Stop Scammers from Controlling Your Computer
Source: YouTube · John Hammond · published Jun 25, 2024 · 16:00
Scammers are increasingly misusing the native Windows Quick Assist tool to gain remote access and deploy ransomware, such as Black Basta, via social engineering attacks 3:38.
Key Takeaways:
• Quick Assist is a pre-installed Microsoft tool designed for legitimate tech support that allows trusted users to view or control a screen remotely, accessible via the Start menu or Ctrl+Win+Q 1:00.
• Microsoft's threat intelligence team has observed the threat actor Storm-1811 abusing Quick Assist to target users in social engineering attacks leading to ransomware 4:00.
• If the tool is not used, organizations should consider uninstalling it entirely using a specific PowerShell command or blocking its usage to reduce the attack surface 7:20.
• Administrators can prevent Quick Assist from functioning by editing the hosts file to create a DNS sinkhole that blocks traffic to remoteassistance.support.services.microsoft.com 10:00.
By understanding how legitimate tools are weaponized, users can take proactive steps like removing unused software to secure their environments 12:00.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
you're probably pretty familiar with the classic tech support scam right say that there's an email that arrives in your inbox from Microsoft or Geek Squad or Best Buy or Norton Antivirus or whatever organization company scammers might be impersonating and saying with a notice or renewal or confirmation details that say oh an invoice was paid or a subscription was renewed something fake something that's a lie something incorrect to scam you into or actually picking up the phone and calling the number they provide in the email once the scammers have you on the phone they'll be impersonating the support team and they'll ask you to install and run software that will grant them remote control over your computer th software like team viewer or any desk screen connect Ultra viewer and there are a…