WEBVTT 1 00:00:00.040 --> 00:00:03.839 Welcome to another deep dive. This time we're gonna be 2 00:00:03.839 --> 00:00:06.599 taking a look at ransomware. Yeah, you gave us this 3 00:00:06.759 --> 00:00:11.880 excerpt from a book. It's called Preventing Ransomware. Oh wow, 4 00:00:12.039 --> 00:00:13.560 so you know, right off the bat, it sounds like 5 00:00:13.560 --> 00:00:16.280 we're in for a treat. Yeah, but thankfully we have 6 00:00:16.399 --> 00:00:19.239 expert speaker here to help guide us through this. 7 00:00:19.399 --> 00:00:21.000 Happy to be here, all right. 8 00:00:21.079 --> 00:00:24.480 So to kind of set the stage, yeah, the book 9 00:00:24.519 --> 00:00:28.359 takes us back to, you know, the early days of malware. Okay, 10 00:00:28.559 --> 00:00:31.280 you remember, like the I Love You worm? Oh yeah, 11 00:00:31.320 --> 00:00:34.799 you know, looking back now, it almost seems quaint, doesn't it. 12 00:00:34.799 --> 00:00:39.159 It really does. It's like back then, malware was almost playful, right, 13 00:00:39.399 --> 00:00:42.280 you know, I Love You. It would spread through emails 14 00:00:42.399 --> 00:00:45.280 and it would like replace files, but it was mainly 15 00:00:45.359 --> 00:00:49.520 just about disruption. It wasn't really about you know, making money. 16 00:00:49.679 --> 00:00:52.280 Right now it's all about the money exactly. The malware 17 00:00:52.359 --> 00:00:52.960 is all grown up. 18 00:00:53.159 --> 00:00:56.159 Yeah, it's it's matured really very much. 19 00:00:56.200 --> 00:00:59.000 So. So how did we get from like those early 20 00:00:59.079 --> 00:01:00.920 days who just kind of and around to where we 21 00:01:00.920 --> 00:01:01.399 are now? 22 00:01:01.920 --> 00:01:03.640 Well, I think a big part of it is that 23 00:01:03.679 --> 00:01:07.879 shift towards profit, right, Yeah, as online systems became more 24 00:01:07.959 --> 00:01:12.400 and more essential to businesses and individuals. The potential for 25 00:01:12.519 --> 00:01:16.920 financial gain just became too tempting for attackers to resist. 26 00:01:17.120 --> 00:01:19.920 Yeah, it's like they realized, hey, we can actually make 27 00:01:19.959 --> 00:01:22.840 money off of this exactly. So let's talk about like 28 00:01:22.959 --> 00:01:28.760 the different types of ransomware. The book starts with scareware, okay, 29 00:01:28.920 --> 00:01:31.159 which to me feels like the og trickster. 30 00:01:31.359 --> 00:01:35.079 Yeah. Scareware is all about deception, right, and preying on 31 00:01:35.200 --> 00:01:35.840 people's fear. 32 00:01:35.920 --> 00:01:38.599 Yeah, like you know those pop ups that scream your 33 00:01:38.640 --> 00:01:42.280 computer is infected exact click here to download this scanner, 34 00:01:42.359 --> 00:01:45.439 which is like the malware itself. 35 00:01:45.159 --> 00:01:48.480 Or those fake anti virus programs with like really sleek 36 00:01:48.560 --> 00:01:51.920 interfaces that just bombard you with warnings and threats. 37 00:01:52.159 --> 00:01:53.879 I mean, I'm surprised that stuff still works. 38 00:01:54.079 --> 00:01:56.200 Yeah, you'd think people would be more savvy to it, 39 00:01:56.239 --> 00:01:58.200 but you know, there's still plenty of people who aren't 40 00:01:58.280 --> 00:02:01.280 as tech savvy. Ye, you know, maybe older users or 41 00:02:01.439 --> 00:02:05.120 just anyone who like panics easily when they see technical jargon, 42 00:02:05.879 --> 00:02:10.039 they might not realize that legitimate security software doesn't use 43 00:02:10.120 --> 00:02:11.800 those kinds of aggressive tactics. 44 00:02:12.000 --> 00:02:15.439 Yeah, yeah, so what about screen lockers? 45 00:02:15.759 --> 00:02:17.280 Oh, those are interesting. 46 00:02:17.360 --> 00:02:20.319 Those just like lock you out of your device until 47 00:02:20.319 --> 00:02:20.719 you pay. 48 00:02:21.080 --> 00:02:25.240 Yeah. Essentially, they hold your device hostage and they display 49 00:02:25.319 --> 00:02:28.479 this message demanding payment to unlock it. 50 00:02:28.680 --> 00:02:30.319 Right. Have you ever encountered one of those? 51 00:02:30.759 --> 00:02:33.800 I haven't personally, but I know people who have. Yeah, 52 00:02:33.840 --> 00:02:37.159 and the early versions were pretty simple, but they've gotten 53 00:02:37.199 --> 00:02:38.680 a lot more sophisticated over time. 54 00:02:38.800 --> 00:02:39.759 Oh really. Yeah. 55 00:02:39.800 --> 00:02:43.520 Some of them even mimic like official notices from law enforcement. 56 00:02:43.639 --> 00:02:46.360 Oh wow, to really amp up that fear factor. 57 00:02:46.520 --> 00:02:49.039 That's scary. But the book did mention there might be 58 00:02:49.080 --> 00:02:50.639 ways to like outsmart them. 59 00:02:50.879 --> 00:02:53.319 Yeah, depending on the complexity of the locker, there are 60 00:02:53.400 --> 00:02:58.599 potential workarounds like booting into safe mode or using system 61 00:02:58.639 --> 00:03:01.879 restore points. You know, those aren't always guaranteed to work. 62 00:03:02.000 --> 00:03:05.599 Yeah, right, right. But now let's get to like the 63 00:03:05.680 --> 00:03:11.560 really serious stuff crypto ransomware. Okay, this is where things 64 00:03:11.599 --> 00:03:16.919 get like really interesting and terrifying and terrifying. Yeah yeah, So, 65 00:03:17.120 --> 00:03:19.520 I mean what makes crypto ransomware so different? 66 00:03:19.680 --> 00:03:22.479 Well, it's the use of advanced encryption. It's like a 67 00:03:22.599 --> 00:03:24.800 digital thief changing the locks. 68 00:03:24.520 --> 00:03:26.800 On your house and then demanding a ransom for the 69 00:03:26.879 --> 00:03:29.800 key exactly, And even if you pay the ransom. 70 00:03:29.400 --> 00:03:31.120 There's no guarantee you'll actually get. 71 00:03:30.960 --> 00:03:33.319 Your data back, right, You're trusting criminals to keep. 72 00:03:33.159 --> 00:03:35.919 Their word, and criminals aren't exactly known for their honesty. 73 00:03:36.159 --> 00:03:40.039 Yeah. Good point. So how does this encryption like actually work. 74 00:03:40.199 --> 00:03:43.280 Well, a lot of them use a combination of symmetric 75 00:03:43.319 --> 00:03:47.319 and asymmetric encryption. Okay, think of it as a double lock. Okay, 76 00:03:47.360 --> 00:03:50.719 So they generate a unique key for each file, right, 77 00:03:50.840 --> 00:03:53.360 and then they encrypt that key with a master key 78 00:03:53.400 --> 00:03:54.520 that only they have. 79 00:03:54.840 --> 00:03:55.919 Okay, I'm already lost. 80 00:03:56.159 --> 00:03:57.120 Complicated stuff. 81 00:03:57.199 --> 00:03:59.479 Yeah, maybe it'll help if we like look at some 82 00:03:59.520 --> 00:04:02.719 real world examples. The book starts with jeep Code, which 83 00:04:02.800 --> 00:04:06.240 was like one of the early ransomware players. 84 00:04:06.360 --> 00:04:09.520 Yeah. Jeepode is a good example of how ransomware has evolved. 85 00:04:09.680 --> 00:04:09.960 Okoy. 86 00:04:10.199 --> 00:04:12.919 It used a relatively weak encryption. 87 00:04:12.639 --> 00:04:14.520 Algorithm, so it wasn't that sophisticated. 88 00:04:14.680 --> 00:04:17.120 Not really. No, In fact, some victims are actually able 89 00:04:17.160 --> 00:04:21.680 to decrypt their files without paying the ransom. Oh really Yeah, 90 00:04:21.720 --> 00:04:24.519 and it also left traces on the system, which made 91 00:04:24.560 --> 00:04:25.920 it easier to track. 92 00:04:26.279 --> 00:04:28.720 So not exactly master criminals at. 93 00:04:28.600 --> 00:04:29.959 This point, No, not quite. 94 00:04:30.040 --> 00:04:32.040 The jeep code was kind of a stepping stone. 95 00:04:31.839 --> 00:04:34.800 Right, Yeah, it paved the way for more sophisticated attacks 96 00:04:34.959 --> 00:04:36.920 like crypto locker. Exactly. 97 00:04:37.199 --> 00:04:38.839 That one was a big deal, wasn't it. 98 00:04:38.839 --> 00:04:39.720 It really was. 99 00:04:39.720 --> 00:04:42.800 Strong encryption, Bitcoin payments, the whole nine yards. 100 00:04:43.040 --> 00:04:45.360 It was a whole new level of. 101 00:04:45.439 --> 00:04:47.480 Threat and it's spread like crazy. 102 00:04:47.560 --> 00:04:50.959 Yeah. It mainly spread through phishing emails, okay, disguised as 103 00:04:50.959 --> 00:04:54.319 messages from legitimate companies like FedEx or ups. 104 00:04:54.600 --> 00:04:57.879 So you would open an attachment and boom, your data 105 00:04:57.959 --> 00:04:58.480 is locked down. 106 00:04:58.639 --> 00:04:59.199 Exactly. 107 00:04:59.560 --> 00:05:02.360 That a trick of tricking people into clicking. 108 00:05:02.040 --> 00:05:05.680 On things they should It's amazing how effective it still is. Yeah, 109 00:05:05.720 --> 00:05:09.079 social engineering remains one of the most powerful tools in 110 00:05:09.160 --> 00:05:10.399 the ransomware. 111 00:05:09.959 --> 00:05:13.800 Arsenal Right, So from g code to crypto locker, we're 112 00:05:14.199 --> 00:05:18.399 seeing this trend towards more sophisticated tactics, and then comes 113 00:05:18.439 --> 00:05:21.839 crypto wall, right, which the book describes as like almost 114 00:05:21.839 --> 00:05:23.839 treating ransomware like a legitimate business. 115 00:05:24.000 --> 00:05:27.920 It's fascinating, isn't it. Yeah, they had version updates, support systems, 116 00:05:28.000 --> 00:05:28.800 the whole works. 117 00:05:28.879 --> 00:05:32.079 Wait, support systems like they would actually help their victims 118 00:05:32.120 --> 00:05:32.800 pay the ransom. 119 00:05:33.240 --> 00:05:35.279 It sounds crazy, but yeah, that's. 120 00:05:35.199 --> 00:05:37.800 Kind of messed up, it is, But I guess it makes. 121 00:05:37.639 --> 00:05:40.759 Sense, right, Yeah, the smoother the payment process, the more 122 00:05:40.879 --> 00:05:42.000 likely victims are to. 123 00:05:42.000 --> 00:05:44.199 Pay, right, So it's all about maximizing profit. 124 00:05:44.360 --> 00:05:47.079 It's a twisted kind of customer service. 125 00:05:47.160 --> 00:05:49.680 Yeah, very twisted. Yeah. And then of course there was Lockie, 126 00:05:49.720 --> 00:05:52.439 which was like a master of disguise. 127 00:05:52.720 --> 00:05:56.480 Oh yeah. Lockie was constantly changing its tactics right to 128 00:05:56.519 --> 00:05:59.000 stay ahead of security measures, so it was really. 129 00:05:58.759 --> 00:06:01.399 Hard to detect. And then we have Serber, which would 130 00:06:01.399 --> 00:06:03.800 actually play audio messages demanding payment. 131 00:06:04.199 --> 00:06:06.240 I know, it's like something out of a horror. 132 00:06:05.959 --> 00:06:09.600 Movie, right, it's just adding insult to injury exactly. And 133 00:06:09.639 --> 00:06:13.040 the book also mentioned that Serber used configuration files to 134 00:06:13.160 --> 00:06:14.240 adapt its behavior. 135 00:06:14.439 --> 00:06:17.959 Yeah. Those configuration files allowed the attackers to modify Serber 136 00:06:18.000 --> 00:06:20.800 without having to rewrite the entire code, so. 137 00:06:20.759 --> 00:06:24.079 They can easily change things like the ransom amount or 138 00:06:24.120 --> 00:06:24.839 the files they. 139 00:06:24.759 --> 00:06:27.360 Were targeting, exactly, and made it a very flexible and 140 00:06:27.399 --> 00:06:28.319 adaptable threat. 141 00:06:28.879 --> 00:06:32.720 All right. So we've talked about scareware, screen lockers, and 142 00:06:33.000 --> 00:06:37.399 this whole world of crypto ransomware, but the book also 143 00:06:37.439 --> 00:06:41.000 mentions another category, boot ransomware. 144 00:06:41.199 --> 00:06:45.040 Oh yeah, those are nasty like petya. 145 00:06:45.680 --> 00:06:47.720 So what makes boot ransomware different. 146 00:06:47.480 --> 00:06:51.079 Well, boot ransomware targets the master boot record or MBR, 147 00:06:51.560 --> 00:06:54.319 which is basically what's needed to start your computer. So 148 00:06:54.439 --> 00:06:57.560 by infecting the NBR, Petya could lock down your entire 149 00:06:57.600 --> 00:07:00.560 system before Windows even had a chance to load. Oh wow, 150 00:07:00.639 --> 00:07:02.920 which made it incredibly difficult to remove. 151 00:07:03.040 --> 00:07:04.920 So you turn on your computer, yeah, and instead of 152 00:07:04.959 --> 00:07:06.399 seeing your desktop, you'd. 153 00:07:06.279 --> 00:07:07.160 Get a ransom note. 154 00:07:07.759 --> 00:07:10.560 Yeah, that's a nightmare, it is. Okay, we've covered a 155 00:07:10.560 --> 00:07:13.079 lot of ground here, we have. I'm already feeling a 156 00:07:13.120 --> 00:07:14.040 little overwhelmed. 157 00:07:14.040 --> 00:07:16.560 It's a lot to take in, I know, but you know, 158 00:07:16.920 --> 00:07:20.839 understanding these threats is the first step to protecting. 159 00:07:20.480 --> 00:07:23.079 Yourself, right, well said, I think we need a moment 160 00:07:23.120 --> 00:07:25.639 to just like digest all this before we move on. 161 00:07:25.800 --> 00:07:26.800 Yeah, good idea. 162 00:07:26.879 --> 00:07:28.959 All right, let's pick up where we left off, and 163 00:07:29.000 --> 00:07:30.360 I think it's time to talk about a couple of 164 00:07:30.439 --> 00:07:32.519 names that you know, really shook things up in the 165 00:07:32.519 --> 00:07:35.879 world of ransomware. Want to Cry and not Patya. 166 00:07:36.079 --> 00:07:37.720 Yeah, those were game changers. 167 00:07:37.800 --> 00:07:40.279 What made them so different from you know, everything else 168 00:07:40.279 --> 00:07:41.000 we've talked about. 169 00:07:41.000 --> 00:07:45.160 Well, Want to Cry back in twenty seventeen, really exposed 170 00:07:45.160 --> 00:07:47.360 how vulnerable a lot of systems were. 171 00:07:47.560 --> 00:07:51.639 The book called it a global panic inducer, and I remember, 172 00:07:51.759 --> 00:07:55.600 I mean it was everywhere. It was hospitals, businesses, governments. 173 00:07:56.240 --> 00:07:57.680 Nobody seemed to be immune to it. 174 00:07:57.920 --> 00:08:01.319 And that's because it exploited this vulnerability and a system 175 00:08:01.399 --> 00:08:03.680 that was used for file sharing. 176 00:08:03.560 --> 00:08:05.319 So it spread really easily. 177 00:08:05.279 --> 00:08:07.360 Yeah, like wildfire through networks. 178 00:08:07.480 --> 00:08:09.000 And I guess that's you know, one of the things 179 00:08:09.040 --> 00:08:09.680 that made it so. 180 00:08:09.720 --> 00:08:13.800 Scary, right, it showed how interconnected our digital world is yea, 181 00:08:14.000 --> 00:08:16.439 and how vulnerable we can be because of it. 182 00:08:16.879 --> 00:08:18.959 And one of the reasons it spread so quickly, as 183 00:08:19.000 --> 00:08:22.000 I understand it was this self spreading mechanism. 184 00:08:22.120 --> 00:08:25.800 Yeah, once it infected one system, it could automatically jump 185 00:08:25.879 --> 00:08:29.279 to other vulnerable computers on the same network. 186 00:08:29.279 --> 00:08:31.160 So no human interaction required. 187 00:08:31.279 --> 00:08:33.559 Nope, it was like a digital contagion. 188 00:08:33.360 --> 00:08:35.360 Just hopping from system to system. 189 00:08:35.159 --> 00:08:38.279 Exactly, and that made it incredibly difficult to contain. 190 00:08:38.600 --> 00:08:40.600 Yeah, by the time you realized you were infected, it 191 00:08:40.639 --> 00:08:42.960 could have already spread to who knows how many other 192 00:08:42.960 --> 00:08:46.480 systems exactly, So want to cry was bad enough. But 193 00:08:46.519 --> 00:08:49.600 then there's not Petya, which from what I read, wasn't 194 00:08:49.600 --> 00:08:51.159 even really about making money. 195 00:08:50.879 --> 00:08:53.360 That's right, Not Petya was much more destructive. Yeah, it 196 00:08:53.399 --> 00:08:56.080 was a wiper disguised as ransomware. 197 00:08:55.840 --> 00:08:57.840 So its goal was to destroy. 198 00:08:57.559 --> 00:08:59.919 Data exactly, not hold it hosted. 199 00:09:00.279 --> 00:09:01.240 That's just malicious. 200 00:09:01.320 --> 00:09:03.960 It was a very targeted and malicious attack. 201 00:09:04.320 --> 00:09:07.039 The book mentions how it went after the master file table, 202 00:09:07.480 --> 00:09:11.360 which honestly I don't fully understand. It's pretty technical, but 203 00:09:11.399 --> 00:09:14.360 the end result was basically mass chaos and damage. 204 00:09:14.440 --> 00:09:17.799 Right, Yes, yes, not Petia caused a lot of damage 205 00:09:17.840 --> 00:09:20.519 to businesses and organizations around the world. 206 00:09:20.279 --> 00:09:22.639 And it's spread using similar techniques as want to Cry. 207 00:09:22.840 --> 00:09:25.879 Right, Yeah, it exploited the same vulnerability, but its intent 208 00:09:26.039 --> 00:09:27.360 was purely destructive. 209 00:09:28.279 --> 00:09:33.440 So we've seen how ransomware has evolved from those early 210 00:09:33.519 --> 00:09:36.600 days to these global threats like want to Cry and 211 00:09:36.679 --> 00:09:40.000 not Pettia, and it's pretty clear that there's a serious 212 00:09:40.000 --> 00:09:41.120 problem that's not going. 213 00:09:40.879 --> 00:09:42.200 Away, not anytime soon. 214 00:09:42.440 --> 00:09:44.559 So let's shift gears a little bit and talk about 215 00:09:44.559 --> 00:09:48.240 how these attacks actually happen. How does ransomware get into 216 00:09:48.279 --> 00:09:49.399 our systems in the first place. 217 00:09:49.519 --> 00:09:52.559 That's a great question because understanding the methods of attack 218 00:09:52.720 --> 00:09:55.440 is the first step to defending yourself, right, and one 219 00:09:55.440 --> 00:09:58.399 of the most common ways ransomware gets in is through phishing. 220 00:09:58.639 --> 00:10:01.879 Fishing, that classic attack of tricking people into clicking on 221 00:10:01.960 --> 00:10:05.559 malicious links or opening infected attachments exactly. You know, it's 222 00:10:05.559 --> 00:10:08.399 been around foreverything else, but it's still incredibly effective. 223 00:10:08.559 --> 00:10:09.440 Why do you think that is? 224 00:10:09.879 --> 00:10:11.840 I mean, I guess it just plays on our human nature. 225 00:10:11.679 --> 00:10:15.799 Right, Exactly. It exploits our emotions fear, urgency, curiosity. 226 00:10:15.879 --> 00:10:18.799 Right. So the attackers will create these emails that look 227 00:10:18.879 --> 00:10:21.440 like they're from a bank, or a government agency, or. 228 00:10:21.399 --> 00:10:23.000 Even a trusted colleague. 229 00:10:22.840 --> 00:10:24.080 Yeah, someone you know and trust. 230 00:10:24.200 --> 00:10:25.559 Right. It's all about social. 231 00:10:25.240 --> 00:10:28.960 Engineering, manipulating people into letting their guard down exactly. So 232 00:10:29.080 --> 00:10:31.320 are there any red flags like things we can look 233 00:10:31.360 --> 00:10:34.399 out for to avoid falling victim to these phishing scams? 234 00:10:34.879 --> 00:10:39.919 Absolutely? First and foremost, be wary of any unsolicited emails. 235 00:10:39.679 --> 00:10:42.919 Like if you weren't expecting it, be suspicious. 236 00:10:42.399 --> 00:10:45.120 Right, especially those that create a sense of urgency or 237 00:10:45.480 --> 00:10:47.000 pressure you to act quickly. 238 00:10:47.320 --> 00:10:49.080 Oh yeah, those are always a red flag. 239 00:10:49.279 --> 00:10:51.879 Right. Also, take a moment to really look at the 240 00:10:51.919 --> 00:10:57.720 sender's email address. M hmmm, are there any misspellings inconsistencies? 241 00:10:58.399 --> 00:11:00.639 And don't click on any links and ntil you've hovered 242 00:11:00.639 --> 00:11:02.320 over them to see the actual URL. 243 00:11:02.519 --> 00:11:04.440 Yeah, if it looks suspicious, don't click. 244 00:11:04.639 --> 00:11:07.960 Okay, good advice. But it's not just fishing, right. 245 00:11:08.200 --> 00:11:12.440 No, there are other ways ransomware can get in, like what, well, 246 00:11:12.440 --> 00:11:14.399 they're these things called exploit kits. 247 00:11:14.840 --> 00:11:16.120 Exploit kits, what are those? 248 00:11:16.240 --> 00:11:21.919 They're basically automated tools that scan for vulnerabilities in your software, okay, 249 00:11:22.120 --> 00:11:26.000 and then deliver tailored exploits to take advantage of those weaknesses. 250 00:11:26.279 --> 00:11:29.279 So it's like they're scanning your system for any cracks 251 00:11:29.320 --> 00:11:29.919 in your armor. 252 00:11:30.200 --> 00:11:31.240 That's a good way to put it. 253 00:11:31.200 --> 00:11:33.960 And then they exploit those cracks exactly. And these exploit 254 00:11:34.039 --> 00:11:36.639 kits they're constantly evolving, right they are. 255 00:11:36.759 --> 00:11:41.039 They're always incorporating new exploits as vulnerabilities are discovered. 256 00:11:41.320 --> 00:11:43.639 So it's like an arms race, it is between the 257 00:11:43.679 --> 00:11:45.480 attackers and the defenders exactly. 258 00:11:45.519 --> 00:11:49.120 And that's why it's so important to keep your software updated, right. 259 00:11:49.200 --> 00:11:52.799 Those updates, those pesky updates that we all hate, but 260 00:11:52.879 --> 00:11:56.240 they're crucial. They're not just about new features. They're often 261 00:11:56.399 --> 00:11:58.759 patching those vulnerabilities. 262 00:11:58.039 --> 00:11:59.919 Right, the ones that could be exploited by rants. 263 00:12:00.720 --> 00:12:03.799 So update your software people, please, It could save you 264 00:12:03.879 --> 00:12:04.679 a lot of trouble. 265 00:12:05.200 --> 00:12:05.600 It could. 266 00:12:05.720 --> 00:12:07.759 And then there's another way ransomware can get in. 267 00:12:08.279 --> 00:12:09.799 There is that's. 268 00:12:09.639 --> 00:12:11.919 Even more passive. These drive by downloads. 269 00:12:12.000 --> 00:12:13.759 Oh, drive by downloads, Yeah, those. 270 00:12:13.600 --> 00:12:15.559 Are scary one of those exactly. 271 00:12:15.639 --> 00:12:20.039 Well. Imagine you're visiting a website. Okay, seems harmless enough, right, Yeah, 272 00:12:20.080 --> 00:12:24.240 You're browsing for information, maybe shopping online, and suddenly, without 273 00:12:24.279 --> 00:12:28.159 even clicking on anything, your computer's infected with ransomware. 274 00:12:28.440 --> 00:12:31.240 Wait what I thought you had to download something or 275 00:12:31.240 --> 00:12:34.120 click on a link. Not always, that's terrifying. 276 00:12:34.440 --> 00:12:34.960 It can be. 277 00:12:35.240 --> 00:12:37.200 So just visiting a website can. 278 00:12:37.120 --> 00:12:40.039 Be risky to a certain extent. 279 00:12:40.159 --> 00:12:43.480 Yes, but there are ways to mitigate these risks, right, absolutely. 280 00:12:43.559 --> 00:12:48.279 It's all about understanding the threats, yeah, and taking appropriate precautions. 281 00:12:48.480 --> 00:12:51.519 Okay, so let's talk about those precautions. All right, what 282 00:12:51.559 --> 00:12:55.440 can we do to protect ourselves from this ever evolving 283 00:12:55.519 --> 00:12:56.639 threat of ransomware. 284 00:12:56.960 --> 00:12:59.919 Well, let's start with the basics. Operating system hardening. 285 00:13:00.320 --> 00:13:02.159 Operating system hardening, what's that? 286 00:13:02.720 --> 00:13:05.240 It might sound complicated, yeah, but it's really just about 287 00:13:05.240 --> 00:13:08.600 making your system less vulnerable to attack. Okay, So this 288 00:13:08.679 --> 00:13:10.519 includes things like disabling. 289 00:13:10.039 --> 00:13:11.320 Auto un auto run. 290 00:13:11.360 --> 00:13:15.000 What does that do that prevents programs from automatically launching 291 00:13:15.039 --> 00:13:19.399 from external devices. Oh yeah, you should also use strong passwords. 292 00:13:18.919 --> 00:13:20.480 Right, passwords that are hard. 293 00:13:20.360 --> 00:13:23.639 To guess exactly, And of course keep your system patched 294 00:13:23.639 --> 00:13:25.159 with the latest security updates. 295 00:13:25.240 --> 00:13:26.679 Those pesky updates. 296 00:13:26.320 --> 00:13:28.559 Again, I know, but they're important, right. 297 00:13:28.600 --> 00:13:31.039 All right, So we've got the basics covered. But what 298 00:13:31.120 --> 00:13:34.639 about antivirus software. Isn't that enough to protect us? 299 00:13:34.720 --> 00:13:38.200 Anti virus is important. Yeah, it's a key layer of defense, 300 00:13:38.480 --> 00:13:40.360 but it's not a fool proof solution. 301 00:13:40.600 --> 00:13:43.240 So it's not like a magic shield that will block everything. 302 00:13:43.440 --> 00:13:44.559 No, unfortunately not. 303 00:13:44.759 --> 00:13:45.080 Why not? 304 00:13:45.519 --> 00:13:50.559 Well, traditional antivirus relies on signatures to detect known threats, okay. 305 00:13:50.919 --> 00:13:54.840 And while that can be effective against some ransomware variants, yeah, 306 00:13:55.080 --> 00:13:59.279 more sophisticated attackers can evade signature based detection. 307 00:13:59.399 --> 00:14:02.960 So they find ways to sneak past the antivirus exactly. 308 00:14:03.559 --> 00:14:06.639 But the book does talk about how antivirus has evolved 309 00:14:06.879 --> 00:14:09.919 to try and combat these more advanced threats. It has like, 310 00:14:10.000 --> 00:14:12.159 what are some of the things that antivirus is doing 311 00:14:12.200 --> 00:14:14.120 now to keep up with the bad guys. 312 00:14:14.440 --> 00:14:19.840 Well, modern antivirus solutions are incorporating more sophisticated techniques, okay, 313 00:14:20.080 --> 00:14:24.399 like heuristics, which involves analyzing code for suspicious patterns, okay, 314 00:14:24.440 --> 00:14:28.840 and behavioral analysis, which monitors how programs behave on your system. 315 00:14:28.960 --> 00:14:32.039 So it's not just about looking for specific files anymore. 316 00:14:31.759 --> 00:14:35.159 Right, it's about recognizing patterns and behaviors that might indicate 317 00:14:35.480 --> 00:14:36.480 malicious intent. 318 00:14:36.840 --> 00:14:38.879 So it's like they're trying to think like the attackers 319 00:14:38.919 --> 00:14:42.559 in a way. And in addition to antivirus, Windows itself 320 00:14:42.639 --> 00:14:45.960 has built in security features that can help protect against ransomware. 321 00:14:46.120 --> 00:14:49.399 Yeah, there are some really useful features like what. Well, 322 00:14:49.720 --> 00:14:54.480 there's DP, which stands for Data Execution Prevention that prevents 323 00:14:54.519 --> 00:14:56.960 code from being executed in areas of memory that are 324 00:14:57.000 --> 00:14:57.960 meant for data. 325 00:14:57.759 --> 00:14:59.960 Storage, all right, and that helps how. 326 00:15:00.039 --> 00:15:03.519 It makes it harder for exploits to target key system components. 327 00:15:03.600 --> 00:15:04.799 Okay. And there's another one. 328 00:15:04.720 --> 00:15:07.720 Right, Yeah, there's ASLR, which stands for a dress space 329 00:15:07.799 --> 00:15:12.679 layout Randomization Address space layout what randomization. It basically makes 330 00:15:12.720 --> 00:15:16.200 it more difficult for exploits to find and target specific 331 00:15:16.240 --> 00:15:17.279 memory locations. 332 00:15:17.600 --> 00:15:19.639 So it's like they're constantly moving the target. 333 00:15:20.039 --> 00:15:21.600 Yeah, that's a good way to think about it. 334 00:15:21.639 --> 00:15:23.320 So I'm guessing it's a good idea to keep these 335 00:15:23.320 --> 00:15:24.600 features enabled. 336 00:15:24.360 --> 00:15:26.320 Absolutely they add an extra layer of protection. 337 00:15:26.480 --> 00:15:29.679 Okay, good to know. And if you're using Windows eight 338 00:15:29.799 --> 00:15:32.240 or later, there's another feature called secure boot. 339 00:15:32.639 --> 00:15:34.559 Oh yeah, secure boot is great. 340 00:15:34.960 --> 00:15:36.200 What does that do well? 341 00:15:36.200 --> 00:15:39.879 It's designed to prevent attacks that target the boot process 342 00:15:40.120 --> 00:15:43.480 like petya exactly. It verifies the integrity of the bootloader, 343 00:15:43.480 --> 00:15:46.600 which is the program that starts your operating system. So 344 00:15:46.639 --> 00:15:50.559 it makes sure that only trusted software is loaded during startup. 345 00:15:50.840 --> 00:15:53.120 So it's like having a bouncer at the door checking 346 00:15:53.159 --> 00:15:56.879 IDs to make sure only authorize guests get in exactly. 347 00:15:57.039 --> 00:15:59.960 And speaking of gatekeepers, we can't forget about. 348 00:15:59.720 --> 00:16:02.360 Fire Oh yeah, firewalls are essential. 349 00:16:02.840 --> 00:16:05.200 Everyone's heard of them, right, but I'm not sure everyone 350 00:16:05.279 --> 00:16:07.519 understands how they actually work. Well. 351 00:16:07.879 --> 00:16:11.200 They act as a barrier between your computer or network 352 00:16:11.360 --> 00:16:15.960 and the outside world, monitor and control network traffic, blocking 353 00:16:16.000 --> 00:16:21.440 incoming connections from suspicious sources and preventing unauthorized access to 354 00:16:21.480 --> 00:16:22.039 your system. 355 00:16:22.600 --> 00:16:27.279 So they're basically filtering traffic based on certain rules exactly. 356 00:16:26.840 --> 00:16:29.960 Like who's allowed to connect and what ports they can use. 357 00:16:30.279 --> 00:16:33.080 So they're like a security checkpoint inspecting the traffic. 358 00:16:33.120 --> 00:16:34.159 That's a good analogy. 359 00:16:34.720 --> 00:16:37.960 The book talks about different types of firewalls. Yeah, network 360 00:16:38.000 --> 00:16:41.200 firewalls and host based firewalls. What's the difference. 361 00:16:41.360 --> 00:16:45.000 Well, a network firewall protects your entire network, okay, it 362 00:16:45.039 --> 00:16:48.320 filters traffic between your internal network and the outside world. 363 00:16:48.519 --> 00:16:50.519 So it's like having a security guard at the entrance 364 00:16:50.559 --> 00:16:53.679 to your building exactly, checking everyone who comes in and out. 365 00:16:54.080 --> 00:16:55.840 And a host based firewall. 366 00:16:55.480 --> 00:16:58.919 That's installed on your individual computer so it protects that 367 00:16:58.960 --> 00:16:59.960 specific device. 368 00:17:00.080 --> 00:17:02.840 So it's like having a personal bodyguard exactly. So having 369 00:17:02.879 --> 00:17:06.480 both types of firewalls is ideal. Ideally, Yeah, it provides 370 00:17:06.519 --> 00:17:08.359 a more comprehensive layer of protection. 371 00:17:08.599 --> 00:17:08.839 Right. 372 00:17:09.039 --> 00:17:12.440 And in addition to firewalls, there are also intrusion detection 373 00:17:12.599 --> 00:17:13.720 and prevention systems. 374 00:17:14.440 --> 00:17:18.720 Oh yeah, idips SIPs. What are those, Well, think of 375 00:17:18.759 --> 00:17:22.079 them as the traffic cops of your network, Okay. They 376 00:17:22.119 --> 00:17:27.200 analyze network traffic for suspicious patterns that might indicate and attack, so. 377 00:17:27.160 --> 00:17:29.720 They're like looking for anything out of the ordinary, exactly. 378 00:17:29.839 --> 00:17:32.160 They come in two flavors, right, IDs and IPS. 379 00:17:32.240 --> 00:17:35.960 Right. An IDs passively monitors traffic and alerts you to 380 00:17:36.039 --> 00:17:40.799 potential threats, okay, while an IPS can actively block malicious traffic. 381 00:17:40.960 --> 00:17:44.559 So they're like having surveillance cameras and security guards working together. 382 00:17:44.680 --> 00:17:45.599 That's a good analogy. 383 00:17:45.680 --> 00:17:48.160 And the book mentions something called Snort signatures. How do 384 00:17:48.160 --> 00:17:48.680 those fit in? 385 00:17:48.880 --> 00:17:53.880 Well? Snort is a popular open source intrusion detection system, okay, 386 00:17:53.920 --> 00:17:58.599 and it uses rules called signatures to identify malicious traffic. 387 00:17:58.680 --> 00:18:01.960 Oh okay, So these rules define patterns of network activity 388 00:18:01.960 --> 00:18:04.799 that are associated with known attacks or exploits. 389 00:18:04.920 --> 00:18:06.319 So if the traffic matches a. 390 00:18:06.319 --> 00:18:08.359 Rule, Snort raises a red flag. 391 00:18:08.440 --> 00:18:11.119 Okay. So it's like having a security camera that's programmed 392 00:18:11.119 --> 00:18:17.880 to recognize suspicious behavior exactly. Okay, So we've got anti virus, firewalls, 393 00:18:17.960 --> 00:18:21.400 intrusion detection systems, the law, I know it is, but 394 00:18:21.680 --> 00:18:23.799 it sounds like we're building up quite a security arsenal 395 00:18:23.799 --> 00:18:28.960 here we are. What about dealing with like suspicious files? 396 00:18:29.079 --> 00:18:29.400 Okay? 397 00:18:29.440 --> 00:18:31.079 You know, if you come across a file that you 398 00:18:31.119 --> 00:18:33.799 think might be infected, is there a way to analyze 399 00:18:33.839 --> 00:18:35.799 it safely without risking infection? 400 00:18:36.160 --> 00:18:36.720 There is? 401 00:18:36.839 --> 00:18:39.000