Dutch university hit by cyber attack on its Windows systems
maastrichtuniversity.nl
Dutch university hit by cyber attack on its Windows systems
1–10 of 37 posts
Re: Dutch university hit by cyber attack on its Windows systems
#2on its Windows systems
Re: Dutch university hit by cyber attack on its Windows systems
#3There really isn't more information about this than the above so we don't know.
Here's a few Dutch sources at the bottom you can throw through a translation service: "nearly all windows computers were hacked", "we dont know if this was criminal and if the perpetrator(s) demand money".
Noteworthy quote "We are researching if the attackers could access that. Our expectation is that this is very difficult." on the storage of scientific data.
https://nos.nl/artikel/2316120-cyberaanval-op-computers-van-... https://www.1limburg.nl/groot-cyberhack-bij-um-criminele-aan...
Re: Dutch university hit by cyber attack on its Windows systems
#4It's interesting how the language around these incidents has shifted to give the impression that cybercommandos have stormed into cyberspace with their cyber assault rifles, when in reality the chances are very high that some university administrator probably downloaded a shady program from a porn site.
Re: Dutch university hit by cyber attack on its Windows systems
#5according to an insider, tweakers [0] is reporting that it is a ransomware attack and many device have been encrypted
[0] https://tweakers.net/nieuws/161538/deel-diensten-universitei...
Re: Dutch university hit by cyber attack on its Windows systems
#6Allegedly it's the CLOP ransomware.
"All dhcp-servers, Exchange-servers, domaincontrollers and networkdrives have been encrypted."
Source in Dutch: https://tweakers.net/nieuws/161538/deel-diensten-universitei...
Clop: https://securingtomorrow.mcafee.com/blogs/other-blogs/mcafee...
Re: Dutch university hit by cyber attack on its Windows systems
#7Central point of control (domain), central point of infection.
As someone else said it, many networks are crunchy on the outside, chewy on the inside.
We need a new model, that makes lateral movement much harder. There's no reason to allow an infected domain controller to infect the whole network, but I don't know what the solution looks like which still allows centralized control.
Re: Dutch university hit by cyber attack on its Windows systems
#8It's interesting how the language around these incidents has shifted to give the impression that cybercommandos have stormed into cyberspace with their cyber assault rifles, when in reality the chances are very high that some university administrator probably downloaded a shady program from a porn site.
Jason from Defcon had an interesting quote about it...
"It's not an Advanced Persistent Threat, it's Basic Ass Threat, but you just want your cyberinsurance policy to pay out. Fuck off"
Re: Dutch university hit by cyber attack on its Windows systems
#9It's interesting how the language around these incidents has shifted to give the impression that cybercommandos have stormed into cyberspace with their cyber assault rifles, when in reality the chances are very high that some university administrator probably downloaded a shady program from a porn site.
> chances are very high that some university administrator probably downloaded a shady program from a porn site.
Nah, in reality someone probably clicked a link in a malicious email that launched a backdoor on their computer. The likelihood of that approaches 100% on untrained users. And, as this is a university environment, that user likely had local admin.
You only need 1 successful click to breach the good ol' "secure internal network" after which all bets are off - few companies sufficiently secure their networks from "internal" attackers.
On a traditional Windows network, credential hygiene practices are woeful and Domain Admin (admin access to every single domain-joined device on the network) level credentials are lying around everywhere and once those are compromised, every single domain-joined device on the network can be compromised.
I've seen this all happen in the span of 10 minutes - a remote user with VPN gets compromised, the attacker connects to the corporate network through them, gets Domain Admin and spreads malware through Active Directory to every single device on the network - X thousand workstations, Y hundred servers etc.
There's no actual vulnerability to remediate - you just have to "administrate properly" to prevent this. (https://aka.ms/spa)
Re: Dutch university hit by cyber attack on its Windows systems
#10It's interesting how the language around these incidents has shifted to give the impression that cybercommandos have stormed into cyberspace with their cyber assault rifles, when in reality the chances are very high that some university administrator probably downloaded a shady program from a porn site.
All of this shit comes through phishing emails with Office docs containing malicious macros or links. Literally 99% of it. All of these stories should say "Sysadmins ignored best practices of disabling unapproved macros, allowing malware to gain a foothold, dump privileged credentials on the system, and move laterally through the environment with ease"