Does Ransomware on one computer put entire network at risk?

Question

I was visiting an office recently where one computer had become infected with a ransomware variant and turned off until the 'network guy' could come take a look (I don't know which one as no one took an image of the screen or was at all knowledgeable about security issues).

If the infected computer is on an ethernet network with other computers all on the same subnet, are those computers likely to be infected also as a result of the first computer becoming infected? I realize that they might be infected independently due to lack of whitelisting, spearphishing, etc.

Answer 1

Short answer, without any supplementary information, one should at least consider the risk of network infection as important.

The main thing is at least to be able to put a name on the malware, and even better to detect how this first computer was infected.

Some worms indeed use network connection to propagate themselves: they scan the local network generally targeting some defined unpatched OS flaw and take advantage of this to propagate. However, this the worst scenario because:

1. The other system may be up-to-date and correctly patched,
2. Not all worms are acting like this,
3. You may even not be facing a worm at all, in such case the ransomware contamination was just the result of another way of infection not impacting for the rest of the network (phishing email, browser flaw exploited by some site visited by the user, etc.).

If possible, I would encourage you to take a look for suspicious network activity. A dozen of infected PCs scanning the network to find supplementary victims is usually quite noisy...

Answer 2

A common networking scenario implements a file server. If the infected system has access to the file server then it can both encrypt and infect files on the file server, thereby placing all other systems on the network at risk as well as the intellectual property of the company should the company be lax regarding backup policies.

Answer 3

I get really aggravated when people talk about "infecting the network." Typically, there are two separate issues in play here. Just because a computer shares a subnet with another doesn't make it vulnerable (or, at least, it shouldn't, barring bugs).

The real vulnerability is in the credentials the infected computer has. On domain-joined Windows computers, the Active Directory service that handles authentication and distribution of credentials frequently is run on (and only works on) a particular network segment, leading to the common misconception that "the network" is not just a means of transmitting data, but a "trusted" thing.

In short, look for what machines the infected computer had access to. If the infected computer was a domain-joined Windows machine, the infected machine and the users logged into it may very well have had access to other computers on the network, placing them at risk. If it was a Windows machine that was not domain-joined, worry about other machines on the network that used the same user name and password as a user on the infected machine, or that the infected machine had saved credentials for (check the Credential Manager on the logged-in accounts).

It's also worth noting that most ransomware isn't that smart. It's not typically a self-spreading thing, just a payload delivered by some other exploit mechanism. It wouldn't really help it to encrypt files on other computers unless it can also display a ransom demand, and that requires code execution, not just file access. Most ransomware won't touch the network unless you have a network drive mapped, and then only because it confuses those with local drives.