Analysis of Locky ransomware
-
@JaredBusch weird mix of USD and European notation there.
-
@BRRABill said:
@Dashrender said:
this is why I turned off Doc and DOCX files via the spam filter.
What if your users legitimately need those files?
Then I can white list them. Luckily - we rarely need those sent through email.
-
@BRRABill said:
@wirestyle22 said:
Much better ways to share documents than through email
Good point.
Actually - I would say not good point. What ways are you thinking? Drop Box? Google Drive? OneDrive, ODfB? etc - those are all horrible ways to share files because it's just as easy to get infected by them as it is by email.
Heck, the one person I know who got hit by Locky got it through DropBox. He got a notice it had been uploaded - he went and looked - he though HUH, it's odd that it's a word file, because normally it's a PDF - meh, whatever - click - infected!
It didn't help that the company used GPOs to remove the prompting about macros, so he didn't even have that protection. -
@Dashrender said:
Actually - I would say not good point. What ways are you thinking? Drop Box? Google Drive? OneDrive, ODfB? etc - those are all horrible ways to share files because it's just as easy to get infected by them as it is by email.
Heck, the one person I know who got hit by Locky got it through DropBox. He got a notice it had been uploaded - he went and looked - he though HUH, it's odd that it's a word file, because normally it's a PDF - meh, whatever - click - infected!
It didn't help that the company used GPOs to remove the prompting about macros, so he didn't even have that protection.It was more a ML concession. I just assumed there was an easy was in ODfB everyone was using I was unaware of.
For the most part file sharing like that is a PITA, especially for most users who have no idea. I have to get the file, and share it out, etc..
-
@Dashrender said:
@BRRABill said:
@wirestyle22 said:
Much better ways to share documents than through email
Good point.
Actually - I would say not good point. What ways are you thinking? Drop Box? Google Drive? OneDrive, ODfB? etc - those are all horrible ways to share files because it's just as easy to get infected by them as it is by email.
Heck, the one person I know who got hit by Locky got it through DropBox. He got a notice it had been uploaded - he went and looked - he though HUH, it's odd that it's a word file, because normally it's a PDF - meh, whatever - click - infected!
It didn't help that the company used GPOs to remove the prompting about macros, so he didn't even have that protection.I don't really do any local editing any more. Since I have Zoho I use Zoho Docs (doesn't really matter what service you use), but I use their online software. If I get it in an email, I can open it directly with their Docs apps and edit.
-
@johnhooks said:
@Dashrender said:
@BRRABill said:
@wirestyle22 said:
Much better ways to share documents than through email
Good point.
Actually - I would say not good point. What ways are you thinking? Drop Box? Google Drive? OneDrive, ODfB? etc - those are all horrible ways to share files because it's just as easy to get infected by them as it is by email.
Heck, the one person I know who got hit by Locky got it through DropBox. He got a notice it had been uploaded - he went and looked - he though HUH, it's odd that it's a word file, because normally it's a PDF - meh, whatever - click - infected!
It didn't help that the company used GPOs to remove the prompting about macros, so he didn't even have that protection.I don't really do any local editing any more. Since I have Zoho I use Zoho Docs, but I use their online software. If I get it in an email, I can open it directly with their Docs apps and edit.
This is something awesome about O365 and Google Apps as well.
-
@Dashrender said:
@johnhooks said:
@Dashrender said:
@BRRABill said:
@wirestyle22 said:
Much better ways to share documents than through email
Good point.
Actually - I would say not good point. What ways are you thinking? Drop Box? Google Drive? OneDrive, ODfB? etc - those are all horrible ways to share files because it's just as easy to get infected by them as it is by email.
Heck, the one person I know who got hit by Locky got it through DropBox. He got a notice it had been uploaded - he went and looked - he though HUH, it's odd that it's a word file, because normally it's a PDF - meh, whatever - click - infected!
It didn't help that the company used GPOs to remove the prompting about macros, so he didn't even have that protection.I don't really do any local editing any more. Since I have Zoho I use Zoho Docs, but I use their online software. If I get it in an email, I can open it directly with their Docs apps and edit.
This is something awesome about O365 and Google Apps as well.
Ya I've used both. I have a Microsoft account and an Office 365 account. The Office online stuff is nice, and same with Google Docs. I just use Zoho for mail so that makes sense for me.
-
This post is deleted! -
@Nic Sorry, I don't click on links
-
@aaronstuder said:
@Nic Sorry, I don't click on links
come on, it's just a little ransomware, that's all
-
@aaron said:
@aaron said:
Yes, Backblaze can help with ransomware.
To follow up, Backblaze was hit with CryptoWall on a corporate Windows machine. Not Locky... But I I think it's a better story to follow than my shorter answers.
If you'd like to read the unfortunate details and how it was recovered from backup https://www.backblaze.com/blog/cryptowall-ransomware-recovery/
The nice part is that you can get a full restore as of a certain day. Certainly a good part of a nice backup strategy.
-
@BRRABill said:
@aaron said:
@aaron said:
Yes, Backblaze can help with ransomware.
To follow up, Backblaze was hit with CryptoWall on a corporate Windows machine. Not Locky... But I I think it's a better story to follow than my shorter answers.
If you'd like to read the unfortunate details and how it was recovered from backup https://www.backblaze.com/blog/cryptowall-ransomware-recovery/
The nice part is that you can get a full restore as of a certain day. Certainly a good part of a nice backup strategy.
What is the range of time though? 7 days? 30 days?
-
@wirestyle22 said:
What is the range of time though? 7 days? 30 days?
They keep 30 days of revisions/deletions.
-
Are you using Microsoft EMET at your machines? Which antivirus is your favourite?
Here, some spanish security gurus say EMET is necessary in all cases, also with Windows 10.
-
-
Hospitals can declare a state of emergency of the Internet now? Good to know.
-
It's actually an INTERNAL state, though it could also be considered an INTERNET state as well!
Not sure why the URL says that.
-
@BRRABill said:
It's actually an INTERNAL state, though it could also be considered an INTERNET state as well!
Not sure why the URL says that.
LOL, just going by what I read
-
@Carnival-Boy said:
Isn't it easier to disable macros in Word? I've never known anyone ever use macros in Word (Excel, yes, Word, no).
Went to do this today. Downloaded and installed all the Office ADMX files from Microsoft. Spent ages trying to figure out why it wasn't working. Eventually found a Spiceworks thread where someone points out that Group Policy is not supported with Office 365 Business Plans.
That sucks!!!
Any alternative suggestions would be appreciated. I guess I could do a custom group policy object to change the registry values where macro settings for Word are specified? It looks like it is set by a DWORD called VBAWarnings. That wouldn't stop a user from changing it back, but it would help.
-
This is really winding me up today. I went on to Techradar.com at lunchtime for a bit of light reading and the headline was "Microsoft tightens Office 2016 security with anti-macro measures". "Cool", I thought.
The headline and article was based on a new blog post from Microsoft here:
https://blogs.technet.microsoft.com/mmpc/2016/03/22/new-feature-in-office-2016-can-block-macros-and-help-prevent-infection/ with the headline "New feature in Office 2016 can block macros and help prevent infection"At no point in either article does it point out that these group policy features aren't available to several versions of Office 2016. It is only available to O365 Enterprise versions (and ProPlus and Volume Licence). Sure, it talks about "Enterprise Administrators", but it's not obvious that enterprise administration means an enterprise plan.
You have to go to this document to actually find out which versions of Office support group policy:
https://technet.microsoft.com/en-us/library/office-applications-service-description.aspxI think it's a disgrace that a plan that is advertised as supporting up to 300 users doesn't include group policy support. 300 Office users is a fairly sizeable company in my book.
