That PowerShell 'fix' for your root cert 'problem' is a malware loader in disguise Crafty criminals are targeting thousands of orgs around the world in social-engineering attacks that use phony error messages to trick users into running malicious PowerShell scripts. This latest Windows malware distribution campaign uses fake Google Chrome, Microsoft Word, and OneDrive error messages that look kinda like …
So, for home users:
Despite my mum programming mainframes in 1970 before she had me, my dad is on the polar opposite of the IT spectrum, and needs help with some tasks. However, instilling a sense of cynicism has actually kept him safe: he calls when there's a pop up, or dodgy looking email. Even when I forgot to update my credit card details for GSuite, he called immediately
It's taken a while to get to this point, but I'm proud of him for not falling foul of such miscreants
For enterprise users:
My company runs frequent phishing campaigns which have taught the workforce really good internet hygiene. But, shockingly, despite being referred to training should you click on link, there are still those amongst us which do it. It has been effective, though
Why are links you shouldn't click on appearing on the desktop at all? There are perfectly good and well established ways of preventing this happening. Relying on the least technically expert echelon as your first line of defence is (apologies for the jargon) just stupid.
> "don't ever act on any online prompts to.......
But it wasn't online. It was on my computer. My computer is always sending me messages about one thing or another.
Seriously? I grew up hacking, and it is not always instantly clear to me how to vet the many things my computer complains about. My father was in at the beginning but toward his end he got fooled once we know of.
Well said.
I have a friend who often tells me "I got this or that on my computer today"
I have to explain to him that he's seeing something on the INTERNET not on his computer and reiterate the dangers of accepting it.
Fortunately, he's learned to ask the right questions BEFORE he clicks on unknown "stuff"
hahaha, simply amazing and quite frankly well deserved for the morons who will fall for it. They deserve everything they get for being stupid enough to run some random bit of code suggested by a pop up on that virus/trojan delivery system that masquerades as an operating system, let alone using it for anything important. Yet again exposing it for the piece of garbage it is that it even allows things like this to happen.
Oh good, that means you know of an operating system that would prevent someone knowingly pasting code into an admin or root CLI from causing damage. Please tell me what it is. I've got a couple versions of Windows, Mac OS, about a dozen Linuxes, and a few BSDs and none of them can do it, so I'm always interested in an idiot-proof and even a malice-proof OS. Of course, your critique means you have such a thing, right? Not that you have no clue what you're talking about and want to castigate someone you dislike for something that everything would be vulnerable to?
I've received emails that look plausible enough for me to give at least half a thought they might be real and so to clicking a link. I haven't- but only because I'm allergic to links in emails and they make my paranoia flare up something terrible.
But I'm mid-60s, have been using computers for half a century, and been training people on how to use PCs for much of the last 40 years. And if I'm not convinced I'd never get caught, the odds that a two fingered Excel pilot would get caught by a carefully crafted hook are close to certainty.
We aren't terribly far from this:
You have just received the Amish virus. Since we have no electricity or computers, you are on the honor system. Please delete all of the files on your hard drive. Then forward this message to everyone in your address book.
--Thank thee
IF I were a bad actor looking to target a specific segment, such as those with elevated privileges, this type of attack might be perfect. Hear me out on this before you lambast me with criticism. Clearly this attack should not work on seasoned System Admins, PKI Admins, cryptographic gurus etc. BUT....There are millions of small and medium businesses out there who have one overworked system admin or worse yet an "IT Guy" who is also the shipping manager and the building coordinator whose job it is to keep the computers running. Even if these unfortunate souls have a little formal training on Windows Servers its very likely that they have no training on the black magic that we call cryptography or certificate servers or PKI. In fact I will bet you my private key that they run from the topic because the one thing they know is that a certificate problem can have major impacts and they don't want to be embarrassed when they don't know how to fix it. Sooooooo, if you made the bait look official and like something MS or GoDaddy or CISA would put out about fixing a certificate error, Bob's your uncle your in, at least with some. Then once you own the SMB you can see what deep pockets targets the SMB has connectivity to. --- Just a Thursday morning thought-- MuleD
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
