Slashdot Mirror
Microsoft Warns of ZCryptor Ransomware With Self-Propagation Features (softpedia.com)
An anonymous reader writes from a report issued by Softpedia on May 27: Microsoft and several other security researchers have detected the first ransomware versions that appears to have self-propagation features, being able to spread to other machines on its own by copying itself to shared network drives or portable storage devices automatically. Called ZCryptor, this ransomware seems to enjoy quite the attention from crooks, who are actively distributing today via Flash malvertising and boobytrapped Office files that infect the victim if he enables macro support when opening the file. This just seems to be the latest addition to the ransomware family, one which recently received the ability to launch DDoS attacks while locking the user's computer.
and data. After twenty years of problems with code in documents, including some that would wipe-out your partition table, they still allow code in a document to execute.
Also, this might be the first malware that infected network files, but it certainly isn't the first to affect Office documents. We've been hit several dozen times.
More proof that everyone should be using an adblocker to keep their computer and friends computers safe.
Dear website owners.... WAHH about your lost revenue. start hosting the ad's on your own servers and VET THEM to be safe and not an attack vector.
Do not look at laser with remaining good eye.
Let me tell you what it's like working in infosec in a large organization.
Me: We need to remove some of these global admin accounts, they can access literally everything, change group policy, delete all 500+ of our file servers around the globe.
Manager: No we need meetings to do this and a change request process and team to make sure all the players are onboard. Also we cannot spend any money doing this, cannot schedule any employee hours to do this so you'll be doing it on your own time without getting paid. If anything at all goes even the slightest bit wrong, we'll blame you.
High level manager: I'm not giving up my access to everything
Manager: okay so Anonymous Coward you can remove all of the 'extra' global admin accounts besides the ones on this list
(Some giant disaster happens because some Director of Finance or something downloaded malware and then logged into the domain with his global admin account)
Manager: WHAT THE FUCK ANONYMOUS COWARD, HOW COULD YOU HAVE LET THIS HAPPEN?
Me: we need to implement security policy X (example: no badge access to data rooms unless you're a sysadmin or otherwise need it)
Manager: No we need meetings to do this and a change request process and team to make sure all the players are onboard. Also we cannot spend any money doing this, cannot schedule any employee hours to do this so you'll be doing it on your own time without getting paid. If anything at all goes even the slightest bit wrong, we'll blame you.
High level manager: What do you mean I won't have badge access to the server room? I'm the warehouse manager, my job has nothing to do with IT or servers, but my badge HAS to work on that door because I AM THE MANAGER!
Manager: okay so Anonymous Coward you can remove badge access to all the 'extra' badges besides the ones on this list
(Some giant disaster happens because the Warehouse Manager badged into the server room, unplugged all four network cables on the production server and then drove home while everything had a meltdown)
Manager: WHAT THE FUCK ANONYMOUS COWARD HOW COULD YOU HAVE LET THIS HAPPEN?