Microsoft Teams Phones Considerations

Microsoft Mechanics just released a video about how to set up Microsoft Teams Phones which as always, is a good high level technical overview of something Microsoft is doing. Here’s the video:

Personally, I’ve been living with using Microsoft Teams as the phone system for PSTN calls for about 6 months now, after coming from Skype for Business On-premises. There are some aspects that do ‘just work’, but there’s also limitations to be aware of. For reference, I’m using it via Telstra’s TCO365 service, which may give a bit of a different experience to others not using it this way. For example, I can’t get PSTN call logs via Teams itself:


I don’t have to worry about any gateways

With Skype for Business On-Premises, we had multiple gateways to convert the SIP calls into SfB. It’s now all happening in the cloud, I just have a range of numbers provided by the telco that turn up in Teams and can allocate them, along with the user requiring the right Micrsoft license, and the TCO365 license. There’s no specialist knowledge required to maintain any gateways, and reduces complexity of the environment. The gateways were mostly set and forget – but still needed work do to manual updates. If one had a fault, it’d be a pain to resolve.

Microsoft Teams Client

This will also appear as a con later, but everyone already uses the Microsoft Teams client for meetings – so the learning curve isn’t as bad compared to using another platform. It very much leads into the notion that beyond email, Teams is trying to be the single pain of glass for immediate interactions and communications. The client receives constant updates which can bring quality of life improvements.

Teams Admin Portal

The admin portal is generally a lot nicer to use than the old Skype for Business portal, which ran on Silverlight. It is constantly changing and being updated, and has grown in stability since I started using it 6 months ago. There’s a lot more that can be done in there around usage and reporting, and client health. There’s still plenty of improvements that can be made, but for the most part it does work.

Feature Updates

Not having to patch Skype for Business servers is great – a standard benefit of on-premises vs SaaS. The less things we have to manage for no real benefit, the better. When those updates come through, they’re regular, and bring new options to the platform. The client updates of course bring many more features too – but be weary of release dates. When something gets released in June 2021, it probably means that Microsoft are starting to roll it out then, and may take a few months to get to your tenant.

Calling Queues and Auto Attendants

The range of options around these is a lot greater in Teams – you can have a lot of scenarios covered and more complicated rulesets on how to handle calls. Members of a calling queue can also optionally have the toggle in their client if they want to be a part of it or not, which is handy to give end users the ability to jump in and out.


Microsoft Teams Client

A double edged sword – it is nowhere near as slick and well designed as Skype for Business was for purely making phone calls. The interface is huge, becuase it’s designed to do so much; but the phone aspect still feels like an afterthought that constantly changes. Doing something simple like clicking in the field to dial a number, typing it and pressing enter does not call the number. You have to press enter twice – but not straight away, that won’t work, you have to wait for it to pop up a dialog showing it’s got the number ready to dial, then press enter again. Or, you can then go to the mouse and click call, which to me isn’t as good since I just used the keyboard to type a number in. Clicking all the digits of a phone number isn’t fun.

The Teams client is still memory hungry, has a lot of weird bugs (at one stage, the Calls icon just wouldn’t show which makes it very hard to make calls!). A whole re-write of the Teams client will come out at some stage, so hopefully that runs a lot better.

Desk Phones

This is another aspect that feels like it doesn’t get enough attention and effort. The Teams app that runs on Android will power any desk phone, and it’s not instantly quick to respond. It’s good enough, but not great. Many phones still don’t support being automatically updated via Teams, but will support a manual update. Part of the desk phone experience comes down to which third party vendor you pick, but features like being able to swap a PSTN call between desk phone and PC are still coming – these should have been there from day 1.

Unassigned Number

On Skype for Business, there was a great feature that would redirect calls of unallocated numbers in number ranges to another number – so if someone left, their calls would go to reception. This isn’t available in Teams at all, if you want to recreate the feature, you’ll have to pay license and phone company fees for every single number you’d like to do this to. A real pain.

Calling Queues and Auto Attendants

Although another positive, the internal Teams support for this is poor. If you try to look up the name of a calling queue in Teams, it won’t come up. So, if you create a Helpdesk group and expect internal staff to be able to type ‘Helpdesk’ in to find and call them, you can’t. I’m really disappointed on this one. The workaround is to fully license an account called Helpdesk, and set that to divert all it’s calls to the calling queue number.

There’s a bunch more points to consider, if you want to see a comparison on features for Skype for Business vs Teams in it’s multiple iterations of phone support (Teams Calling Plan, Teams Direct Routing, Teams Operator Connect) check out Luca Vitali’s constantly updated feature comparison table

I am looking forward to seeing how Teams Phones progresses and becomes a stronger product; in it’s current state be aware of the existing limitations and if it meets your requirements. It’s also worth seeing what’s on the roadmap for Teams and Phones to know what’s coming.

Ransomware happens, be prepared: Preventing a LockBit attack 


In the first two parts of this series, I went over what happens when BitLocker attacks your computer when the computer is unprotected, and what it takes to possibly recover at least partially from the attack. While it is possible that someone who is prepared will not be significantly impacted by a ransomware attack, most of us will not be so lucky. In most cases, a ransomware attack will mean completely restoring the computer to its factory settings and losing most or all of our data. This is clearly not the best option for anyone, so what can we do to make sure that we don’t become a victim in the first place? 

Be prepared 

The phrase is a little cliche, but it’s the best piece of advice I can provide. It’s easy to say, but what does it mean? Being prepared in this case means that you are assuming that you will be attacked at some point, and you have protections in place to stop the attack early in the attack chain, while also having measures in place to stop the attack at later stages and recover from damage in case the attack can’t be prevented early on. It’s something we advise all of our customers to do at Acronis. Attackers are continually improving their tactics and tools, which means that a solution that is continually updated and implements detection that has a better chance of detecting future attacks is key. 

When it comes to ransomware, there are a number of aspects we need to consider. How did the ransomware get on the computer in the first place? How can the ransomware be stopped early? How can the ransomware be stopped before significant damage is caused if the initial attack isn’t stopped? How can we easily recover from an attack if all other methods fail? By asking these questions, we can find a solution that ensures any attacks have little to no impact on our lives. 

Just stop it! 

The best way to avoid an attack is to stop it before it starts. Most ransomware attacks come from malware installed because of a phishing attack, or a vulnerability in the software we have installed. The solutions here are fairly simple, as we can learn to keep from opening attachments or clicking links in unexpected emails and keep our software updated. Another good practice is to uninstall any software that we stop using. Old software potentially adds vulnerabilities to our computers, even if we don’t run the software anymore. 

Of course, a solution to help us avoid some of the malicious servers and websites is available as well. Sometimes a link or file may be convincing enough that even a well-trained individual may be fooled. This is where URL Filtering comes in. A solution that prevents access to malicious URLs will help to keep us from accessing dangerous websites, or having documents download malware behind the scenes. 

Stop it early 

In the cases where an attacker uses an unknown vulnerability, also known as a zero-day vulnerability, or a new website or server, we can still stop most malware before it can impact our systems. A good, modern, antivirus that utilizes AI and behavioral detection will usually be able to stop even new droppers and trojans, preventing the installation of ransomware early on in the attack chain. By utilizing newer technologies, rather than relying on classical antivirus solutions that just look at the code or the file hash, we can ensure that even new malware is detected and blocked by the solution you implement. 

At least stop it 

Even with modern antivirus, there may be times when the initial malware isn’t stopped. As I have previously mentioned, attackers are constantly updating how they do things, and sometimes they find novel ways to attack systems that haven’t been considered previously. This type of attack may even be able to bypass behavioral detection or AI analysis. This is where dedicated ransomware protection comes in. There are behaviors exhibited by ransomware that will exist no matter what methods are used. For instance, multiple files being encrypted is a strong indicator of a ransomware attack. A solution that specifically looks at ransomware behaviors, and provides proper protection against ransomware, will create protected duplicates of files as they are accessed, then will stop the ransomware and be able to restore the files from the backups it created. It is important not to rely on Windows shadow copies, as some ransomware will delete these copies to prevent easy access to be able to restore the files. 

Reverse total destruction 

Even with the best solutions, there is always going to be a worst-case scenario. When the attack starts, executes and completes, a proper solution ensures that all is not lost. It is important to have a backup solution that can scan backups for malware, and protects the backup files from tampering. With a full backup, it can be made simple to restore the system to the last backup prior to the attack. If there have been new changes to files between the last backup and the attack, it is still possible to lose some data, but this will minimize the impact of any lost data and will ensure that any lost data is recent enough that it will be much easier to remember what it was and recreate it. 

The key consideration with your backup solution is that the backups must be protected from tampering. A recent addition to the common tactics of ransomware operators is to identify and delete or encrypt backups. Ensuring that the backups are protected against tampering will help to ensure that they are available when it comes time to use them to recover your files. 

Final thoughts 

While it can be overwhelming to think about a ransomware attack, there are ways to make sure you can easily defend against or recover from an attack. Even if you think you are not a target, it is important to have a multi-layered solution that covers attack prevention, malware detection, ransomware protection, and protected backups. With such a solution in place, you can rest easy knowing that if an attack comes, you have a solid security posture, and won’t be significantly impacted by the attack. 

Topher Tebow is a cybersecurity researcher, focusing on community collaboration and threat analysis. Topher has been working with malware and other cyberthreats for more than a decade, beginning with web-based malware before moving into endpoint protection. Topher has written technical content for several companies, covering topics from security trends and best practices, to the analysis of malware and vulnerabilities. In addition to being published in industry publications like Cyber Defense Magazine and Security Boulevard, Topher has contributed to articles by several leading publications, and spoken at international cybersecurity events.

Expensive Graphics Cards and Mining Cryptocurrency

If you’ve wondered why graphics cards are so expensive – new or used, you might have wondered why. You might have also been told that it’s due to people using these graphics cards for mining, and then been annoyed that you have to pay a lot of money to get a better graphics card. Or maybe that’s all just me… but I’ve been looking into this, and playing with mining cryptocurrency; here’s what I learnt.

I bought a new PC for home with the following specifications:

The key component here is the NVIDIA RTX 3080 graphics card, and you’re lucky to get one at the time of writing for $2000AU. When NVIDIA first launched the 3080 amongst other cards in late 2020, their RRP was $1139AU. A huge price increase – so why does mining cryptocurrency affect the pricing?

To actually use your GPU to mine can be incredibly easy. Platforms such as Nicehash let you set up within a few minutes, and just run a piece of software that sorts it all out for you. The barrier to entry is very low with methods like this, and Nicehash act as a service to allow people’s GPUs to mine cryptocurrency, take a cut of the money made, and pay the people doing the work in bitcoin (and to clarify, Nicehash aren’t getting their users to mine bitcoin itself, but several other options are available – and the market constantly changes, so there’s not one particularly good ‘coin’ to mine).

There are other options such as mining Ethereum, or using HiveOS – and I’m not recommending Nicehash in particular, but it’s the one I’ve tried and makes explaining things easier.

Coming back to my above computer – if I chose to run Nicehash, they have a calculator to show how much you could make:

Ignoring electricity costs (I’ll get to that later), running the Nicehash software based on the time of writing’s Bitcoin to AUD rate, I would get paid $5.38AU of bitcoin each day.

If my RTX 3080 cost $2000AU to buy, and I left Nicehash running on it, it would take 371 days to pay for itself – if the value of Bitcoin didn’t change. At 371 days, I also still have the RTX 3080. You can probably see the problem here already, and why so many people are now mining cryptocurrency.

Historically, the value of graphics cards drops as new models come out. However, due to crypto, value has gone up. Supply can’t meet demand, and older cards have increased in value because they can pay for themselves, then start making profit with enough time and power. The NVIDIA GTX 1080 Ti which came out in 2017 at a RRP of ~$900AU. They’re still worth about that on the second hand market, because:

Buying one for $900 would take 281 days to pay for itself. That’s better value than my new 3080.

Nicehash have a list of cards, recommended general overclocking settings, and the expected performance on one particular type of coin. the MH/s is a million hashes per second measurement, which is the actual work your card needs to do to make money:

Also note that some of the newer cards are ‘Lite Hash Rate Limited’ or LHR. This is due to NVIDIA trying to make the new cards less lucrative to miners, which is what my card is. The market for newer, non-LHR cards is of course stronger with the market paying much higher amounts for these cards, being twice as efficient. Spending $3000AU on a non-LHR RTX 3080 could make more financial sense than $2000 on a LHR RTX 3080.

Of course power isn’t free – unless you have solar during the day, and enough batteries at night, so there’s running costs to consider, and the other hardware required to run the GPU. There are mining rigs that can be built fairly cheaply, running many cards at once back to a motherboard/CPU/GPUs to provide more MH/s and therefore profit:

In these rigs, devices called ‘PCIe Risers’ are used to connect the GPU back to the motherboard. The GPUs would normally need a 16x PCIe slot, but these adapters can connect to a 1x PCIe slot – so a motherboard with lots of PCIe slots is what people look for in a mining rig. Plain USB can also be used, like this Asus motherboard with 20x USB ports on the motherboard itself:

None of the above is definite – things that happen in the world affect the value of cryptocurrency – including events like China banning cryptocurrency altogether which can throw values up or down. While there’s enough money in cryptocurrency though, this will continue; unless there’s an absolutely huge market crash (which could happen just like in anything lucrative). NVIDIA could work out how to build newer cards that are worse at mining, while still being better at gaming graphics – but new NVIDIA cards aren’t due out until late 2022. AMD has a similar problem as NVIDIA, with similar profits being possible.

Recovering from a LockBit ransomware attack 


In the first part of this three-part series, I went over what happens when your security posture is broken. In my job at Acronis, I regularly analyze ransomware, and its destructive behavior. Using the example of LockBit 2.0 ransomware, our computer may have been able to keep running, but once the attack got in, the ransomware didn’t stop encrypting documents and other sensitive files until it was done. Even restarting the computer wasn’t enough to stop the attack. Here’s the thing with relying on being insignificant enough to not be an obvious target: it doesn’t matter. You are still a target if you are vulnerable, and the chances of coming out of the situation without any data loss are minuscule. Of course, you can do things with a partial protection solution, even though you may not be able to stop the attack or save all of your files. These options include tools that range from built-in or free tools to paid solutions that will at least minimize the impact of an attack on your computers. 

Stop in the name of the Task Manager 

The great thing about Task Manager is that it is a part of Windows by default. MacOS and most Linux distributions also have their own versions of this, and they all work similarly. For this example, let’s just assume that you happen to notice something going on with your system. Maybe it’s running slower, the fans kick in when they normally wouldn’t, or you even happen to catch the file extensions beginning to change. Great, you have an opportunity to stop the ransomware before you have lost everything. It’s easy, just right-click on the taskbar, and open the Task Manager. If you click on the More details link at the bottom of the window, you can see the Lockbit22.exe – or whatever the name is that the file is given by the attacker – in the Task Manager window, so it’s a quick right-click, and you can stop the ransomware before it does any more damage. 

There are a couple of problems with this scenario. One is that you need to be familiar enough with Windows to recognize any processes that are unusual, and the other is that it relies on the ransomware allowing the task manager to stop it, and not having already set up automation to restart the ransomware after it has been stopped. If this works, you may have just saved yourself the massive headache of having all of your important files encrypted. Maybe it doesn’t work, and you need something a little more powerful. 

Exploring your options 

A fairly common tool that is used by researchers is Process Explorer, which is part of the SysInternals Suite provided by Microsoft. This is not installed by default but is easy to find on Microsoft’s website. Process Explorer is like Task Manager on steroids, but it works very similarly. Again, you can right-click on the process, and stop it with either Kill Process or Kill Process Tree. Again, you have to be familiar with what you should expect to see running in order to identify something that is out of place. While it is more likely that the process will be stopped with this application, we still have to hope that the ransomware won’t automatically start up again. 

Starting over 

If you remember from my last article, I rebooted the computer, and the ransomware started up again after I stopped the process. I had used Process Explorer, but this only stopped the malware until the computer was restarted. The ransomware had updated registry settings and ensured that it would automatically start up again when Windows booted up. Of course, the ransomware isn’t listed in the Startup Apps – that would be too easy. We need to get into the registry and clean up what the ransomware has done there. Everything else has been fairly easy up until this point, so before a reboot, I should be able to clean up these changes, right? 

There is a tool called RegShot that lets you take two snapshots of the Windows registry, and compare them. I took a snapshot before running LockBit, and again after the ransomware finished running. This is where your heart sinks as you start seeing the number of changes to the registry. Over 20,000 keys were deleted. 

Almost another 82,000 keys were added in that same timeframe. 

You might be able to narrow it down some, maybe by searching for keywords like “lockbit” in the log. This isn’t an efficient way to ensure you have cleaned all traces of the changes made by the ransomware, because it is very likely that the ransomware did not use its own name in every change. Perhaps you try, and perhaps you get the computer back to normal operation, without risking the ransomware being started up again. At this point, the ransomware still exists on the system. From the Task Manager or Process Explorer, we have the file name, we can search in Explorer for this file, and will most likely be able to delete it. This ignores a common trick employed by ransomware, which is to drop additional files, which have a different name but are additional copies of the ransomware, or additional malware payloads. 

Since we’re now likely in the land of make-believe, let’s pretend that you deleted all of the copies of the ransomware and any other malware from your computer. You have also restored the registry to its former glory – a task that is only recommended for experienced professionals. By stopping the ransomware, you may have even saved some of your files. The thing is, you still have encrypted files. There are two options here, pay the ransom in the hopes that the attackers are nice enough to give you the decryption key, or maybe you’re lucky enough to have all of the affected files in a cloud storage service like Google Drive or Microsoft OneDrive. Most people don’t back up all of their files to these services, and most of the time don’t have enough storage available to do so. 

The end is near 

This is where I get overly honest. Everything I just outlined is an oversimplification of this scenario. I didn’t even mention possible changes to Group Policy or other tactics used by ransomware groups. The fact is, if you are caught unprotected, it is unlikely you will be able to fully recover. Ransomware gangs are getting more sophisticated, and often just scan the internet for vulnerable computers to attack without regard to who the target is. The only way to ensure you won’t become a victim is to be prepared ahead of time. This means a multi-layered solution to protect your computer from future attacks. 

We’ve seen what happens when your computer is attacked, and now we’ve seen how enough diligence, and probably research, can help us to largely get back to normal after the attack. In the third and final part of this series, we’ll dive into what it takes to make sure you don’t become a victim of LockBit in the first place. 

Topher Tebow is a cybersecurity researcher, focusing on community collaboration and threat analysis. Topher has been working with malware and other cyberthreats for more than a decade, beginning with web-based malware before moving into endpoint protection. Topher has written technical content for several companies, covering topics from security trends and best practices, to the analysis of malware and vulnerabilities. In addition to being published in industry publications like Cyber Defense Magazine and Security Boulevard, Topher has contributed to articles by several leading publications, and spoken at international cybersecurity events.

No user too small to target: A look at the new LockBit ransomware 


It is no secret that ransomware attacks are on the rise, and attackers are finding new ways to access our systems. While malicious emails remain a constant, we are seeing an increase in compromises of trusted software. This increase is coming as extortion gangs become more organized and learn from each other. A great example of the evolution of malware is LockBit, which had already taken on some of the traits of Maze, but with LockBit 2.0 now also showing similarities to Ryuk and Egregor. 

With the improvements in ransomware, and improved malicious access to our computers, what is the worst that can happen if an attack gets through? The problem is too many people ask this question as a way to justify inaction, rather than as a justification for implementing the cybersecurity measures that they should.  

There is an answer to the question, of course. The worst that could happen is being unprepared for an attack, allowing it to run rampant on your computers – stealing data, encrypting files, and enabling future attacks that take advantage of the information uncovered in the initial attack.  

With that in mind, let’s take a look at just how bad a broken security posture can be. 

It won’t happen to me 

The default security on my computer should be enough to keep me safe, right? After all, I’m just an individual, not a large multinational corporation – I’m too insignificant to be targeted. 

Thinking like that allows attackers into our computers. The fact is that extortion schemes are constantly changing, and the criminal use of automation means attackers can target individuals and small businesses as easily as they can a global corporation. As a result, we have seen ransomware hit large corporations, individuals, and everything in between. When these attacks happen, we could lose everything on any computer connected to our home networks.  

With LockBit now rising to the top of the heap as a leading extortion gang, their ransomware is a great example of what happens when you are inevitably attacked. Let’s assume that the attack begins with a vulnerability in a trusted piece of software: a browser, a game, or maybe even Windows. 

Oh, it’s happening 

LockBit 2.0 is a very efficient piece of ransomware, and you may not even notice it running on your computer. It follows what has become a typical practice of being selective in the files that are encrypted. This approach helps to ensure that the computer continues operating as expected, while all of your important documents, pictures, and other files you may not want to lose are being encrypted. 

As you can see in these screenshots, common documents and other select files have .lockbit added to the end of the file name, while applications and less common file types have been left untouched. This tactic buys time for the ransomware to complete its job while you are browsing the internet, watching movies, or whatever else you may use your computer for. Once you try to open a picture or document, you’ll find that it no longer opens.  

If you are like most people, you might not even see these file extension changes, since this requires a change from the default settings. What you will notice is that the icons change to the blank page icon. By now, it’s too late. You can try changing the file extension back to the default for the file, but the file has been encrypted, and can no longer be opened by the computer. 

Once the files have been encrypted, a ransom note is dropped in any directory with encrypted files. In the case of LockBit, this file is named Restore-My-Files.txt. Once all relevant files are done being encrypted, LockBit 2.0 changes your desktop background to alert you to read this file, then shuts itself down. 

I can stop this! 

Maybe you happen to notice your files being encrypted early in the process. No problem, just restart the computer to stop the ransomware from running, right? It’s a nice thought, but by the point files are being encrypted, LockBit has already updated the settings to automatically start it when the computer restarts. The encryption process will begin immediately on startup, and will continue until everything relevant has been encrypted.  

This type of persistence is common in ransomware, because the attackers want to ensure that they steal and encrypt as much of your data as they can. 

What’s the point then? 

If ransomware is used on any target that the attackers can find, and it’s nearly impossible to stop once it’s found its way in, what is the point of worrying about it? Again, the answer is simple, because you can take steps to stop it before it starts.  

Now is the time to look into options for securing your computers, rather than waiting until after all of your data is lost. Make sure that you have a multi-layered solution like Acronis that protects against ransomware, and other types of malware, and even provides a protected backup solution to be able to restore files if something does happen to get past the other measures you have in place.  

With attackers constantly looking for new ways to get in and infect your computer, it is more important than ever to plan for any potential attacks, and implement a solution that will minimize any damage or inconvenience this may cause. 

[In the next part of this three-part series, we’ll look at how to counter the LockBit infection.] 

Topher Tebow is a cybersecurity researcher, focusing on community collaboration and threat analysis. Topher has been working with malware and other cyberthreats for more than a decade, beginning with web-based malware before moving into endpoint protection. Topher has written technical content for several companies, covering topics from security trends and best practices, to the analysis of malware and vulnerabilities. In addition to being published in industry publications like Cyber Defense Magazine and Security Boulevard, Topher has contributed to articles by several leading publications, and spoken at international cybersecurity events.