A global computer outage occurred due to a faulty update on CrowdStrike's Falcon endpoint protection platform, impacting 8.5 million Microsoft systems. This led to disruptions in 911 services, airlines, banking, and more, with an estimated recovery cost of over $4.5 billion. However, I will not delve into the causes of this incident in this article.
You may be familiar with the saying, "Never let a crisis go to waste." This concept can be traced back to Niccolo Machiavelli, who noted that a crisis presents an opportunity. If there were ever a group that embodied this idea, it would be malicious hackers.
How did the black hat hacker community react to this severe outage?
Phishing Attacks: Cybercriminals are exploiting the chaos and urgency caused by the outage to launch phishing campaigns. They are sending deceptive emails appearing to be from CrowdStrike or related entities, urging recipients to click on harmful links or provide sensitive information under the guise of security updates or support.
Social Engineering: Attackers are employing social engineering tactics to deceive individuals into sharing credentials or installing malware. They may impersonate IT support or CrowdStrike representatives, taking advantage of heightened concerns during the outage to gain trust and access.
Exploiting Unpatched Systems: Some systems might remain unpatched or inadequately monitored during the outage. Malicious actors are scanning for these vulnerable systems to launch attacks, such as installing ransomware or other malware.
Supply Chain Attacks: Given the disruption affecting various companies, attackers might target third-party vendors or suppliers impacted by the outage, attempting to breach them and then move laterally to other connected organizations.
Disinformation Campaigns: Malicious actors are spreading false information about the outage to incite panic or mislead organizations about the status of their systems and the necessary steps to secure them. This can lead to incorrect responses and further vulnerabilities.
CrowdStrike has advised all affected parties to remain vigilant, use official communication channels, and verify the authenticity of any support communications to mitigate these risks.
The key lesson is that malicious actors are always seeking opportunities in chaos to strike. Therefore, it's crucial to have precise and well-practiced business continuity plans in place, allowing your company to operate during a computer outage, along with a disaster recovery plan to safeguard your organization as you return to normal operations. Responding to major disruptions is vital for both short-term and long-term success. The hackers are counting on panic and lowered defenses, so it is essential to be prepared.
コメント