Patch Lady – I smell a Rat

Topic

New Reply

(coming to you from the friendly wifi of United Airlines as I fly to the Quest/The Experts Conference) So twice lately someone has asked about article
[See the full post at: Patch Lady – I smell a Rat]

Susan Bradley Patch Lady/Prudent patcher

12 users thanked author for this post.

jburk07, wavy, Norio, David F, wdburt1, Microfix, HiFlyer, Nibbled To Death By Ducks, woody, OscarCP, Lars220, lanceboil

Reply | Quote

Replies

Patch Lady: Thanks for your comment on this dubious/exaggerated phishing alarm. Also, I am now curious to know more details about the “the recent ransomware coming into multiple government entities via a shared managed service providers” that you mention as something of real significance This might concern me — not very likely, but this may be something that is better to learn more about. Is there some Web site where one can read about this in more detail? If there is, I’ll appreciate getting the link to it.

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote

https://www.channele2e.com/technology/security/texas-ransomware-attacks-msp-industry/

That’s the Texas ransomware that (reportedly) came in via their managed service provider.

Susan Bradley Patch Lady/Prudent patcher

3 users thanked author for this post.

WildBill, HiFlyer, OscarCP

Reply | Quote

Eeek! That is a bad way to get infected — by the service provider and not by the employees who were using the state government computers.

This is a real riot. Virtually all states publicly disclose their bidding process, and disclose the winning bidder. Great! So now a city, say Dallas, publicly discloses what vendors won the bidding process for AV software or for anti-ransomware. Now bad actors know what their potential target software is. Even worse is when bad actors know that there are no anti-ransomware defenses because there never was any bidding process for any of the specialized anti-ransomware defenses which are used by large corporations.

No wonder the computer networks of state agencies are “sitting duck” targets.

3 users thanked author for this post.

wavy, HiFlyer, OscarCP

Reply | Quote

I wonder about the situation in the State and Federal governments; if there have been attacks also brought to them, unwittingly, by IT contractors supposed to provide “security”, not by careless or clueless civil servants. As a consultant working with NASA, I have to take, every year, a long (and getting longer) IT security test to be allowed to even see my email at a NASA site, not to mention to use computers there. Wouldn’t it be ironic if, for example, the people in IT security, or even those preparing the tests, were also, quite unintentionally, bringing in such malicious bugs?

Two years ago, there was a big problem in the UK when their National Health Service, that pays for and organizes the medical care most people get there (something like what medicare does here for the elderly), was infected with the WannaCry ransomware across many of its computer installations. The reason in that case? Poor IT security in place:

https://www.bbc.com/news/technology-41753022

“An assessment of 88 out of 236 trusts by NHS Digital before the attack found that none passed the required cyber-security standards.”

Sounds familiar? Unfortunately, it does.

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

2 users thanked author for this post.

Lars220, HiFlyer

Reply | Quote

I see an article from Forbes at least once a week about Microsoft “Issuing an alert to millions of Windows users.” It’s getting so bad that I now have Forbes hidden from my news feeds.

4 users thanked author for this post.

Perturbance, Myst, Nibbled To Death By Ducks, OscarCP

Reply | Quote

Gordon in particular is sensationalist.

Susan Bradley Patch Lady/Prudent patcher

4 users thanked author for this post.

zero2dash, WildBill, Myst, woody

Reply | Quote

I read both of those articles and came away shaking my head.

Should’ve been shaking my fist.

What really hurts is when drivel like this makes it to the mainstream media.

4 users thanked author for this post.

WildBill, Myst, Microfix, Nibbled To Death By Ducks

Reply | Quote

It IS disheartening, isn’t it? The worst part about it is that it’s all about fright tactics to up the click count, so they can squeeze more money out of their advertisers. “See? Look at how many more views we have!”

When push comes to shove, the love of money always seems to eclipse values, standards, even human life, more and more. But I digress…(a habit of the old. Sorry.)

I’d like to see a topic started (Gee, I might do it myself!) regarding what everyone thinks are credible security threat sources/sites and what are NOT, especially in the on-line Infosec pub world. (Woody’s would be right up there with the good guys!)

Win7 Pro SP1 64-bit, Dell Latitude E6330 ("The Tank"), Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Newbie
--
"The more kinks you put in the plumbing, the easier it is to stop up the pipes." -Scotty

3 users thanked author for this post.

Lars220, WildBill, geekdom

Reply | Quote

[WildBill]

Forbes is definitely mainstream & even CNN jumped on the alarm bandwagon when August’s Patch Tuesday rolled around. Wonder if “Facts First” will start spreading the “Complete Control” panic around soon? I searched for the phrase in quotes & got nothing so far; in Business as well as All CNN. As for mspoweruser.com, they seem more niche to me. I suspect they got the “scoop” from Davey Winder of Forbes, rather than vice versa.

Bought a refurbished Windows 10 64-bit, currently updated to 22H2. Have broke the AC adapter cord going to the 8.1 machine, but before that, coaxed it into charging. Need to buy new adapter if wish to continue using it.
Wild Bill Rides Again...

• This reply was modified 5 years, 8 months ago by WildBill.

Reply | Quote

Technology, computer, manufacturing, and engineering information is best left to trade and specialty publications.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

Sick of MSM peddling OMG ALERT ALERT EMERGENCY, YOU SHOULD FEEL FEAR AND SHOCK! at everything.

We have weather, during winter we’re going to get ARCTIC BLASTS, and WALLS OF SNOW and POLAR VORTEX, and summer a SCORCHING HEATWAVE etc. Then with tech we have OMG PATCH NOW, UBER VIRUS OUT PATCH PATCH, BATTON THE HATCHES, DON’T GO ONLINE FOR 3 MONTHS! (despite there not even being any patches out).

You edited one of my previous posts to softly say “they should be taken to task”, but you know what they really need. These people writing these articles do so to intentionally cause terror, for political or financial gain. With the former, that’s literally terrorism, and there’s no excuse for it.

These people actually want the general public, their own audience even, to be sat cowering in fear and anxiety, 24/7. Makes me sick.

What they should be teaching is, “This is business as usual. These sort of threats are always out there. Learn and follow good I.T security principles and standards. Just as you lock your door at night to secure your house, learn the basics of securing your computer, and go about your day.”

1 user thanked author for this post.

anita.yk

Reply | Quote

When People say the sky is falling and patch now, REMEMBER THIS: Web site that offer the downloads can and at times are hacked. Remember Ccleaner and the malware? For me if someone is saying the above, then they might have hacked a site and put malware instead of  patches or even put malware IN the patch. So for me I stay far, far away and wait for more news.

Reply | Quote

The problem is that when the big voices call WOLF all the time, when the wolf does come it’s just business as usual.

Our best protection is precaution and prevention on a rational scale, the bear catches the slowest runner..

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote