The weighbridge at one of our aggregates yards is supported by a small specialist company in the Midlands. When its software played up in September, their engineer rang the yard manager and asked her to install a well known remote support tool so he could look at the PC. It was a perfectly normal request.
She searched for the tool's name and clicked the first result. It was an advert, placed above the genuine site, and the page it led to looked exactly like the real one, down to the logo and the download button. The file she downloaded installed the remote support tool, which worked, and the engineer fixed the weighbridge. It also installed something else.
About twenty minutes later our endpoint protection flagged an unfamiliar process on that PC talking to a domain registered four days earlier, and isolated the machine from the network. We found no sign that anything had been taken. The PC was rebuilt, her password was reset.
None of this is new. In December 2022 the FBI published a public warning that criminals were buying search engine adverts impersonating well known brands and software downloads, and recommended that people check the address before clicking and use an ad blocker. Remote support tools remain a favourite target, because the person installing one has usually been told to by someone they trust.
What interested me was how ordinary her route was. We had never given our depots anywhere to get software. Laptops at head office have a company portal with approved applications in it. Depot PCs, shared and largely unmanaged in that respect, had nothing, so whenever a supplier asked for a tool, the search engine was our software catalogue.
We changed three things. The company portal now runs on every depot PC, and the remote support tools our suppliers ask for most often are in it, already configured. Suppliers who need to reach a depot machine now do so through our own remote access service, arranged through the service desk, rather than whatever tool they prefer. And our web filtering blocks advertising networks on company devices.
The yard manager did nothing wrong. She followed a reasonable instruction with the only tool she had. If people have nowhere safe to get software, they will search for it, and the top result is for sale.
– Serguey Shinder
Top comments (0)