Next 2022 Can We Escape Ransomware by Migrating to the Cloud?

Security. Hi there. Welcome to another special edition of the Cloud Security Podcast by Google. Your hosts today, as ever, are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered to you piping hot every Monday or whenever we have a special episode, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we're talking about a fun but kind of sad because of how prevalent and damaging it is topic today, that being ransomware.

Yes, indeed. And I think ransomware did make an appearance quite a few times in our show, but we never quite did an episode mostly focused on ransomware. And in this case, that's this episode as a part of our next 2022 series, right?

I think what's so interesting about this episode is we really get into some of the nuances of on-prem ransomware, ransomware in the cloud, ransomware of the cloud. Really fascinating and good in-depth discussion.

And I think that the discussion managed to go pretty dark at one point.

Yes.

But it didn't hit the darkest spots. Like, remember the other episode when somebody said, Wait a second. Did you know that, I don't know, high percentage of victims of ransomware actually pay, and then they pay twice?

Yep.

I remember that made me really sad that day.

Yeah, the other episode that made me really sad was the thought that people could trick self-driving cars into running me over on the street. I didn't like that thought either. So perhaps, listeners, with these jolly topics behind us, let's welcome today's guest. Today, we're joined by Nellie Kassam, a security and compliance specialist here at Google Cloud. Nellie, we're talking about a tragic topic, but also an interesting one for many security professionals. We're talking about Ransomware. When did ransomware get to be just so popular? What's going on with that?

So to put the hand on it, it's difficult. When did it start? Vestige of ransomware a while back, maybe 20 years back, but it became an issue, I think publicly, maybe 2020. This is when you started to really see companies suffering from it almost every year.

Right. And I think it's a funny example. When I was reading one of the threat reports, it turns out that people have been attempting to launch the ransomware business as far back as maybe 2015. But you're right. So you can see traces of ransomware as far back as 2015. But you're right, it became frontline news, I think, in 2020, right? A big deal.

And it became extremely popular because from the attacker's perspective, it's a direct financial profit situation. Like, you can make money out of it just like that. I think I've seen reports that in the last year, it was over $580 million that were swindled via ransomware. So that on its own is a huge business, right?

Hold on, say that number again.

$590 million.

Wow, that is a lot.

But Tim, keep in mind, it's not the money swindled or money lost. It's the other side that's scary, right? There's a bad guy or a set of bad guys somewhere who has that money in their pocket. The scary part is not that many businesses worldwide lost $500 mil. It's there's somewhere bad guys with $500 mil in their pocket. That's the scary part. That's true.

And it also gives you an idea of how much they can invest in it, right? We're not talking about the low-hanging fruits anymore. We're talking about people going after systematically getting access or causing harm at a company's system. And because it brings so much money, they can then invest so much time in it and so many resources. So you basically have attackers who work for a living on ransomware. They wake up, they go to the office, They try to get access, and they try to cause harm. And, you know, they go back. You know, they work from 5 to 8.

So I wanted to switch gears a little bit, maybe make a bit of a revelation, a little bit about myself. A few years ago, I assumed that ransomware would mostly affect organizations with subpar security. And I sort of assumed that ransomware is kind of— I guess the politically incorrect way to say it would be like it's a poor people's problem. It's not the problem of well-protected enterprises. But I ended up being completely wrong. It was a bad take. It is not the reality. So do we know more about what organizations are affected by ransomware? Like, what types of businesses, government agencies?

So the reports that came out last year suggest that the target number one is, like, business professional services and financial services. Wow.

That is scary. These are not organizations with bad security.

Not at all.

No, but they are organizations with piles of money to spend on solving problems.

Exactly. And then you have retail, hospitality, and maybe healthcare that, you know, round around the top 5. But it goes back to exactly what you said is when you see financial services on the top of the list, you understand that it's everybody's problem. And as security professionals, what you try to explain is that your mindset should be, The attack is gonna happen sooner or later. It is happening. And how much you invest in security will then help you, will make the difference of how much damage that attack can inflict in your systems. This is where you wanna prepare. But thinking that if you spend enough money on security, you'll never get attacked, that's not true anymore.

I'm just trying to digest all this, and I'm having to ask, we've been seeing this happen, we know how much it costs, why is it still happening? Why is the industry not doing a better job of Stopping this thing that we know is happening every day to all of our peers all around us?

So I think there's multiple reasons. I would love your take on it, but if you look at the numbers that came out of YAL last year, again, the trend is slowing down. If you compare 2021 to 2020, you see that there are less ransomware-related attacks than it was in 2020. So the dwell time is getting better. We're getting better at knowing that we got attacked and responding to it. Our forensics dwell time is also getting better.

That's good.

Exactly. In that sense, not everything is doomed and everything is going in the bad direction. However, it's, again, a lot of the ransomware is malware. A big part of it is based on phishing attacks. Phishing attacks are like 80% human element. So this probably will never stop unless we somehow wake up tomorrow and every company's investing heavily in user awareness.

Hmm.

So this is a part of it, but then a big part of it is also that because it brings in so much money, the malware authors are getting really, really big. Better at their jobs.

Ah, see, this is one place where I'm going to disagree with you. You said companies investing in user awareness. Users know that phishing exists. I think the problem is that companies haven't adopted FIDO keys or web authn. The fact that we still rely on fishable credentials is crazy. Like multi-factor is great at stopping credential stuffing in some cases, but honestly, if we're relying on human beings to type in the code to the right browser or push the accept this push, you know, auth at the right time, we're going to keep losing. As the Uber hacker. among others showed. I think really the phishing recommendation has to be move to unphishable factors.

I completely agree with you, but there's another layer of it. When you see how far it has gone to use user phishing to get access to a system, I've seen reports of, I've seen even the pictures of them, which are very scary. They send gifts to the employees pretending to be their company, and it's like very expensive gifts wrapped for Christmas and so on. And part of those gifts will be some sort of a USB token or something. And of course, it will have malware that would act like a worm and infect your system. But if you think about it, how much time are you going to spend analyzing a gift that you got from your company, right?

Yeah, right?

Yeah.

You know, it's funny. I'll tell a story about getting gifts from companies. I was in Israel a couple of years ago giving a talk for Google, and I got back to my hotel room, And sitting on my table in the hotel room in shrink wrap was a Google Home. There was no note. Nobody told me they were going to give me one. And this cursed artifact shows up in my hotel room. And I was just like, good God, no.

But would you rather have a Google Home or say candy that you have to eat? So this is like, I mean, it's like, what is the risk?

Honestly, if there had been a chocolate bar on my table, I would Exactly. Even if there was no note, I would've just assumed the hotel gave it to me. Like, the hotel's not gonna poison me, but leaving a listening device in my room? No way. No way. Forget about it.

I agree with Tim on that one, to be honest.

Okay, now I'm not gonna hit you with a threat model question, Tim, because it depends on the threat model, of course, because I'm looking at, I think, 2 Google Homes in my, well, home office.

But you sourced those yourself. You weren't given those by an unknown person.

Well, there is that. Yes, I admit to that.

Yes.

Which brings us to the other question, which we've been asking some guests in the past, and it's kind of about ransomware actors, ransomware groups trying to move to the cloud. And I don't mean transform their businesses digitally. I think they're already pretty digital, but more about move to cloud as a target or move to cloud as a venue. And we've gotten some pretty, I would say, diverse answers ranging from it's not happening, it's happening slowly, or in the cloud ransomware isn't aware.

Yeah.

It's a ransom op. Do you have any kind of view, position, or opinion or anything on ransomware in the cloud?

From what I've seen, I haven't yet heard that there are ransomware actors targeting cloud environments. Like, when you see reports that are coming out of Splunk and Mandiant, you know, the groups, they target a certain type of environment, and the cloud is not still— there is no known group that is targeting only cloud environments, for example. However, what exists on the cloud, a big part of it, unfortunately, still functions the same way that the legacy systems function. So you still have VMs, you still have storage mechanisms with auto-synchronization that is not over-securing what's happening. So you have legacy assets on the cloud that have been moved, installed on VMs, and function in the same way. So in that sense, if an attack happened on-prem and you have a lot of mechanisms that are not extremely secure, the attack will probably propagate to the cloud, but it's not proper to the cloud yet.

This is what the main event people told us once, is that if they are compromising the on-prem environment and getting creds and then using the creds to go to the cloud, is this a cloud breach? That gets pretty philosophical pretty quickly, right?

Of course.

What's interesting there, Nelly, is you touched on compromise of applications running in the cloud, not of the cloud control plane and cloud identities itself. So I think there's a distinction there we might want to think about. of how adversarial toolkits that work on-prem targeting applications on-prem can target applications in the cloud, but maybe they aren't tooled up yet for targeting the cloud itself?

So, I think every cloud provider have some sort of a shared responsibility model, right? Which when you look into it, you kind of understand that the more abstract or the more managed the service that you're using is, the less responsibility you have. And in that sense, Naturally, you will have less problems with very abstract services. So, if you're using Cloud Functions, for example, you're safer than other, you know, if you're developing on a VM and you're doing it yourself. When you talk about compromise of cloud accounts or cloud projects, or, you know, as you said, the admin panel of the cloud, we go back to what I said about human factor. I mean, if the credentials are leaked and someone has access to an admin access or a super admin access to your cloud, there's very little that this cloud provider can help you with, right? And in that sense, I think the only thing that I've seen or heard of was when the credentials were compromised. So it's all related to IAM and the lack of IAM security within the cloud. So basically, on the customer side of it, if they leak their credentials and someone has access, and then they're able to encrypt using very native tooling assets on the cloud, and then you're presented with a ransomware scenario. But again, all of this is on that panel of I mean, you're using cloud tools, of course, but it's just the customer leaking their own credentials.

So it's essentially on-premise threat type against the cloud infrastructure type.

Exactly.

Like, it's not a cloud threat in that sense. Sorry, I think it gets kind of philosophical somewhat quickly. Like, what's a cloud threat versus a cloud asset being hit by an on-premise threat? Actually, the other day there was some kind of breach. I'm not going to name it, but the other guest told me that Oh, and the reason was they had an unauthenticated API. It's like an API that had like no auth at all.

No.

And I thought, that's not '80s, that's like '70s. At this point, we are not in the password guessing. There is no password to guess because they forgot to build that auth. And to me, that was like, it's not '80s, it's '70s, dude. I'm sorry. It's like r/login for the really old people in the audience. How bad can this stuff get?

Okay.

Anything positive? Google Cloud tools that help against ransomware.

Yeah. What's the good news? Because this has been a depressing episode.

I think we do have good news. I told you, like, the attacks did not go up in 2021, and I think that's really good news. That means whatever we're doing is working, right? But on a better good news is when you're moving to the cloud and you have your important assets or your critical assets are on the cloud, in that sense, a lot of the, as I said, a lot of the toolings that you, a lot of the services that you're using will be based on— we'll have a shared responsibility model where Google can help you with that. So we're maintaining, we have health checks and so on. And that's the larger sense of it. But more particularly, we have tools like Security Command Center, Chronicle, that are able to give you great visibility over what's happening in your projects on GCP. And if you leverage this type of tool, then again, going back to the mindset of the attack is going to happen, it's just how you're going to respond to it. Those tools will help you respond automatically, very quickly. Cloud Armor as well is a great tool to help protect your environment. I wanted to mention as well the Workspace offering in general. So everything that is Google Mail, Drive, the Chromebooks haven't registered any ransomware attacks so far, right?

Hold up. Say that again. Say that again. No, no, no. Say the thing you just said. Say your last sentence again for listeners who were zoned out for a sec, because this is really cool.

So Workspace being Google Mail, Drive, and Chromebooks haven't registered any ransomware attacks so far.

No ransomware attacks on Chromebooks.

Right. But how would— like, it's kind of painfully obvious, right? Like, duh, that's what we expect.

I don't think that's painfully obvious. Why is that painfully obvious?

It's painfully obvious.

No, no, no. Nelly, why is this?

So the files, the data is encrypted by default, and it's cut in chunks and encrypted and put in a safe place on the cloud. So it's impossible, theoretically, and so far practically impossible to do ransomware on Drive files, for example, or Gmail files, because they're just not on that Chromebook. You cannot get the files, encrypt them, and do harm with it.

I mean, admittedly, everybody knows that if you have Chromebooks, you can never suffer from ransomware, right?

Not everybody knows that. And I don't know if I would go that far. Like, I don't want to say never.

Well, yeah, of course.

I want to keep my skeptical security person hat on, and I'll make fun of you for saying never, Anton.

You're right.

But I'll tell you a good trend that now you see customers who need very permissive machines in certain situations. They would rather have those machines become Chromebooks than any other operating system. So if you have machines on ground that you're using to access certain servers and you're giving more permissive rights to those machines than the normal machine, you see it systematically. Chromebook is number one. I mean, Chrome OS is the number one OS they would choose for that.

If I were advising a startup or a political campaign or a school, And they said, what are the 2 things I could do to improve my security outcomes? The number one thing I would say is unphishable security keys. And 2, Chromebooks for everybody that can live on a Chromebook.

Yeah.

I completely agree with you.

Maybe you're right. Maybe you're right, Tim. Maybe I was too— I went too far by saying it's painfully obvious. You're right. For us, it's painfully obvious that if you have Titan keys or FIDO keys and you have Chromebooks, then you probably would not suffer from ransomware. You're right. I shouldn't say never ever, because we'll challenge somebody and they will figure out the way, but— Yeah.

Don't throw down that gauntlet.

We are talking about like a meteor. Do you wear a helmet to not be hit by a meteor kind of risk?

Well, hey, after that meteor that NASA smashed last night, you never know what the asteroids are going to get up to. So we're coming up on time. And Nelly, I feel a little bad because I just gave 2 tips for improving your security, but I'm going to ask you for another tip for improving your security outcomes against ransomware. And then, of course, any recommended reading for the audience?

If I had to choose one thing, it's use Security Command Center. It's a great tool. It's made for that. It's a great tool. It's made for the cloud. It is able to see and react in a lot more depth than anything else that I've seen for the GCP environment.

Listeners, that was not a plant. And Nelly, I'm one of the PMs for SCC. So that's, that's really sweet of you to say. Thank you.

I didn't know.

Yeah, no, you didn't know. Yeah. That's what I do here when I'm not hosting this podcast. I'm actually the Senior PM for Threat Detection in GCP. And then recommended reading.

We have, of course, material from Google. We create a lot of security content and I recommend that, but I also recommend to maybe look at the trends that are published every year by Mandiant, by Splunk. They have a lot of information about ransomware and give you a lot of insights and how it happened the last year. It's very good.

That's awesome. All right. Well, Nelly, thank you so much for joining us today. I think this is the most fun we could have possibly had talking about ransomware. And listeners, I promise there was no plant here. It was just a very good recommendation.

Thank you so much for having me, and I had a lot of fun. Thank you.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter @anton_chuvakin and @_timpeako. Tweet at us, email us, argue with us, and if you like or hate what you hear, We can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.