Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

Re:Massachusetts Steamship Authority hit by ransomware attac... by dopidopHN on Wednesday June 02, 2021 @11:13PM (#27376845)

But then who whitelist the whitelister?

Solarwind was fun for that. They provide safe update of signed binaries . But their build system is corrupt, builds tampered stuffs and sign them.

I’m a just a user of those things: it seams that cryptography is not what is breaking the chain of trust. It’s the usage? But go fix phishing.

Maybe gov agencies should opt in for some tightly manage environments?

[ Parent | on HN ]

Re:Massachusetts Steamship Authority hit by ransomware attac... by viraptor on Thursday June 03, 2021 @12:05AM (#27377108)

Windows application whitelisting in this context means your own list based on either paths or hashes of executables. https://www.bleepingcomputer.com/tutorials/create-an-applica...

But you're right that it wouldn't help with the solarwind situation. Once installed and given privileges, a trusted app can do whatever it wants.

[ Parent | on HN ]