Threat Vector by Palo Alto Networks Crisis in the Kitchen: Unraveling a Malware Incident
Jan 16, 2025
Patrick Wright, Forensic and Incident Response Lead at BP, discusses a malware incident that infiltrated a kitchen management system at a coffee retailer. He details the surprising operational challenges faced when the team decided to disconnect the system to mitigate risks. The conversation also uncovers the complexities of conducting forensic investigations under pressure. Wright emphasizes the necessity of individual awareness and proactive measures in combating cyber threats, making a strong case for increased vigilance across all levels of an organization.
AI Snips
Chapters
Transcript
Episode notes
Malware Incident at BP Gas Station
- Suspicious outbound SMB traffic was detected from a BP gas station's kitchen management system (KMS) in Southeast Asia.
- This system, used for managing drive-through orders, was unexpectedly spraying the internet with SMB traffic.
POS System Connection Raises Alarm
- The KMS's connection to the Point of Sale (POS) system raised concerns about potential compromise.
- Immediate action was taken to disconnect the KMS, prioritizing security over potential business disruption.
Limited Visibility Challenges Incident Response
- BP's incident response team often faces challenges due to limited visibility into certain systems.
- They frequently need to gather information about system configurations and network topology during incidents.