Trend Micro Ransomware File Decryptor Covers a Decent Number of Strains

While not perfect, this is a nice little tool to have in the toolbox just in case. I haven’t tried it personally, but it is said to decrypt files infected from the list below. Keep in mind there are some issues with certain strains, such as CryptXXX V3 and CERBER, so be sure to read the instructions and notes before proceeding. Hopefully you will never need this, but if you do, good luck.

The tool will attempt to decrypt files encrypted by:

  1. CryptXXX V1, V2, V3
  2. CryptXXX V4, V5
  3. Crysis
  4. DemoTool
  5. DXXD
  6. TeslaCrypt V1
  7. TeslaCrypt V2
  8. TeslaCrypt V3
  9. TeslaCrypt V4
  10. SNSLocker
  11. AutoLocky
  12. BadBlock
  13. 777
  14. XORIST
  15. Teamxrat/Xpan
  16. XORBAT
  17. CERBER V1
  18. Stampado
  19. Nemucod
  20. Chimera
  21. LECHIFFRE
  22. MirCop
  23. Jigsaw
  24. Globe/Purge
  25. V2:
  26. V3:

Erich’s “What in the (cyber security) world is going on?” 02-16-17 edition

So, I will unabashedly admit to failing miserably at making my weekly post the last couple of weeks. I’ve been traveling and webinaring and otherwise buried in stuff. Oh, and I was abducted by aliens. yeah, that’s it… aliens. Either way, my bad.

Careless Licking Gets a Nasty Ransomware Phishing Infection

Yeah, I totally took this headline from my employer. It was just too good to pass up. What happened is Licking County Ohio got hit by ransomware that took down about 1,000 machines and completely shut down the town government. The best quote I’ve seen for a while came from that when County Auditor Mike Smith commented: “Apparently, our clock still works”. Ouch!

 

Polish banks hit by malware sent through hacked financial regulator

Well, some smooth slick soul managed to upload malware to the Polish financial regular’s website which resulted in infections in some Polish banks. Not a good thing, not at all. Just goes to show, be cautious even when dealing with “trusted” sources.

 

There is a fake Netflix app that is ransomware

Trying to steal Netflix? It may cost you. Just pay the $8mo for crying out loud.

 

New campaign spreading ransomware and another trojan simultaneously

Because Locky doesn’t suck enough as it is, this campaign is also downloading a click-fraud trojan so they can make a few bucks on the side. Shameless.

 

Mirai is spreading via Windows malware

They have started spreading this via windows trojans as they work to build the largest, most terrifying IoT botnet ever known to man. When fridges revolt, nobody is safe!

 

Arby’s got breached

More than 350,000 credit and debit cards could be at risk after Arby’s POS systems were found to be malware laden. I’d say more, but I have no beef with them. (<- you see what I did there, right?)

 

Soda machines take down a university

A gaggle of  infected IoT devices, including vending machines, caused a lot of havoc at an unnamed university by flooding the DNS server with seafood-related lookups. Obviously something was fishy, so they took action and tracked it down.

 

That’s all I have this week. I’m going to work on doing more mini posts based on things I see during the week, so subscribe and you will get those notifications. Thanks

FUD or Fact? Is ransomware and social engineering really that big of a threat?

We hear the stories almost daily, we see the headlines in the news, but how worried should we be?

The answer really is, it depends. Today I have seen a few headlines including this whopper: “New ransomware could poison your town’s water supply if you don’t pay up“. Sounds very scary, and the idea is, however it is important to understand that this is based on a Proof of Concept (PoC) attack demonstrated at RSA. Is it possible that this can occur, I suppose it is, but the real question is if it is likely. The answer is, not right now. This makes it FUD, or “Fear, Uncertainty and Doubt”. There is a big difference between showing a PoC and doing it in the wild, so you can sleep well tonight.

but…

This is where it get’s a bit spooky. It is possible, and if the researchers that did this are thinking about it, you can bet our enemies and the bad guys just out for a big payout, are too. So research like this is important, but let’s not start stocking up on bottled water just yet.

What is the real threat RIGHT NOW?

The current threats deal more with making fast money and wreaking havoc on organizations by locking them out of records and data that is required to do business. Even that threat is expanding though as hackers are working to innovate. Before we see water supplies threatened, expect to see more and more attacks where the bad guys are threatening to, or actually publicly releasing, sensitive information. Imagine if your organizations “secret sauce” or proprietary information was made public. How much did it cost you to develop that, and how much of a competitive advantage would be lost if that happened? Take KFC’s “Secret Recipe” for example. Rumor is, it is guarded by eunuch Ninja cyborgs… or something like that.

The other real threat is CEO Fraud (aka BEC) and W2 scams that are happening right now. Just yesterday I spoke with an individual that signed up for our training because they sent all of their employees W2’s to some scammers. They were surprised to learn that they are not alone. Manatee County, FL (in my own back yard) was a victim, as was Argyle School District in Texas. Even Snapchat got caught in the crosshairs last year. This is real, this is in the wild, and it is happening to organizations of every size in every industry.

So, what do you about it?

The number 1 way to counter these attacks is through user training because the number 1 attack vector is via email phishing. You train your folks and phish them with non-malicious payloads and links. This way they get used to spotting these phishing emails before something real hits. Technical controls are just not reliable enough to catch and stop these targeted attacks, but making your users a “Human Firewall” is.

The number 2 thing is to have good backups. This really only matters for ransomware because once you send money or W2 info, backups won’t help. For those cases, number 2 is to have a plan to deal with it. Developing this plan will help you react quickly and help you develop policies to avoid these attacks (e.g. ALWAYS talk to the requestor on the phone BEFORE sending money or sensitive info). All should agree on this policy, and they will if you have trained them on the threats. Also, know who your local law enforcement contacts are, and how to contact them. Having a PR firm and/or lawyer in mind is also a good idea.

So, keep an eye on the new developments, but don’t get dragged in to the FUD. Focus on the real, current threats and you will do more to protect yourself than by chasing the possible (but not likely) ghosts of things to come.

So, You Are a Tech Manager Now…

** I want to start by saying that this is nowhere near a comprehensive list of things that can help you better manage, but simply a sharing of my personal experience and meant to help people step back and think about things a bit. **

 

So, now you’re a manager. You got that promotion that you probably either dreaded or worked very hard for. The question is, what now? Your whole career you’ve been a tech guy and now all of a sudden you’re a manager. First thing to remember is, don’t panic! (and perhaps carry a towel just in case)

While this can be a very spooky time, it’s also a great step in your career. You are going to have to look at things a little differently though. For one, instead of waiting for somebody to tell you what to do, you’re going to have to do the telling. That means now, all of a sudden, you are responsible for figuring out what needs to be done and assigning someone to the task. This may be new to you, but if you keep a cool head, it’s not that bad.  Remember that when you’re in management, the responsibility falls to you. You can delegate the work, but you are still responsible for the results.

 

Budgets

Being in management means looking at the big picture. You need to understand what it really cost per unit of XYZ, and you are going to need to start thinking about how much available labor you have versus how much you need to spend. It’s like budgeting with money, only with time instead.

Something to remember here is that unlike money, where a dollar is worth a dollar, labor varies in its value. Some folks are 85% efficient, others hover around 12%, some can even cause an efficiency/oxygen deficit by dragging others down (<- we all know that person, right?). Labor is generally referred to in a unit of measure called an FTE (Full Time Equivalent) which we consider to be a body working 40 hours per week. Don’t ever try to calculate projects based on straight FTEs though as this can result in much wailing and gnashing of teeth. You have to remember that just because a person is burning oxygen for 40 hours a week, they are not producing 40 hours worth of work. On the flip side, sometimes a person can be working on 2 things at once that overlap, so you have to consider that. For example, if it takes 2 hours to image a workstation, you can figure that much of that time can be spent doing something else while data copies, so it may only take .5 FTEs (30 minutes of actual labor) to do the job.

 

When it comes to financial planning, if you are going to have a budget or be a part of budget planning, learn about the difference between CAPEX and OPEX. Understand that in the technical word, a lot of CAPEX also requires significant OPEX. Likewise, you can move some CAPEX expenses to OPEX, for example by moving to that cloud thingie that is so popular with you youngsters.

 

Language

Another hurdle you may face is a different language used by leadership. They tend to speaking dollarese where we speak in techenese. In a truly cruel irony of the universe, these two languages have very little in common, and those words that are similar in pronunciation, mean polar opposite things. This can lead to anything from minor misunderstandings to World Wars.  To get a handle on this I recommend you spend a little time with some online management courses, maybe somewhere like Lynda.com, that can help you understand management basics and semantics.

 

Personnel 

This can be truly difficult if you were promoted from within the ranks. You may be dealing with folks that are jealous that they did not get the promotion, folks that were peers that you did not get along with, or even the feeling that you “sold out” to management. Regardless, you have to change the relationship. This doesn’t mean you can’t be friends, but what that means will probably need to change how the friendship operates or is perceived. The days of partying after work with the team, sleeping in the parking garage and coming to work to hear stories that start with, “I can’t believe you did that!” are over. If that’s what you want, resign your leadership role now.

 

The best advice I can give when it comes to becoming a manager is to be humble, but firm. You are there to help the people you manage succeed and grow, and make the business a success. This is not about power, it’s not about bossing people around, it’s not about you, it’s about leading. That means getting your hands dirty as well and not just giving all the garbage jobs to the team. On the flip side, that does not mean you should do everything yourself. You have to allow others to do new things so they can grow, but don’t try to use them as your personal slaves. This may take some practice, but if you are honest with your team and humble about your role, people tend to respond well. You may have some folks push boundaries, this is normal as they figure out where your limits are. Don’t take this personally, listen to their suggestions, consider the argument, but remain firm in your decisions unless there is a compelling reason to change.

 

There are other things you may not have had to do, such as performance reviews for your old team members. This gets a little weird when you are managing people that you used to be peers with. It may not be easy, but this is one place where you really earn the title of manager. You may find yourself reviewing a person that you don’t like personally. Set the personal issues aside and judge them on the job requirements. It’s not always easy to do, but just because they shared that embarrassing picture from the Christmas party after a few too many eggnogs, it doesn’t mean they aren’t great at the job. You need to be honest about it and fair to everyone. Don’t be afraid to say, “Tom, we haven’t always got along, but you are a great here.”

 

Check Your Pride at the Door

Embrace feedback from your leadership and your team as well. Be open to criticism and be willing to learn from it. You are doing something new and uncomfortable and you will make some mistakes along the way. Mistakes are OK if you own the goof up, learn from it and don’t repeat it. Apply this to your team members as well.

 

Dress Code

I decided to add this after just having lunch with a friend. You might need to dress differently. Embrace it, love it, live it and SUIT UP!  😀

 

 

 

TL;DR

You are responsible for people now, and you will need to act like it. Embrace the personal and professional growth, get serious about things and enjoy seeing your team grow. It will grow on you, and one of the most rewarding things I have ever experienced is watching a person I led excel in their career and personal life.