I've been asked to find out what companies are doing in regards to Ransomware and SharePoint. The question lies with e-mailing SharePoint Links that are hijacked along with the e-mail address and used as a Ransomware link that is sent back to an unsuspecting employee. How do you handle this?

  • Is the data really being held or is this ransomware actually over taking your environment? Is your SharePoint site still available and accessible in this scenario? I would assume that it is available and accessible and this ransomware is more of a phishing scheme. – Eric Alexander Dec 15 '15 at 18:26
  • The SharePoint Environment is fine. Sites are still available. I think what my CIO is concerned about is the hijacking of an e-mail with a SharePoint Link in it, which is changed and sent back where the employee clicks on the new link which sends them to, or activates Ransomware that encrypts their PC, Thumbdrives, Shared Drives, etc. – Bismarck Dec 15 '15 at 18:43
  • It's not a SharePoint issue. its more of a phishing scam that takes a user to a place to activate Ransomware. I could see this possibly more prevalent on an Extranet. I think this forum might not be the correct place to ask, only my CIO would like to find out if the SharePoint Community is handling this in some way. – Bismarck Dec 15 '15 at 18:49
  • 1
    The Information Security site might get you a better response, security.stackexchange.com. It it social engineering/phishing, so really its about being proactive in communications regarding phishing schemes and the messaging folks being on top of spam filtering and blocking these types of emails before they get to users. – Eric Alexander Dec 15 '15 at 18:53

To hijack SharePoint notifications you would have to do something like this: How can I create custom Alerts for external email addresses? you could periodically review the configuration files to make sure they have not been changed. (They are loaded in the DB, not on the server, so a standard file checker would not cut it.)

To Phish you would have to send from outside the network or spoof from inside the network. in both cases the email looks different. Mitigate with user education standard for phishing prevention ala security.stackexchange.com

To send malicious links from a SharePoint email however would be as trivial as adding a malicious link in a list and sending an alert to some users. This is neither ransomware nor SharePoint specific. Any system that sends an email could easily send bad links.

This should help you get started on risk assessment. I really hope this is not a buzzword evaluation style risk assessment. If you are trying to evaluate risk then take your time, select a framework, do the research, and then assess the risks using the framework. This seems like a VERY SPECIFIC question about risk of a particular product. I would rate this risk as possible (like all vulnerabilities) but with several hours of effort. Yet not very likely because of the effort involved to do this from SharePoint and the ease of doing the same thing from other routes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.