Home Depot B2B EDI “support” is a model of Asian outsourcing failure.
Home Depot outsourced it’s B2B and EDI (Electronic Document Interchange) support to India, Pakistan or somewhere in Asia long ago. It’s a model demonstration of the failures that can come from outsourcing. The long running jokes about Indian call center support embraced by US technology and telecommuncations companies have spread across almost all areas of I.T. This particular failure on the part of Home Depot is of particular importance because it causes disruption in their vendor supply chain.
Honorable mention goes to Home Depot for their selection of unqualified candidates to work in their B2B support center. Not only are they generally unhelpful and unknowledgeable regarding things like their own EDI mapping specifications, but Home Depot has found it acceptable to hire those who ONLY speak Farci or Urdu with almost zero ability to speak English. This is no exaggeration or matter of interpretation. My guess is the top of the totem pole in Atlanta probably isn’t even aware how bad the situation is with this language barrier. I challenge anyone in their stateside senior management to call their own B2B support department and hold a conversation. Our organization has been required to call in our Indian and Pakistani product managers to sit on calls and speak with the HD B2B support staff in their native language because they genuinely did not know the words in the English language to communicate high level technical information to our internal EDI staff or our application vendors. This is when you know they’ve gone too far in their quest to offset costs.
Predictably Home Depot could play the “we can’t find U.S., Canadian or European workers with the skill set to fill these roles”. Well, you didn’t find them in India or Pakistan either. Furthermore the document specifications and translation sets are written in English code, specifically XML. If they can’t speak it my guess is they couldn’t read a map or the specification sets during training either.
We are at a point of impasse in our organization right now when it comes to turning up a new trading partnership for Home Depot Canadian distribution centers even though we have a signed supplier agreement because we literally can’t find anyone in Home Depot B2B who can communicate with us in English. Furthermore when we engage our language translators they still can’t grasp technical concepts well enough to even provide us proper document specifications for their domestic and international programs. This is why Home Depot’s long running B2B outsourcing initiative deserves a resounding FAIL.
Home Depot has millions of dollars to fix this problem and insure faster supply chain integration. Apparently the decision not to fix the problem is completely based on trying not to pay U.S., Canadian or European technical specialists the wages such B2B and EDI expertise demands, opting instead for cheap, unqualified, outsourced Asian call center operatives who are at best ineffective in their roles and in many cases detrimental to vendor supply chain integration.
No commentsGoogle Translate is a security risk.
Lots of articles out there about why it’s not safe to translate sensitive internal business documents using Google Translate. Most of these articles discuss accuracy and confidentiality. But Google translate is also dangerous because it acts as a proxy by design, making it a security issue. That means you can plug in a URL in any language, including English and Google will display the contents of the site. This undermines any corporate security measures put in place to keep employees away from blocked or compromised sites. The answer is a translation service from Google or a competitor built for business. This would allow for administrative logins to manage what sites can be translated and monitoring of what documents are uploaded for translation. It’s also a revenue generator for the first service to come up with administrative translation control.
No commentsCan I decrypt files encrypted by RYUK? Is it possible to decrypt .ryk files?
No. There is no decryptor for RYUK at the time of this post. If you need the file(s) and don’t have a backup you will need to reach out and pay the ransom for a decryption key.
No commentsDetails of a ransomware attack and how to thwart the ransom.
Here are the basic steps included in a ransomware attack and how vulnerable people and ports are used to accommodate the attacker. Conditions must be met.
- The attacker relies on stolen credentials. These are harvested in the form of viruses delivering malware. Specifically in recent attacks Emotet as the delivery agent for the Trickbot trojan. All too easy with users susceptible to social engineering.
- Trickbot uses lateral movement across systems, relying on SMB to navigate the network, stealing passwords, mail files, registry keys and more. It communicates the stolen material back to the bad actor, the black hat.
- Trickbot also launches the Empire Powershell backdoor and downloads the Ryuk virus upon the black hat’s command. Armed with harvested credentials, the black hat is now ready to execute Ryuk and encrypt files at will.
- The black hat scans for a vulnerable port of entry on an external interface.
┌─[blackhat@parrot]─[~]
Once a port of entry is found, in this case a very common and vulnerable port used as a remote access interface, the black hat can use the stolen credentials to log in to the network and rely on protocols such as SMB and RDP to access and exploit systems on the network, launching Ryuk to encrypt files on select systems.
So how can you protect systems and most importantly backups so that rapid recovery, the best offence against black hat attacks, remains possible?
- The obvious first step in recovery is to neutralize all exploits. It can also be the most time consuming. Use Windows firewalls to block all SMB traffic and stop lateral movement across systems. Deploy through domain level group policy. Open only the ports necessary to deliver anti-malware utilities to clean all machines of any sign of exploits. Windows 7 systems remain highly vulnerable to SMB attacks without proper patching and configuration. Best to get them off your network regardless of how annoyed some end users are by the thought of Windows 10.
- Always make sure your backup files and database backups reside on systems that are not authenticated to the network using domain level credentials. Make sure they cannot be accessed using SMB or RDP protocols at all.
- Of extreme importance is to make sure EVERYONE, especially your domain administrators are forced to change their login credentials routinely. IT staff have a bad habit of being prime offenders of exempting themselves from password changes. Take a stand. NO MORE. Everyone changes their passwords and password complexity rules must be adhered to by every account on the network.
- Make sure you have machine images that are not accessible using domain level authentication credentials. If you run a VMware environment make sure you administer VCenter only through local Vsphere credential logins, not AD authentication. This is not to protect your production images, this is to protect your snapshots. Hyper-V environments, God help you. When you are solely reliant on Windows authentication to manage your virtual servers, you’re vulnerable. I’d have to do more research on exactly how to stop propagation to all systems in a Hyper-V environment. My first inclination would be spend some money on VMware or a XEN Hypervisor, Nutanix if you must.
- Have snapshots. Have recent snapshots. If you don’t run virtual servers at least have Windows bare metal restore backups for physical machines. Again these are to be written to appliances that are not connected to the network with domain level authentication. Snapshot and bare metal backup files should remain recent enough to take into account all hardware and operating system changes that have been implemented.
- Close vulnerable ports on your public interfaces or at minimum set them to random port numbers. Obvious ports like 8443 are gonna get hit.
Note: I did not specify anything related to archiving and compliance backups because while essential for certain industries and disaster situations they are not specific to rapid recovery in the event of malicious disaster in which physical hardware assets are not compromised.
Once you are able to quickly restore a virtual machine or physical system from a recent snapshot or bare metal recover file copies of data files and database backups can be moved into place for restoration to the most current backup set. Daily is usually the best most small to medium “enterprises” can achieve. With added expense in resources and configuration backups can be run with more frequency. Unfortunately even hourly database log shipping won’t save a database from an encryption attack unless those log files are being off loaded in hourly increments to storage appliances that are not connected with domain level authentication. As always, the question of investment becomes: How much can you afford to lose?
The best defense against Ransomware is a good offence in the form of rapid recovery. Since these exploits rely on social engineering (gullible people) you can never pretend your network is free of any vulnerability. Do not design your backup and recovery environment in case something happens. Design it for when it happens.
No commentsFirst to choose seats for Avengers End Game.
No commentsView this post on Instagram
