Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dutch university hit by cyber attack on its Windows systems

maastrichtuniversity.nl

Post reply on HN
Print view View original

11–20 of 37 posts

Re: Dutch university hit by cyber attack on its Windows systems

#11

Post by noinsight »

WrtCdEvrydy wrote: post #8
chroem- wrote: post #4

It's interesting how the language around these incidents has shifted to give the impression that cybercommandos have stormed into cyberspace with their cyber assault rifles, when in reality the chances are very high that some university administrator probably downloaded a shady program from a porn site.

Jason from Defcon had an interesting quote about it... "It's not an Advanced Persistent Threat, it's Basic Ass Threat, but you just want your cyberinsurance policy to pay out. Fuck off"

Why would you blow your zero days on something when you can just download stuff off GitHub that works?

Russia initially compromised the 2018 Olympics with publicly available malware off GitHub.

See: https://www.wired.com/story/untold-story-2018-olympics-destr...

Re: Dutch university hit by cyber attack on its Windows systems

#12

Post by FDSGSG »

noinsight wrote: post #9
chroem- wrote: post #4

It's interesting how the language around these incidents has shifted to give the impression that cybercommandos have stormed into cyberspace with their cyber assault rifles, when in reality the chances are very high that some university administrator probably downloaded a shady program from a porn site.

> chances are very high that some university administrator probably downloaded a shady program from a porn site. Nah, in reality someone probably clicked a link in a malicious email that launched a backdoor on their computer. The likelihood of that approaches 100% on untrained users. And, as this is a university environment, that user likely had local admin. You only need 1 successful click to breach the good ol' "se…

>Nah, in reality someone probably clicked a link in a malicious email that launched a backdoor on their computer. The likelihood of that approaches 100% on untrained users.

In 2019 this is actually very unlikely. Driveby exploits have been pretty rare for years now.

Re: Dutch university hit by cyber attack on its Windows systems

#13

Post by throw0101a »

Are there any documented reports of Linux/Unix systems ever being hit by ransomware? Or files on NAS appliances (NetApp, Isilon, etc) being encrypted in a way that is unrecoverable (especially since snapshots can be scheduled regularly)?

Certainly you can steal data from non-Windows systems, so exfiltration attacks are similar on both, but AFAICT, these "we've got your data" style attacks are unique to Windows. If an IT (desktop/laptop) environment was more Mac-heavy, would these be an issue either?

Re: Dutch university hit by cyber attack on its Windows systems

#14

Post by rb808 »

throw0101a wrote: post #13

Are there any documented reports of Linux/Unix systems ever being hit by ransomware? Or files on NAS appliances (NetApp, Isilon, etc) being encrypted in a way that is unrecoverable (especially since snapshots can be scheduled regularly)? Certainly you can steal data from non-Windows systems, so exfiltration attacks are similar on both, but AFAICT, these "we've got your data" style attacks are unique to Windows. If an…

Basically 99.99% of companies and governments use windows so its unlikely to see this happening.

Re: Dutch university hit by cyber attack on its Windows systems

#15

Post by HarryHirsch »

throw0101a wrote: post #13

Are there any documented reports of Linux/Unix systems ever being hit by ransomware? Or files on NAS appliances (NetApp, Isilon, etc) being encrypted in a way that is unrecoverable (especially since snapshots can be scheduled regularly)? Certainly you can steal data from non-Windows systems, so exfiltration attacks are similar on both, but AFAICT, these "we've got your data" style attacks are unique to Windows. If an…

Ten years ago or so, our NMR spectrometer was held ransom. OK, it was a completely out-of-date Solaris, not Linux, but if don't use Windows you are not immune.

Re: Dutch university hit by cyber attack on its Windows systems

#16

Post by noinsight »

FDSGSG wrote: post #12
noinsight wrote: post #9

Earlier quoted context omitted.

> chances are very high that some university administrator probably downloaded a shady program from a porn site. Nah, in reality someone probably clicked a link in a malicious email that launched a backdoor on their computer. The likelihood of that approaches 100% on untrained users. And, as this is a university environment, that user likely had local admin. You only need 1 successful click to breach the good ol' "se…

>Nah, in reality someone probably clicked a link in a malicious email that launched a backdoor on their computer. The likelihood of that approaches 100% on untrained users. In 2019 this is actually very unlikely. Driveby exploits have been pretty rare for years now.

It's still one of the top methods.

See for example Symantec's report [1] with lots of data.

[1] https://www.symantec.com/content/dam/symantec/docs/reports/i...

Re: Dutch university hit by cyber attack on its Windows systems

#17

Post by briffle »

iwantagrinder wrote: post #10
chroem- wrote: post #4

It's interesting how the language around these incidents has shifted to give the impression that cybercommandos have stormed into cyberspace with their cyber assault rifles, when in reality the chances are very high that some university administrator probably downloaded a shady program from a porn site.

All of this shit comes through phishing emails with Office docs containing malicious macros or links. Literally 99% of it. All of these stories should say "Sysadmins ignored best practices of disabling unapproved macros, allowing malware to gain a foothold, dump privileged credentials on the system, and move laterally through the environment with ease"

Its a university, so more likely "Sysadmins implemented best practices of disabling unapproved macros, but due to an extreme number of complaints from academic staff that all their research would be ruined, had to disable it again."

Re: Dutch university hit by cyber attack on its Windows systems

#18

Post by mmilgauss »

throw0101a wrote: post #13

Are there any documented reports of Linux/Unix systems ever being hit by ransomware? Or files on NAS appliances (NetApp, Isilon, etc) being encrypted in a way that is unrecoverable (especially since snapshots can be scheduled regularly)? Certainly you can steal data from non-Windows systems, so exfiltration attacks are similar on both, but AFAICT, these "we've got your data" style attacks are unique to Windows. If an…

Linux systems are less targeted because they're less commonly used, their userbase on average knows more about technology and they're inherently more secure.

Re: Dutch university hit by cyber attack on its Windows systems

#19

Post by zeta0134 »

mmilgauss wrote: post #18
throw0101a wrote: post #13

Are there any documented reports of Linux/Unix systems ever being hit by ransomware? Or files on NAS appliances (NetApp, Isilon, etc) being encrypted in a way that is unrecoverable (especially since snapshots can be scheduled regularly)? Certainly you can steal data from non-Windows systems, so exfiltration attacks are similar on both, but AFAICT, these "we've got your data" style attacks are unique to Windows. If an…

Linux systems are less targeted because they're less commonly used, their userbase on average knows more about technology and they're inherently more secure.

Ha! This got a good chuckle out of me. Check again; this happens more often than you would think in the web hosting business, especially the small to medium business segment. "It's just a website how hard could it be?"

If I had a nickel for every RHEL 5 (yes, 5!) box still running after we begged customers to please, please move to something actually receiving patches...

In theory ransomware shouldn't have as large of an impact, but in practice backups are not a magical wand of "restore website and lose 0 transactions" either. That's assuming the backups are actually configured to grab the correct data, and haven't been silently failing for months...

Re: Dutch university hit by cyber attack on its Windows systems

#20

Post by jlgaddis »

throw0101a wrote: post #13

Are there any documented reports of Linux/Unix systems ever being hit by ransomware? Or files on NAS appliances (NetApp, Isilon, etc) being encrypted in a way that is unrecoverable (especially since snapshots can be scheduled regularly)? Certainly you can steal data from non-Windows systems, so exfiltration attacks are similar on both, but AFAICT, these "we've got your data" style attacks are unique to Windows. If an…

There was (recently) some ransomware for (unpatched, IIRC) Synology devices.
Post reply on HN