technical savvy are more vulnerable. The way we've seen it come in
is a few different ways. We've seen the traditional click on this link, you need to update your
browser. Somebody clicks on the link, it downloads a file. They open it and it runs an exe. It
spins up a virtual box in the background.
The most common one is what that will do is it'll actually map your file, personal files,
your folders to the virtual box. Then when it opens, it's able to encrypt those files
from inside the virtual box. Of course, your antivirus doesn't see what's inside the virtual
box, so that makes it more difficult for it to detect what’s happening.
Basically kidnapped it to a third location or something.
Yeah. That's one way. Word documents are pretty common as well, people clicking on macros
and saying, I want to, or they're calling out powershells that – The user doesn't
know anything. They've opened a word document. They said you need to click, enable macros.
For me obviously, it's pretty easy for me to why would you enable macros?
There are so many security alerts. There are so many messages that pop up on your computer
saying, “Are you sure? Are you sure? Are you sure?” Nobody really knows what they
all mean, so they just keep clicking, unless you're a technical professional, yes, yes,
yes, because I need to get this document open. The user opens that document, they enable
the macro and then it will go off in the background. It'll download it silently. The obvious ones
are when they do launch the virtual box with immediate malware.
The other one which we’ll see more common inside the network, which is a little bit
more terrifying is where it doesn't go and encrypt your files. What it does is it will
spin up that virtual box and it doesn't – it's not limited to virtual box. That's the biggest
target at the moment, but any virtual machine. They now have a machine running inside your
perimeter. They now have TeamViewer installed on that machine, go to assistance on that
machine and they can connect to that machine, they can scan your network. They’re basically
plugged into your lap. It's this month's flavor of attack. I mean, next month it'll be something
different. This month, it's virtual box and virtual machine.
New episodes of Cyber Work are available every Monday at 1pm central, and don't forget to
claim your free month of Infosec Skills. Sign up using the code 'cyberwork' and you'll get
unlimited access to hundreds of courses, hands-on labs, certification practice exams, skills
assessments and more. Use code 'cyberwork' for Infosec Skills.