Jack Rhysider
👤 PersonAppearances Over Time
Podcast Appearances
Now, typically when someone defaces a website, it's a small-time hacker. Being able to show your friends that you changed the text on a government website makes you look cool in some hacker circles. But it wasn't this person who defaced the website that put the malware on that computer. See, when Omar was investigating the defacement, he checked to see if any malware was left behind.
Now, typically when someone defaces a website, it's a small-time hacker. Being able to show your friends that you changed the text on a government website makes you look cool in some hacker circles. But it wasn't this person who defaced the website that put the malware on that computer. See, when Omar was investigating the defacement, he checked to see if any malware was left behind.
And it was just not by this person. One of the places Omar likes to look for malware is in the temp directory. The temp directory is used by programs to temporarily hold data. And it's kind of a free space for any app to use to dump data in there if it needs it. So this directory often has open permissions. Anyone can read or write to it. Not many directories are like that on a computer.
And it was just not by this person. One of the places Omar likes to look for malware is in the temp directory. The temp directory is used by programs to temporarily hold data. And it's kind of a free space for any app to use to dump data in there if it needs it. So this directory often has open permissions. Anyone can read or write to it. Not many directories are like that on a computer.
So that's why Omar looked in the temp directory, and that's where he saw that someone had stuck this malware in there.
So that's why Omar looked in the temp directory, and that's where he saw that someone had stuck this malware in there.
So someone had exploited this system 10 months ago, stuck some malware in there and then left quietly. And when someone else came and defaced the site, that's when he discovered that it was there. And just imagine that sinking feeling for a moment. Malware had been here for 10 months and nobody noticed. Your worst fears start racing through your head at this point. Did they steal anything?
So someone had exploited this system 10 months ago, stuck some malware in there and then left quietly. And when someone else came and defaced the site, that's when he discovered that it was there. And just imagine that sinking feeling for a moment. Malware had been here for 10 months and nobody noticed. Your worst fears start racing through your head at this point. Did they steal anything?
Did they access stuff they shouldn't? Did they jump around to other computers?
Did they access stuff they shouldn't? Did they jump around to other computers?
A zero-day means that not even Microsoft knows about this vulnerability. And the reason why it's worse is because whoever left this here must have access to some pretty advanced malware. It's not easy to find a zero-day exploit, because if it was, Microsoft would find it too and put a fix out for it. So it's supposed to be secret.
A zero-day means that not even Microsoft knows about this vulnerability. And the reason why it's worse is because whoever left this here must have access to some pretty advanced malware. It's not easy to find a zero-day exploit, because if it was, Microsoft would find it too and put a fix out for it. So it's supposed to be secret.
Now, specifically, this malware's purpose was to escalate privileges. So that means if you get on a system as a low-level user, it'll promote you to a user with administrator rights. So now you can do anything you want on that system. Kind of like if you were to just walk into the front door of a prison and convince the guards that you actually own the prison and to give you all the keys.
Now, specifically, this malware's purpose was to escalate privileges. So that means if you get on a system as a low-level user, it'll promote you to a user with administrator rights. So now you can do anything you want on that system. Kind of like if you were to just walk into the front door of a prison and convince the guards that you actually own the prison and to give you all the keys.
Being able to escalate your privileges is a crucial step at getting full control of a computer. And this could be the beginning of a big deal. And just as Omar was about to tell someone about this, news broke out.
Being able to escalate your privileges is a crucial step at getting full control of a computer. And this could be the beginning of a big deal. And just as Omar was about to tell someone about this, news broke out.
Wait, quantum ransomware? Gosh, a totally different group hit them? It makes me want to make a meme out of all this ransomware news. Enough is enough. I've had it with this mother flipping ransomware on these mother flipping computers. Just when you tune your eyes to be able to see and detect a certain kind of malware, you get blindsided by a totally different kind.
Wait, quantum ransomware? Gosh, a totally different group hit them? It makes me want to make a meme out of all this ransomware news. Enough is enough. I've had it with this mother flipping ransomware on these mother flipping computers. Just when you tune your eyes to be able to see and detect a certain kind of malware, you get blindsided by a totally different kind.
And whatever that malware was that Omar found on that web server, that had nothing to do with this quantum ransomware.
And whatever that malware was that Omar found on that web server, that had nothing to do with this quantum ransomware.