09/09/2021
A new security vulnerability is affecting computers all around the globe and can be used to push out ransomware or other damage to your systems. This blog post from the folks at Huntress (we subscribe to their threat detection service) has a technical explanation of what it is.
https://www.huntress.com/blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444
But in short, do NOT click links in your emails from anyone you don't know and even then, verify that it's a legitimate email.
For example, one company received an email from "HR" to all their staff advising them of a lost puppy that was found on the property and a link to see a picture of it. Now who wouldn't want to click to see an adorable puppy?
This sort of vulnerability and the risks it presents is another good example of why layered security is so important. No tool alone can stop 100% of threats, but when stacked with other tools, the risk surface goes way down. Same idea as stacking a bunch of swiss cheese slices on top of each other and seeing if you can see through the entire stack. With one slice, of course -- it's full of holes. Put two slices together and there's less holes. And so on.
So in this case, here's an example of a good layered approach.
1) User behavior. Education. Be aware of clicking links, and do not open any office docs from unknown sources.
2) Email filtering that will find potentially dangerous links and strip them out
3) Applying patches and workarounds to mitigate possible attacks.
4) Updated anti-virus that can detect compromised files and block them
5) A strong firewall that will block incoming and outgoing connections to attacker's bot farms and stop their ability to download malware and encryption keys for ransomware
6) DNS filitering service that can block requests to download payloads and/or provide remote control of a machine to a bot farm.
7) Threat detection software that can detect any compromises (ie, if something gets through all the other layers) to alert sys admins of a problem and get them taking steps (like disconnecting the network) to stop further damage
8) Good redundant backups in case all else fails and the attackers gain access and destroy or encrypt your data, so you can get back online as quick as possible.
We provide this to our clients as part of our service offering, as do most other Managed Service Providers.
Be safe everyone!
Huntress is monitoring a new threat against Windows OS and Microsoft Office products (CVE-2021-40444). The MSHTML engine is vulnerable to arbitrary code ex*****on.
