London uni fears 0-day used to cram network with ransomware

https://www.theregister.co.uk/2017/06/14/university_college_london_ransomware_attack/

 

Question is why are they opening attachments in the first place?

 

Human curiosity. Malware authors know the biggest flaw they can exploit is human nature.

 

https://threatpost.com/ransomware-attack-hobbles-prestigious-university-college-london

 

Love to find what the AV was since they are claiming it was a 0-day that blew right past it.

 

'"Currently it appears the initial attack was through a phishing email, although this needs to be confirmed," the ISD said.' ~ op cit

 

Oh yes folks, you can get ransomware via a drive-by download.

A few months back, Eset detected same. I am posting the screen shots below. At first, I thought it was a FP because no one at VT detected anything about the URL. This went for a couple of days - no detections. Also, each drive-by download had a different hash indicating it was polymorphic. So I finally manually submitted the URL to Quttera. It found plenty of malware. Also after that scan, it finally showed detections at VT - thank you, itman.

Anyway, this incident made me a "firm believer" in Eset's ransomware detection capability. BTW - the ransomware was Cerber.

 

Well it's a website where exploits and vulnerabilities are discussed so there could be some links to POCs and malware posted... Using IE to access that site would not be my choice

 

I don't know which is the most disconcerting, a phishing email or a drive-by web page.

 

https://www.infosecurity-magazine.com/news/ulster-university-also-suffered/

 

I just checked Ulster U's web site. They offer McAfee free to students. So its a fair assumption that's their enterprise vendor also. Do we need further explanation why the U.K. keeps getting hacked all the time?

 

This incident might get interesting ..............

http://www.securityweek.com/uk-center-security-excellence-hit-ransomware

 

LOL, good one. But if they were really hacked via web-exploit, I wonder which browser they were using. It would be crazy to still use IE.

 

Looks like most Wilders folks are covered on this one; the ad blocker part that is.

https://www.scmagazine.com/ad-blockers-help-prevent-ransomware-says-graham-cluley/article/670877/

Also a classic example of a drive-by download. Hum ....... isn't SmartScreen supposed to prevent stuff like this?

 

So they probably used some not up-to-date software that got exploited? I wonder which one was that.
Unfortunately, ad blockers are a must and I usually install them right after I install browser.

 

I read about it, they used an unpatched version of IE, that's asking for trouble. Apparently their AV also failed to block it. All they need to do is start using FF or Chrome with ad-blocker, and of course AE/white-listing.

 

An adblocker is also my first extension after i have installed a browser.

 

Link please.

 

Adgholas malvertising group linked to UCL Trojan ransomware attack

https://www.scmagazineuk.com/adghol...-ucl-trojan-ransomware-attack/article/670252/

 

WoW ! This is getting sirius. Thanks for that one @itman.

I pity those who do not read Wilders daily. It's easy to lose sight of the fact that the vast majority have no idea of the online threats they face daily and their total lack of awareness of the deficiencies in their security practices.

 

https://www.proofpoint.com/us/threa...paign-using-astrum-ek-deliver-mole-ransomware

-EDIT-

CVE-2016-0189 is an IE8-11 vulnerability posted 5/2016
CVE-2016-1019 and 4117 are Flash Player vulnerabilities

My money is on the use of a new undisclosed vulnerability in these latest attacks.

 

Thinking that Microsoft should make uBlock Origin an integrated part of Windows. WD and Smite Screen are apparently not enough.

Does Smite Screen disable uBlock also?? Why not? Since it disables KIS it's only fair that it should also disable uBlock. Looks like a clear case of discriminatory behavior. uBlock should sue Microsoft for not being blocked by Windows.

 

And you already know the worse part. Most couldn't care less but only to get online and take off blindly like a bat not even realizing they been owned several times over or when their system goes Kap00f or overheats due to the nature of some of them. Burn baby burn is the motto for advert foulware makers. Drive new unit sales up or tech support right?

 

Yeah, I hear you. Kids these days.

BTW: Looking at your Signature, are you sure you couldn't use a little "beefing-up" yourself in your security set up Maybe an M1A2 Abrams Tank or something like that.