Hello, welcome to the Thursday, November 17th, 2016 edition of the Sands and Storm Center's Stormcast. My name's Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Yesterday, Brad shared one of the latest ransomware attacks that he has seen in his environment. In this case, it was the Troll-Dash

ransomware that was delivered via malicious spam. The spam itself was in Russian, so mostly targeting

Russian users, of course, claiming to come from a Russian bank. The URL in the email looked

legit, but then of course course when you clicked on it,

you ended up somewhere else and you ended up downloading a screensaver file that was

sipped. If you unciped it, then you got infected with this troll-dash ransomware that, of course,

as typical for ransomware, encrypted your files. As typical for Brad,

he's sharing his indicators of compromise and files with traffic captures and also the malware

itself. For a while now, it has been known that a locked but unattended laptop can potentially

be compromised by plugging it into a USB Ethernet adapter. What's happening is that once you plug

into USB Ethernet adapter, of course with a network connection, then the laptop will reach out the

DHCP typically to then look for an IP address and it will start sending traffic out of

that USB connection. And since modern systems continuously do access various websites and like, for example, check for updates

that can be used by NetHacker to inject malicious content.

There hasn't really been an easy-to-use simple exploit for that.

Of course, it has also been exploited over Wi-Fi connections, but there is now a new little tool called Poison Tap that implements all of this in a little Raspberry Pi Zero.

So all you do is install the software, plug in a laptop, and you may or may not get access to things like cookies and the like that will

authenticate the user. There are sort of two sides to defend against this. First of all,

on the web server side, if you're a website and you're concerned about your users, make sure

you only allow HTTP and you only allow cookies with the secure flag

set. That will mitigate some of the problems here. On the users, on the client side, of course,

...