I just got my first call from someone who had gotten dual-bitten by a password logging bot plus (to my amazement) some ransomware.

She was running a (mostly) updated copy of Win7x64 along with MS Security Essentials.

A close check of all her financial and personal logins followed by the creation of some strong new passwords fixed that worry. Fortunately, nothing was tampered with as far as she and we could tell.

The damage done by ransomware encryption was annoying, but less an issue since she had clean and very recent backups of all her critical stuff.

One HD wipe, reformat, and OS/apps/data reinstall and she was back to normal except for some personal inconvenience plus some money spent getting help and buying more powerful commercial antimalware.

Draw from this what conclusions you will.
.

The damage done by ransomware encryption was annoying, but less an issue since she had clean and very recent backups of all her critical stuff.

I've only ran into that one once during an accountant was checking their personal webmail at work episode. All the stuff on the server was saved using the Previous Versions feature (I really like that one), and all the stuff on the workstation was... hehehe ...Well they won't do that again.

Rule 0: No critical data is ever to be stored on a workstation.

Store it in the Cloud!

Generally speaking, how much do you trust Cloud? I know that even Cloud is (as expected) under attack.

Quote from: Tuxman on July 28, 2014, 10:40 AM

Store it in the Cloud!

Generally speaking, how much do you trust Cloud? I know that even Cloud is (as expected) under attack.

That wasn't a serious statement nor contribution to the thread.

Quote from: Tuxman on July 28, 2014, 10:40 AM

Store it in the Cloud!

Generally speaking, how much do you trust Cloud? I know that even Cloud is (as expected) under attack.

The Cloud is about as rife with penetration options as Linda Lovelace's entourage ... But I'm guessing he's unaware that I only deal with business/commercial class networks.

"Not on a workstation" - but ... on servers then?

Where to store the "critical data" then?

Dumb Terminals/Thin Clients connect to your own servers.  That's been a concept for a while...

You could also run your own trusted private mesh network with some fellow travellers and keep it all off the public backbone.

It's not enough to just own the servers any more. You also need to own the actual network infrastructure.

Quote from: 40hz on July 27, 2014, 06:06 PM

I just got my first call from someone who had gotten dual-bitten by a password logging bot plus (to my amazement) some ransomware.

She was running a (mostly) updated copy of Win7x64 along with MS Security Essentials.

...

Draw from this what conclusions you will.

The problem is you can't draw any more elaborate conclusions than that MSE did not stop this threat. For all we know, a commercial protection might have been equally useless.

Precisely.

To wit: the one and only time I ever got bit was some years back - on a fully protected and updated machine.

I think this is one of those situations where the old adage that "One prayer and a toothbrush is better than a thousand prayers and no toothbrush" applies. It's a more a risk minimization strategy rather than a risk elimination process.

How much additional protection you get going with something other than MSE as your main AV scanner is up for debate. But that's a topic I'm not really qualified (being merely an informed user - and not a bona fide security expert) to get into. About all I have to go on is what I'm seeing on the field. And what I'm seeing is that (lately) more and more stuff seems to be slipping past MSE.

[attach]

It's a more a risk minimization strategy rather than a risk elimination process.

That's definitely an important distinction, as security software is like birth control. Everything is 98% effective...and the last 2% is entirely up to you.

She gets a lot of company and client-generated PDF and document attachments with her e-mail.

With the popularity of Multi Function Printers these days, many companies are going paperless-er. And it seems like a lot of the people that set these things up always leave the default subject line in the scan to email configuration. Se people being used to accepting 'Xerox/HP/Lexmark/whatever model X created document' for a subject line while dealing with 50-100 of these a day can make it easy as hell to miss a bad one. Especially if the attacker matches up the default naming convention of the manufacturer with their name ... Or picks something inconspicuous and relevant like Invoice, Receipt, or Purchase Order.
This happens mainly because nobody wants to have to stand there in front of the damn thing and type a bunch of anything in on one of those tiny assed touch screens. So default, default, default, and send it is. Every friggin time.

Anytime I have to setup scan to Email on one of these devices - which happens a lot given the business we're in - I change the subject line to something that is relevant to the sending company to avoid having their Emailed scans adding to the problem.

Given the popularity of the technology, and ease of blending in...those things can be a real bitch to spot. And as a card carrying BOFH, it truly pains me to say it ... But it's damn hard to blame the user for missing one of these.

Given the popularity of the technology, and ease of blending in...those things can be a real bitch to spot. And as a card carrying BOFH, it truly pains me to say it ... But it's damn hard to blame the user for missing one of these.

Agree. This particular client isn't a fool. I've worked with her for about 10 years now. She's actually one of those responsible types who made sure she was tech-saavy above and beyond the requirements of her job. And she was devastated when this thing hit. Especially once she realized just how serious it was. Being a remote-located employee made her especially vulnerable. And being a non-dork, the very first thing she did was assume she herself had done something stupid. (She didn't btw.)

To make it even more interesting, the odds are pretty good that if it actually did come in via an infected attachment (as I suspect it did), the person who sent it to her didn't know it was loaded. Her company passes a lot of attachments back and forth for follow-up work, processing, client contact, etc. Some of it originates in-house. But the rest (60-70%) is generated by their clients. So it could have come from anywhere.

What's disturbing is that their e-mail provider's security didn't twig on it either. Can hardly blame the desktop when it's not showing a blip on the server's scanners, right? Her only warnings were that (a) her machine seemed ever so slightly slower starting up roughly three mornings before everything went south (she manually reboots each morning just to make sure it's "tidy" as she puts it) - and (b) that her scheduled Windows Update check (running daily at midnight and 6:00am) failed to complete two times in a row the day it happened.

This ain't script-kiddie stuff she got hit with. This is definitely the work of pros.

Scary! And just the tip of the iceberg I'm afraid.