When Office Printers Join Organised Crime

Imagine walking into your office to find all systems locked and the printer spewing ransom notes. This episode of SBCSG Hot Take, hosted by Noel Bradford, explores two significant security breaches. The first organisation made classic mistakes: exposed Remote Desktop and disabled endpoint protection. Attackers used BitLocker to encrypt data, demonstrating how tools meant for protection can be turned against the business. The second business fared worse, misconfiguring an SQL server and leaving credentials exposed, allowing intruders to linger for months. Noel emphasises the importance of response over mere alerts and how organisational oversight often contributes more to breaches than sophisticated hacking tools.

Chapters

• Cold Open A dramatic opening describes ransomware printed from office printers.
• They Did Not Hack the Printer First Kaspersky’s investigation reveals exposed Remote Desktop led to the breach.
• The Protection Had Been Disabled Endpoint protection was disabled due to ‘compatibility issues’, leading to a breach.
• The Second Business Somehow Did Worse A misconfigured SQL server with public credentials allowed attackers entry.
• The Alerts Worked Security alerts were raised but ignored, demonstrating response gaps.
• The Attackers Used Proper IT Tools Attackers used legitimate IT tools instead of custom weapons.
• Then They Destroyed the Evidence In incident response haste, evidence was destroyed, complicating investigations.
• The Ransom Was Almost Sensible A modest ransom demand hinted at a pragmatic cybercrime model.
• The Printer Is Still Guilty Printers, as networked devices, remain security risks despite appearing benign.
• The Hot Take The breaches highlight organisational security failings, not hacker genius.
• Close The episode concludes with irony as the printer finally functions faultlessly.

Links

• https://www.kaspersky.com