Firms that didn’t patch and enabled local admin rights continue to suffer post cyber-attack

Here’s a salutary reminder for all businesses.

Just because a malware outbreak has begun to fade away from the newspaper headlines, doesn’t mean your troubles are over.  Many firms can continue to suffer long afterwards.

In late June, a malware attack crippled businesses and critical infrastructure in Ukraine at astonishing speed.

Initially suspected of being a similar ransomware attack to the WannaCry outbreak seen the month before, the malware (variously named as Petya, NotPetya or GoldenEye by security vendors) appears to have been launched through a malicious automatic update to a popular Ukrainian accounting software tool called MeDoc.

We tell companies all the time to keep their software updated with the latest available patches, and yet here was an update which actually delivered a devastating malware attack.  The irony isn’t lost on anybody.

Once in place on an infected PC, the malware would spread to other networked computers, using a variety of lateral movement techniques.

And it didn’t take long for GoldenEye to spread beyond Ukraine’s borders, hitting the of offices of multinational companies in the United States, UK, Russia, France, Germany and elsewhere.

Organisations that continue to feel the pain include advertising giant WPP, household goods manufacturer Reckitt Benckiser, and world’s largest shipping company Maersk.

As The Register reports, a number of WPP’s agencies remained locked out of their networks last week, as the company struggled to safely return services to normal.  Meanwhile, insiders have claimed that IT support has suffered since being out-sourced, leaving some WPP agencies without critical Windows patches for six months and an alarming number of users granted local admin rights.

The truth is that lax patching, a lack of network segmentation and local admin rights are a recipe for security disaster.

This isn’t a secret – every IT security team worth its salt knows that it is taking a risk by granting users local admin rights – but on too many occasions an IT support technician will choose to enable local admin rights if an application is failing to work properly, rather than resolve the problem by seeking a fixed version of the program.

Making your company resilient against future malware attacks means adopting a layered approach, and sometimes taking some tough decisions.  Sometimes there may not immediately appear to be a good return on “doing things properly”, but you’ll certainly feel the pain if one day a malware attack takes advantage of your lax security.

Don’t take short cuts now that may cost you in the long run.

Download Bitdefender’s white paper: Everything we know about GoldenEye/NotPetya