Re:A Hidden Cost of Ransomware: Wholesale Password Theft
by SturgeonsLaw on Thursday January 09, 2020 @08:44AM
(#22001071)
> Isn't it should have root/admin privieleges to do such thing?
There are a lot of networks out there with fileshares configured far more permissively than they should be. Additionally, if the malware infects a machine that has cached domain admin credentials stored on it, it can use those to authenticate to the rest of the network and own the entire domain.
Yes, if best practice is followed, these tactics wouldn't work. Best practice is not always followed.
There are a lot of networks out there with fileshares configured far more permissively than they should be. Additionally, if the malware infects a machine that has cached domain admin credentials stored on it, it can use those to authenticate to the rest of the network and own the entire domain.
Yes, if best practice is followed, these tactics wouldn't work. Best practice is not always followed.