Conversation

Notices

1. Embed this notice
   BrianKrebs (briankrebs@infosec.exchange)'s status on Thursday, 12-Mar-2026 01:41:57 JST BrianKrebs

   Breaking, new, by me: Iran-backed Hackers Claim Wiper Attack on Medtech Firm Stryker

   A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker's largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headquarters says the company is currently experiencing a building emergency.

   From the story:

   "Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices."

   "Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently."

   https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/

   #stryker #handala #intune #wiper #cybersecurity

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 12-Mar-2026 01:41:56 JST Rich Felker

     in reply to

     @briankrebs LMAO MDM = FAFO

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 12-Mar-2026 02:05:08 JST Rich Felker

     in reply to

     • Dusk to Don :raccoon:

     @dusk @briankrebs Well one level of MDM that's always inherently malicious is BYOD: taking backdoor control of people's personal devices so you can store sensitive work-related data on them. This is just completely unethical and should not even be on the table.

     I'm not sure if that was involved here, but I thought I'd put it out there first.

   • Embed this notice
     Dusk to Don :raccoon: (dusk@todon.eu)'s status on Thursday, 12-Mar-2026 02:05:10 JST Dusk to Don :raccoon:

     in reply to

     • Rich Felker

     @briankrebs

     @dalias Curious if you could share a TL;DR of what an IT admin might consider as an alternative to MDM? Just manage remote machines manually?

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 12-Mar-2026 02:09:28 JST Rich Felker

     in reply to

     • Dusk to Don :raccoon:

     @dusk @briankrebs As for company-owned devices, provision them centrally but don't leave backdoor access. Use encryption at rest to protect against theft rather than relying on ability to wipe after-the-fact (which won't work anyway if the thief is competent and wants the data). Expect devices to be returned upon leaving the company or for service/overhaul, or if you want to do it remotely, set it up so the user has to initiate the listening process to give you control rather than having an ambient backdoor.

   • Embed this notice
     𝙲:\𝚝𝚛𝚊𝚗𝚔𝚣𝚎𝚗> █ (trkzn@mastodon.social)'s status on Thursday, 12-Mar-2026 02:11:18 JST 𝙲:\𝚝𝚛𝚊𝚗𝚔𝚣𝚎𝚗> █

     in reply to

     • Rich Felker

     @dalias @briankrebs In the company I used to work for, we used Intune (a little) because it was already included in what we payed to MS, so might as well use it right ? In light of this, I'm thinking having your MDM solution this tightly integrated to the rest of your ecosystem (and particularily to your backup) is a disaster waiting to happen.
     But is there an MDM solution that doesn't suck ?

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 12-Mar-2026 02:11:18 JST Rich Felker

     in reply to

     • 𝙲:\𝚝𝚛𝚊𝚗𝚔𝚣𝚎𝚗> █

     @trkzn @briankrebs There probably isn't, because the folks who design MDM and the folks who buy MDM have really bad ideas about how it should work based on power trip fantasies not real world threat analysis and making fair and resilient power relationships.