Know every device you have
The attack started on a machine nobody thought of as a computer any more. If it's switched on and connected, it needs updates and protection like everything else.
Client stories / Ransomware
The forgotten laptop that played the music.
At a busy Westminster restaurant and private members club, files started scrambling themselves on every computer, laptop and phone. The source was a laptop nobody remembered, in a cupboard. Here's how I found it, stopped the spread and had them back up and running the same day.
- Client
- Westminster restaurant and private members club
- Incident
- Ransomware spreading through Dropbox
- Source
- A forgotten laptop in a cupboard
- Back up and running
- Same day, no data lost
01What happened
Everything disappearing at once
Files in the business's Dropbox began scrambling themselves, and it was happening on every device at once: computers, laptops and phones.
The membership list became unreadable. So did the ordering sheets, the staff timesheets and the menu designs. Everything the business ran on was disappearing in front of them, so they called me, and I started investigating straight away. With ransomware, every minute counts.
02Response
How I responded
- 01
Saved the good copies
A couple of machines hadn't been switched on yet that day. I kept them off the network, booted them up, and their files were still intact, with the previous night's good copy.
- 02
Stopped the spread
I stopped the Dropbox sync and shut down the network, then ran endpoint protection tools across every device. None of them was the source.
- 03
Found the culprit
Dropbox's admin panel showed one laptop connected and making lots of changes. That jogged the manager's memory, and we went down to an old, dusty cupboard.
- 04
Cleaned up and restored
Inside was a very old laptop running the music for the whole building. I wiped it, then restored clean files to Dropbox from the machines that hadn't been switched on.
03Outcome
The music laptop
The laptop had been plugged into the sound system, playing a playlist on repeat. It was out of date, unpatched and forgotten about, because nobody used it day to day.
At some point someone had signed in to Dropbox on it. When the laptop was hit by ransomware, Dropbox did exactly what it's designed to do: it synced the scrambled files to every other device, overwriting the good ones.
All of the data was recovered, and the business was back up and running the same day. The rest of the security work was finished over the weekend.
04What changed
Closing the gaps
- The music laptop cleaned and wiped
- Endpoint protection installed on every device in the building
- Firmware updated on all the networking kit
- The firewall checked and configured correctly
- Guest Wi-Fi moved to its own network (VLAN), isolated from staff systems and the back office. Until then, the two hadn't been separated at all.
05Lessons
What your business can take from this
Cloud sync isn't a backup
Sync copies damage as faithfully as it copies good work. Keep a separate backup that can't be overwritten, and check you can restore from it.
Testing your backupsKeep guests off your network
Guest Wi-Fi should never be able to reach the systems your business runs on. Keep it on a separate, isolated network.
Act fast, and switch nothing else on
Machines that were still off saved the day here. If files start scrambling, stop syncing, disconnect, and call for help before turning anything else on.
If ransomware hitsNext story: An invoice from the CEO. Except it wasn't.
Files scrambling right now?
Treat it as an emergency. Response usually starts remotely within the hour, with a fixed £795 first response.