Hi, I'm Kevin Mitnick, KnowBe4’s Chief Hacking Officer.
And I want to discuss a new variant of ransomware that we expect on the horizon.
We should all be familiar with ransomware, and what it does.
It's a type of malware, that when your users click on phishing links, or open up phishing
emails, that have attachments.
This type of malware scrambles or encrypts all the files on the user's workstation.
And if the user is in a corporate environment, any network shares where the user has write
access to files, those will also be encrypted.
And then all of a sudden a pop-up will show up on your computer's display, demanding that
you pay a ransom!
Maybe $300, maybe $400.
And you have to pay this ransom, usually via Bitcoin -- and then you're sent a decryption
key, so you can get your files back.
But wait, how can this evolve?
What about the cloud?
A lot of people use cloud-based email services: Gmail, Outlook 365.
So a great friend of mine, Chema Alonso with Telefonica, developed this new attack.
And I want to demonstrate this to you, because this is what you could expect that could happen
to you, if you don't stop, look and think, when you're receiving email.
So let's take a look in one moment, we should be receiving an email, so let's wait for it.
And here we go.
We got an email from AntiSpam PRO, and let's actually open it up.
And I'll zoom in a little bit, and what this email appears to be coming from AntiSpam PRO,
and it looks like it's coming from Microsoft, and it basically says that they're improving
their AntiSpam PRO product.
And they've launched a new service, to basically keep spam out of your Outlook 365 box, in
the email, which you know, nobody likes spam.
And in the email, it asks the user to click the following link, so let's go ahead and
do that.
And I'm gonna stay signed into the same account.
Now what's popping up is a request that this application, this AntiSpam PRO application,
have access to your data -- be able to sign in as you, read your contacts, read your email,
and this sort of thing.
Which seems completely appropriate with an anti-spam product, that has to actually read
all your emails, to kind of check to see if those emails could be spam.
So we'll go ahead and accept.
We click “accept,” no we don't want to stay signed in.
And as soon as one of your users accepted those terms and conditions of the application,
that's where the mistake was made.
What they did is they enabled what we call an “OAuth token,” giving the bad guy (the
threat actor) complete control over your cloud-based email.
So let's go into our email, and see what could what could happen here.
So I go back to into our email right, and if you look at the email it looks perfectly
fine.
But what if the bad guy wants to encrypt your email, essentially bringing ransomware to
the cloud?
So let's pay attention ,I'm gonna go ahead and simulate what a bad guy can do so keep
looking at the display now, look in real-time.
all your emails are suddenly being encrypted or scrambled!
You could read the header, but the body of your email message is completely encrypted.
So let's give it a second and let it finish, we just received a message that your emails
have been encrypted.
Let's take a look at this message.
We take a look at it, and it's the typical type of ransomware message, “Whoops, your
emails have been encrypted!”
Can I recover my email?
Sure.
And the way to recover your emails is to send here, $300 of Bitcoin to this Bitcoin address.
So this is exactly what the bad guys could do, by phishing your users in a cloud-based
environment.
Right, so let's actually take a look at the emails here.
We take a look, you can read the header, but all the contents of your emails and attachments
are completely encrypted, and inaccessible to you.
So let's pretend that we paid the ransom.
So we're going to recover the emails, so pay attention to the screen as everything goes
back to normal.
And here we go once he paid the ransom, you now have complete access to your emails.
So let's be careful out there, let's not let our users get duped by the bad guys.
Where we have to pay any ransoms.
So what you have to do is you have to stop, look and think before you click on any link
in an email, that could potentially give the bad guys access to your data.