https://cybernews.com/news/ikea-posted-ransomware-gang/

<quote>
"IKEA Morocco and Kuwait faced a cyber attack, causing disruptions on
some operating systems. The attack is being investigated in
collaboration with the competent authorities as well as our
cybersecurity partners," the company said in a Twitter post in French.
</quote>

I assume that "some operating systems" does not include VMS.

But does anyone know?

Arne

On 08/12/2022 00:09, Arne Vajhøj wrote:
> https://cybernews.com/news/ikea-posted-ransomware-gang/
>
> <quote>
> "IKEA Morocco and Kuwait faced a cyber attack, causing disruptions on
> some operating systems. The attack is being investigated in
> collaboration with the competent authorities as well as our
> cybersecurity partners," the company said in a Twitter post in French.
> </quote>
>
> I assume that "some operating systems" does not include VMS.
>
> But does anyone know?
>
> Arne

Interesting question. It appears from what I have read that there is a
lot of ransomware which targets files on SMB shares, and I expect these
would find and encrypt anything shared from a VMS box by Pathworks for
example.

Does this mean VMS is affected?

Given the ubiquity of SMB is there anything that could be done?

Dave

On Thu, 2022-12-08 at 08:12 +0000, David Wade wrote:

> Given the ubiquity of SMB is there anything that could be done?

Yes, stop usuing SMB1, use SMB3 instead.

--
Tactical Nuclear Kittens

Single Stage to Orbit <alex.buell@munted.eu> wrote:
> On Thu, 2022-12-08 at 08:12 +0000, David Wade wrote:
>
>
>> Given the ubiquity of SMB is there anything that could be done?
>
> Yes, stop usuing SMB1, use SMB3 instead.

Which would magically protect against files being encrypted via a
machine/user with r/w access to the share exactly how?

Just wondering,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison

On Fri, 2022-12-09 at 15:05 +0100, Alexander Schreiber wrote:
> > > Given the ubiquity of SMB is there anything that could be done?
> >
> > Yes, stop usuing SMB1, use SMB3 instead.
>
> Which would magically protect against files being encrypted via a
> machine/user with r/w access to the share exactly how?

That would be most unfortunate, I agree but moving to SMB3 gives
greater security and if rights and/or permissions were set correctly,
the damage could be limited.
--
Tactical Nuclear Kittens

On 2022-12-09 14:05:56 +0000, Alexander Schreiber said:

> Single Stage to Orbit <alex.buell@munted.eu> wrote:
>> On Thu, 2022-12-08 at 08:12 +0000, David Wade wrote:
>>
>>> Given the ubiquity of SMB is there anything that could be done?
>>
>> Yes, stop usuing SMB1, use SMB3 instead.
>
> Which would magically protect against files being encrypted via a
> machine/user with r/w access to the share exactly how?

I'll here assume this reply was intended as a serious posting, and not
as a troll.

Yes, ditching SMB1 will absolutely help, as it's hideously insecure.
Unfortunately for those folks still necessarily using PATHWORKS Server
/ CIFS / Advanced Server, ditching SMB1 can be a problem. The OpenVMS
Samba port can help:
https://vmssoftware.com/docs/samba-release-notes.pdf

The OpenVMS Samba port is 4.10-16A, while Samba 4.17.3 is current. And
there are security fixes, though whether those also effect OpenVMS I've
not checked.

Is the removal of SMB1 the only thing that needs to be addressed to
improve security? No. Of course not. But it helps, as Ned Pyle will
absolutely tell you.
https://techcommunity.microsoft.com/t5/storage-at-microsoft/stop-using-smb1/ba-p/425858

As for the IKEA breach, it's apparently involving spearphishing, and
the attackers reportedly have more than a foothold in the IKEA networks
and servers.

Of what is reported about the IKEA breach:
https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/

How much we might eventually learn about the details of the IKEA
breach? How much IKEA might discuss with VSI, assuming OpenVMS issues
or exploits are identified and involved in the breach?

Rackspace had an apparently catastrophic hosted Exchange Server Breach
recently, too. Details:
https://www.rackspace.com/newsroom/rackspace-technology-hosted-exchange-environment-update

Mail servers, directory servers, and network servers more generally are
complex, and failures are bad. Related: https://beyondcorp.com

With OpenVMS, there are various things that the OpenVMS staff, and the
organization's network and security operations staff, should be aware
of potential SMB1 usage included, and also including POP and IMAP
support issues, network service reflection attacks, everybody's
favorite iLO password-revealing mess, the ill-considered open-relay
default of the SMTP mail server, and a variety of other
OpenVMS-specific topics, and of course many other and more generic
topics. Because while SMB1 might not be part of any particular security
attack, it could be.

--
Pure Personal Opinion | HoffmanLabs LLC

On 12/9/2022 9:05 AM, Alexander Schreiber wrote:
> Single Stage to Orbit <alex.buell@munted.eu> wrote:
>> On Thu, 2022-12-08 at 08:12 +0000, David Wade wrote:
>>> Given the ubiquity of SMB is there anything that could be done?
>>
>> Yes, stop usuing SMB1, use SMB3 instead.
>
> Which would magically protect against files being encrypted via a
> machine/user with r/w access to the share exactly how?
>
> Just wondering,

Ditching SMB1 does not help if the attack is
using intended file access on a file share.

Ditching SMB1 helps a lot if the attack is based
on one of the known vulnerabilities in SMB1.

Arne

On 12/9/2022 4:37 PM, Stephen Hoffman wrote:
> On 2022-12-09 14:05:56 +0000, Alexander Schreiber said:
>> Single Stage to Orbit <alex.buell@munted.eu> wrote:
>>> On Thu, 2022-12-08 at 08:12 +0000, David Wade wrote:
>>>> Given the ubiquity of SMB is there anything that could be done?
>>>
>>> Yes, stop usuing SMB1, use SMB3 instead.
>>
>> Which would magically protect against files being encrypted via a
>> machine/user with r/w access to the share exactly how?

> Yes, ditching SMB1 will absolutely help, as it's hideously insecure.

It help for some security problems, but not for the one described.

> Is the removal of SMB1 the only thing that needs to be addressed to
> improve security? No. Of course not. But it helps, as Ned Pyle will
> absolutely tell you.
> https://techcommunity.microsoft.com/t5/storage-at-microsoft/stop-using-smb1/ba-p/425858

As always there are a lot of things to do to secure a system, but
getting rid of SMB1 should be part of it.

> As for the IKEA breach, it's apparently involving spearphishing, and the
> attackers reportedly have more than a foothold in the IKEA networks and
> servers.
>
> Of what is reported about the IKEA breach:
> https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/

That was last year.

Is it the same this year?

Arne

On 2022-12-09 23:53:55 +0000, Arne Vajhj said:

> On 12/9/2022 4:37 PM, Stephen Hoffman wrote:
>> On 2022-12-09 14:05:56 +0000, Alexander Schreiber said:
>>> Single Stage to Orbit <alex.buell@munted.eu> wrote:
>>>> On Thu, 2022-12-08 at 08:12 +0000, David Wade wrote:
>>>>> Given the ubiquity of SMB is there anything that could be done?
>>>>
>>>> Yes, stop usuing SMB1, use SMB3 instead.
>>>
>>> Which would magically protect against files being encrypted via a
>>> machine/user with r/w access to the share exactly how?
>
>> Yes, ditching SMB1 will absolutely help, as it's hideously insecure.
>
> It help for some security problems, but not for the one described.

I'll concede that this is not the worst possible problem, of all
possible problems.

SMB1 is a problem that no network should have.

But then this is comp.os.vms, and arguing for the removal of telnet,
FTP, and SMB1 is viewed as traumatic change for some.

>> Of what is reported about the IKEA breach:
>> https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/
>>
>
> That was last year.
>
> Is it the same this year?

Ah, my bad.

Here are some of the recent reported IKEA-related security breaches:
2019:
https://cyware.com/news/ikea-inadvertently-exposed-over-400-email-addresses-due-to-human-error-e14e9f38

2022:
https://globalnews.ca/news/8812708/ikea-canada-internal-data-breach-95000-records/

2022:
https://www.techradar.com/news/ikea-confirms-it-was-hit-in-significant-cyberattack
(which lists Morocco, Kuwait and maybe Jordon, and apparently
franchises.)

--
Pure Personal Opinion | HoffmanLabs LLC