Upload File

i hate ransomware. - black hills information security

  • Home
  • Documents
  • I Hate Ransomware. - Black Hills Information Security
34
© Black Hills Information Security | @BHInfoSecurity I Hate Ransomware. And, you should too! John Strand

Upload: others

Post on 13-May-2022

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

I Hate Ransomware.And, you should too!

John Strand

Page 2: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

What We Are Covering

• Recent attacks

• Deception... Again.

• Beacons.... Again.

• Third type of ransomware

• Raccine

• Windows Settings

No point of this.. I just miss Jack Handy on SNL.

Page 3: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Recent Attacks

Page 4: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Cookies....

Page 5: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

So... Deception.

• Let's hash this out

• Deception is no longer a "nice to have"

• Deception is no longer a "neat thing"

• It is core

• It is essential

• Fight me. "Let's Dance!"

Page 6: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Word Docs!!!

• Word docs are great because we can put them on:• Shares• Compromised systems• Websites (Robots.txt)• Email to spammers!

• When an attacker pivots... Give them something

Would you run it from a share?

Would you run it from a chair?

Would you run it for TOR?

If the FBI comes should you open the door?

Page 7: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Yes! CanaryTokens!

Page 8: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Not bad..

Page 9: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

But we can do better...

Page 10: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Enhance

Page 11: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Applicability

• Attacker pops a box

• They try to pivot by finding docs with passwords in them

• They open a honeydoc

• You get an alert

• You shut them down

• You don't end up in the news

• Everyone likes that... "Let's Dance!"

Page 12: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Page 13: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Important!

Page 14: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Page 15: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Kerberoasting

Page 16: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Applicability

• Attacker pops a box

• They try to pivot by password spraying or Kerberoasting

• You detect it immediately

• You shut them down

• Your CEO does not throw you under the bus before congress

• It was a good day."Let's Dance!"

Page 17: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Network Analysis

Page 18: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

https://www.activecountermeasures.com/free-tools/rita/

Page 19: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

And now...A very special note from Chris Brenton.

Hey dude,

One data point you may want to convey tomorrow is that ransomware is skewing the dwell time numbers between initial compromise and detection. The sites that are reporting that we are getting better than 6 months at detection are including ransomware in their calculations. IMHO, that shouldn't count as it's the attacker revealing themselves, not an actual "detection". When you separate ransomware and APT, we're still at a 6-month dwell time for APT.

HTH,

C

Page 20: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Page 21: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Ransomware of the third kind

Page 22: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

A quick note..

The power grid is a special security case. We need segmentation and to keep legacy systems running for years. If we don't do this

correctly... People can die.

Page 23: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Another note..

Medical is a special security case. We need segmentation and to keep legacy

systems running for years. If we don't do this correctly... People can die.

Page 24: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Another note..

Financial is a special security case. We need segmentation and to keep legacy

systems running for years. If we don't do this correctly... People can die.

Page 25: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Another note..

Defense is a special security case. We need segmentation and to keep legacy

systems running for years. If we don't do this correctly... People can die.

Page 26: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

They are all correct..

• This needs to stop

• Belief that a market vertical is "unique" helps create excuses for not doing the "right" thing

• I know I am preaching to the choir

• One powerful question... "When?"

Page 27: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

If we don't get it.. It's OK.

These folks will teach us the error of our ways.

Page 28: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Anndd....

These folks will "fix" the error of our ways....

Page 29: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Let's Think

"Think about how ransomware works Mark! THINK!"

Page 30: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Raccine

Page 31: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

File and Folder Protection

Page 32: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

One more thing...

Page 33: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Thanks!

• Thanks for hanging out• John Strand• @strandjs

Here is a bunny...

Hope it makes up for the Government slide earlier...

Sorry.

Page 34: I Hate Ransomware. - Black Hills Information Security

© Black Hills Information Security | @BHInfoSecurity

Questions?


RANSOMWARE PROTECTION€¦ · RANSOMWARE PROTECTION UIDE . ... Exploitation Exploit Mitigations Application Behavior Payload Execution ... PREVENTION AGAINST RANSOMWARE

Is the ‘hate’ in hate speech the ‘hate’ in hate crime

Say No To Hate ––--Say No To Hate - OC Human Relations Hate — Say No To Hate — Say No To Hate ... an increase in hate crimes and hate ... Catholic, Jehovah’s Witness,

The Hate That Produced Hate - digitalcommons.pepperdine.edu

An Enterprise Guide to Preventing Ransomware Attacksstratxsolutions.com/...black_ebook_ransomware_0912.pdf · AN ENTERPRISE GUIDE TO PREVENTING RANSOMWARE ATTACKS Ransomware isn’t

Thermostat Ransomware

The Hate That Hate Produced

Ransomware ly

Hive Ransomware

Conti Ransomware

Ransomware: Modern Day PiratesRansomware • What is ransomware • History of ransomware • Actors and their motivations • Anatomy of a ransomware attack • Cost of a ransomware

Threat Alert NotPetya Ransomware Attack...The NotPetya Ransomware Attack June 2017 A Deep Dive into the NotPetya Ransomware Attack This is a new variant of the Petya ransomware family

UNMASKING RANSOMWARE

Easy way to uninstall PadCrypt ransomware: Remove PadCrypt ransomware

Ransomware Eradication using Biomorphic Perimeterisation€¦ · recover from NotPetya. Types of Ransomware (Device Target) Ransomware Device Targets Device Targets are Different

Ransomware Tips to Help Avoid Ransomware Attacks · 2019. 5. 8. · installed the ransomware. Tips to Help Avoid Ransomware Attacks 1. Don’t click. Visiting unsafe, suspicious or

Backup ransomware prevention_2017

Vortrag Ransomware CC BY-SA - edvgt.de¶rn... · EDV-Gerichtstag 2016, Jörn Erbguth, [email protected] Funktionsweise Ransomware 1. Ransomware infiziert Rechner 8

Understanding Crypto-Ransomware

Ransomware - asecuritysite.com · Types •Locker Ransomware. Locks the computer. •Crypto Ransomware. Requires decryption key. •Master Boot Record Ransomware. Attack MBR so that

Cybercrime Tactics & Techniques: Q2 2019 Ransomware ......Ransomware shifts to business targets » Consumer ransomware drops -12% YoY & -25% QoQ » Business focused ransomware increase

Webroot - Ransomware Threats

Ransomware Cyber Threat Acronis Infographicdownload.acronis.com/...Ransomware_Threat_Acronis... · RANSOMWARE THE NEW CYBER THREAT AND HOW TO STOP IT RANSOMWARE: hackers hold your

MAPPING THE RANSOMWARE LANDSCAPE - Bitpipedocs.media.bitpipe.com/io_13x/io_137963/item_1550281/Mapping T… · 2 RANSOMWARE GUIDE: MAPPIN THE RANSOMWARE LANSCAPE SCOPE OF THE THREAT

Ransomware: The Known and Unknown€¦ · Can I get ransomware from removable devices? Can I get ransomware from social media? Can a hacker infect me with ransomware through other

Ransomware: your money or your bytes Version 2.0, updated ...€¦ · Center joint Ransomware Guide6 • Microsoft - Human-operated ransomware attacks: A preventable disaster7 •

AtomSilo Ransomware

Ransomware Mitigation Strategies

Responding To Ransomware - NYMISSA · Ransomware is getting more sophisticated, and shifting to an enterprise threat. Ransomware Nightmares ... 50% of ransomware victims have paid

Ransomware- success stories Triangle InfoSeCon · Ransomware Ransomware WannaCry,Petya,CryptoLocker,and TeslaCrypt are some of the more notable examples of such ransomware. In general,

RANSOMWARE - healthyagingcore.ca

A QUICK GUIDE FOR RANSOMWARE DEFENSE · 2019-03-02 · A QUICK GUIDE FOR RANSOMWARE DEFENSE | 2 A BRIEF HISTORY OF RANSOMWARE Before understanding how to defend against ransomware,

Hate Trotskyism, Hate the Spartacist League

Ransomware Threat Report : WannaCry · Ransomware Threat Report : WannaCry IN-DEPTH COVERAGE AND INSIGHTS OF THE WANNACRY RANSOMWARE FROM ARMOR’S SECURITY EXPERTS

Ransomware and tips to prevent ransomware attacks