Breaking Endpoint Anti-Ransomware: Going... (Nishant Sharma, Vivek Ramachandran)
summary
Claims that ransomware can operate entirely in the browser and bypass EDR/SASE/SSE/DLP by abusing web-native controls, demonstrated with an OAuth consent hijack that grants persistent tokens to an attacker app which reads/deletes Gmail, automates Dropbox password resets and removes notification emails, and pulls or deletes Google Drive files before uploading a ransom note. Research catalogs 100+ browser threat vectors, reports 60 malicious extensions targeting OTT, finds OAuth consent abuse and malicious extensions enable scalable, automated attacks; demos work against early Comet-like agents.
AI-written summary · about
chapters (9)
- 0:00Introduction and overview
- 1:02Speaker introduction and research background
- 3:49Why browser native ransomware matters
- 8:08Browser threats and attack vectors
- 11:44Bypassing endpoint defenses
- 14:15Demo: OAuth consent hijacking
- 22:27Demo: File storage based attack
- 26:01Defense strategies and mitigation
- 29:38Q&A session
related talks
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
37mRansomware Resilience: Holistic Defense for SOC Leaders
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
14mBehind the scenes w/ SentinelOne’s MDR: Detecting cloud ransomware
52mRansomware 101: Get Smart Understanding Real Attacks
40mRansomware Threat Landscape
29mRendering Ransomware Detection and EDR Products Blind
20mWhen ransomware strikes