Malware and Virus Protection

November 6, 2018 by Joseph Martin

McAfee has long been a popular target of scammers, but recently, they’ve changed the nature of their game.

In years past, they’d display a webpage informing you that any McAfee products on your computer are out of date and provide a link to the company’s virtual storefront where you could renew.

Unbeknownst to the people clicking on those links, they were being redirected by an affiliate link, so any purchases made would generate a commission for the site owners.

It was an unscrupulous, underhanded tactic, but not an especially malicious one. Now though, they’re doing something a bit different and darker.

The same page pops up as before, notifying users that their products are out of date. This time, when a user clicks to renew their products, instead of being sent to the McAfee website, they’re simply presented with a capture box that asks for their credit card and personal information.

Assuming you enter that information in, it gets worse.

After “paying” for your purchase, you’re redirected to another webpage with a technical support phone number. The idea is, you call this number and the technician on the other end of the line will help you install your new software.

When you get someone on the phone, the “tech support representative” will ask to remotely connect to your computer.

Once they have access, they’ll tell you that your credit card information didn’t go through, and that you need to purchase the software again. They’d then helpfully open a browser and guide you to the McAfee website, via an affiliate link.

It’s a triple play. Not only are they earning a nice commission when you purchase the software via their affiliate link, but they also manage to get your credit card and personal information. That information will no doubt be put to use not long after you hang up the phone, and on top of that, they’ve got access to your device.

As ever, the best defense against scams like these is vigilance.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

November 1, 2018 by Joseph Martin

If you take a lot of photos with your Android device, you’re probably constantly on the lookout for a better way to organize them and access them. That’s exactly what the authors of the malicious app called “The Album, by Google Photos” are hoping for.

The app put in a brief appearance on the Microsoft store, where it claimed to be from Google but it’s clearly not. Unfortunately, the authors have gone to great lengths to make it appear legitimate, and as such, it has been downloaded and installed an alarming number of times.

When this app is installed and run for the first time, users are presented with a (legitimate) Google sign in page. It is not known whether the authors of the app siphon user login credentials from this page, but it’s certainly possible. So if you have installed the app but haven’t run it yet, don’t log in.

Once you’re logged in, the app will connect to a malicious URL and download a configuration file. Using the information contained in the config file, it will begin running in the background, displaying ads invisibly and then clicking on them, earning revenue for the app’s creators and slowing your Android device to a crawl in the process.

Note that the authors were careful, but only to a point. Although the ads themselves are invisible, if those ads have an audio component, the user will hear the sounds associated with the ad, although of course, they won’t have any clear indication of where the sounds are coming from. This is, in fact, how researchers became aware of the malicious nature of the app.

If you’ve downloaded this app, please uninstall it immediately. Doing so will improve your device’s performance and stop those sounds that have no apparent source from troubling you further.

Joseph Martin

October 24, 2018 by Joseph Martin

Gamers take the games they play seriously. So seriously, in fact, that they’re not above resorting to dirty tricks to score a win.

Recently, social media has been abuzz with reports of a messaging app bug on Sony’s PlayStation devices. Specifically, there’s a bug in both the Android and iOS messaging apps that allow malicious gamers to send a poisoned character via group chat that will brick your gaming console.

If you’re in the middle of a tense death match, you lose by default, because you’re booted from the system entirely.

Here’s an example of what we’re seeing on Reddit:

“There is a new glitch that basically bricks your console and forces you to factory reset it. Even deleting the message from the mobile app doesn’t work. It happened to me during Rainbow Six: Siege. A player from the other team used a dummy account to send the message and crashed my entire team. We all have had to factory reset. Only one of our guys wasn’t affected, and he has his messages private.”

This note holds the key to the workaround until Sony makes some type of official response. If you haven’t yet had the dubious honor of being the recipient of this poisoned message, set your messages to private immediately.

Here’s how you do that:

Go to “Settings” and select “Account Management, Privacy Settings”

Enter your password

Select “Messages” and change it to either “Friends Only” or “No One,” then exit out of the subsystem. You’re all set from there.

If you’d rather change your message settings from your PC and a web browser, you can do that too, though the process is a bit different.

Here’s how:

From your PC, surf your way to the PSN Privacy Settings Management Page

Select “Personal Information/Messages”

Select “Edit,” then change the setting to either “Friends Only” or “No One.” Save and exit.

Joseph Martin

October 9, 2018 by Joseph Martin

According to this year’s Traveler’s Risk Index, published by The Traveler’s Indemnity Company, a majority of business owners have a somewhat fatalistic view of hacking and data breaches.

The index includes 52 percent of survey respondents indicating that they believe a cyber-attack is inevitable.

The other statistics in the report paint a grim picture. Here’s a quick overview:

55 percent of business owners say that they have not completed a cyber risk assessment

63 percent say that they have not yet completed a cyber risk assessment on vendors who have access to their data

62 percent indicate that they have not yet developed any kind of business continuity plan, which means they don’t even have the basic outline of the steps they’ll need to take in the face of a successful attack against their company

The number of survey participants saying they have been the victim of a cyber attack has doubled from 10 percent in 2015 to 20 percent in this year’s survey

Yet in spite of this staggering lack of preparation, fully half of all survey respondents say they have cyber insurance.

Tim Francis, the Enterprise Cyber-Lead at Travelers, had this to say about the report:

“Cyber risks carry serious consequences for any business, threatening everything from revenue to operations. These findings reveal some surprising things about how companies view their cyber exposure, their relative confidence in dealing with them and the clear opportunity that exists for them to be better prepared for a cyber-attack.”

It’s a thorny problem, for sure. Most small to medium sized business are strapped for cash and simply can’t dedicate the level of resources they’d like to toward data security.

The good news is that this most recent survey reveals a few simple, low-cost things you could do starting today that would dramatically improve your chances of dealing with a cyber-attack. Given that most people agree it’s inevitable and just a matter of time, that would be an excellent place to start.

Joseph Martin

September 26, 2018 by Joseph Martin

We’ve known for some time now that the next big crisis the internet will have to come to grips with is the dramatic rise of the Internet of Things (IOT).

The problem isn’t with the devices themselves, which are enormously helpful and rapidly growing in their popularity. Rather, it lies in the fact that the overwhelming majority of IoT manufacturers have been notoriously lax when it comes to building even basic security protocols into the goods they make and sell.

The lack of security and the complete absence of any type of security has made the Internet of Things the new “low hanging fruit” of the internet, and hackers have been happy to take advantage of the incredibly easy access.

Kaspersky Lab has recently given us hard numbers to provide a sense of the scope and scale of the problem.

Last year, the company detected a total of 32,615 malware infections on IoT devices. In just the first six months of this year, the company has spotted 121,588 infections on IoT devices, representing a staggering 273 percent increase.

Far and away, the most commonly compromised devices were routers. Behind them were a whole raft of other IoT devices including smart TVs, refrigerators, DVRs, printers, washing machines and more.

Things have gotten so bad that earlier this year, the FBI issued a public service announcement in a bid to warn users of the dangers of unsecured devices.

These can be slaved by hackers to create enormous botnets like the one that brought down the internet on the entire eastern seaboard earlier this year. However, if they are connected to your home or office network, they provide a perfect launchpad for attacks against other network connected devices.

Sadly, manufacturers to this point have shown little interest in beefing up the security of the devices they sell, so the problem is likely to get much worse before it starts getting better.

Joseph Martin

September 25, 2018 by Joseph Martin

There’s a new report out, authored by ProofPoint, and its findings for business are grim.

It’s no secret that businesses of all shapes and sizes are coming under increasing fire from hackers around the world.

Now we have hard data that shows us exactly how big of an increase we’re seeing.

Here are some of the key findings in the report:

Email fraud attacks targeting businesses have increased 25 percent in the last quarter alone

They have increased by a staggering 85 percent from this time last year

Phishing links sent via social media platforms have increased by 30 percent

60 percent of those phishing links specifically targeted individual contributors and lower-level corporate management

23 percent of attacks targeted employees working in operations and production

Incidents of customer support fraud increased by 39 percent, compared to the previous quarter. This increased a whopping 400 percent compared with this time last year

Nick Frost (a co-founder of the Cyber Risk Management Group) had this to say about the disturbing report:

“Key to this is engineering emails and spoofing email addresses to a level of sophistication that fails to alert the recipient that there is anything suspicious about the email. Techniques such as web crawling and web scraping are able to collect and collate key information about an individual that can be used in crafting an email, accompanied by a link (as part of a phishing attack) to an unsuspecting user.

Whilst there are many legitimate web crawlers and many are enabled for business reasons, there may be organizations and individuals that wish for their information not to be collected and shared either for legitimate or adversarial purposes. There are tools that organizations can adopt that prevent or even delay web crawlers.”

Training is the first line of defense here. If you’re not doing it already, you should be holding regular phishing simulations so your employees become adept at spotting them.

Joseph Martin

September 12, 2018 by Joseph Martin

2017 was “The Year of Ransomware.” It saw an incredible number of ransomware attacks and infections, paired with a tremendous number of innovations.

Although 2018 hasn’t seen quite the same level of ransomware activity, it’s still a major threat with one company coming under attack about every ten minutes.

Although there haven’t been as many innovations so far this year, that doesn’t mean they’re not occurring, and some of the new ransomware strains are particularly nasty.

Of interest, this year has seen a rise in ‘Cryptojacking’, which is a variant of a classic ransomware attack where the malware mass encrypts files on the victim’s machine while simultaneously installing cryptocurrency mining software.

This should come as no surprise given the rise in popularity of cryptocurrency, but it does add a disturbing new wrinkle to ransomware attacks. Even after you get your files back, lurking in the background there is a rogue process that’s slowing your system and ultimately putting money into the bank accounts of the hackers.

Most recently, an Obama-themed cryptojacker has been making the rounds.

The ransomware itself is nothing out of the ordinary. It predictably locks your files, demands payment, and installs a Monero miner in the background.

Obama is not the first world leader to unwittingly become the face of ransomware. In 2016, Candidate Trump was featured in a malware strain that proved to be a work in progress. It would infect machines, but didn’t actually encrypt files. It’s unclear if a working version was ever deployed in the wild.

The Obama strain contains code fragments that indicate Chinese origin. There’s circumstantial evidence that leads some security researchers to believe it may be the work of a Chinese hacker known only as “Rocke,” but so far, there’s no definitive proof.

As things stand now, there’s no good defense against this most recent threat, save for continued vigilance.

Joseph Martin

September 5, 2018 by Joseph Martin

Quick question – how much do the world’s cyber criminals make every sixty seconds?

If you guessed a quarter of a million dollars, you’d be wrong. If you doubled that value, you’d be wrong again.

According to research conducted by RiskIQ, cybercriminals are raking in a cool million dollars per minute, compared with businesses spending $171,233 per minute on security measures. It’s a lopsided battle, and businesses aren’t winning.

Some other interesting tidbits culled from the company’s research. Every sixty seconds:

Four new potentially vulnerable web components are discovered.

A new website appears running the CoinHive cryptocurrency mining script.

1.5 companies fall victim to a ransomware attack, with an average cost to the victimized company of $15,221.

In addition to that, RiskIQ discovered that a site running the CoinHive script was deleted every ten minutes, and that a new phishing domain appears about every five minutes.

Raef Meeuwisse, a security researcher and author, had this to say about the report and its findings:

“Cybercrime and cybersecurity co-exist in a constant cycle of innovation. As one particular criminal trend towards a particular technique increases, so the security functions create or strengthen the required defenses.

However, it is evident at both the level of personal and organizational cybersecurity that spending is unusually low. In fact, most of these cybercriminals are not going after the hard targets with great defenses, they are targeting the low hanging fruit – and there is still far too much of it.”

The simple truth is that until and unless we start taking cybersecurity more seriously, and until the aforementioned “low hanging fruit” ramps up spending to properly secure their systems, we can expect to see the number of cybercrimes continue to increase. Unfortunately, despite the crimewave, there doesn’t seem to be much motivation to do that.

Joseph Martin

September 1, 2018 by Joseph Martin

Android users have a new threat to contend with, according to a sixteen-page whitepaper outlining a new malware strain.

The paper was published by a group of security researchers working for Bitdefender. They identified a robust new strain of malware called “Triout.”

According to the report, although they just discovered the malware a month ago, there are indications that it has been in use since at least mid-May of this year.

Among other things, it can:

Steal call log data

Collect and steal SMS messages

Record every call taking place on the phone

Upload recordings of those calls to a remote server

Send the phone’s GPS coordinates to a remote server

Upload a copy of every picture taken with the phone’s camera to a remote server

Hide from the user’s view

These are robust, highly advanced features that require extensive, detailed knowledge of the Android OS. Typically, malware of this type is used by nation-state hackers with deep pockets, or by well-heeled networks of cybercriminals. At this point, there’s no clear indication which category Triout’s creators fall into.

The malware strain has been found masquerading as a legitimate app, but the team has been unable to trace it back to its source of origin. At this point, there’s no clear indication where it’s coming from. The first sample was uploaded to VirusTotal from Russia, but subsequent samples were uploaded from an Israeli IP address.

The researchers note that despite its advanced feature set, the group responsible appears to have made a mistake:

“What is striking…is that it’s completely obfuscated, meaning that simply by unpacking the cloned app’s .apk file, full access to the source code becomes available….this could suggest that the Triout framework may be a work-in-progress, with developers testing features and compatibility with devices.”

Joseph Martin

August 25, 2018 by Joseph Martin

Depending on the lens you view him through, Patrick Wardle (former hacker for the NSA and macOS security expert) is either your best friend or your worst nightmare.

Most people (whether fans of Apple or not) will readily concede that the company works hard to make their products as secure as possible. Unfortunately, at this year’s Def Con hacker convention in Las Vegas, Wardle made a presentation that is currently sending shockwaves through the Apple user community. He exposed a major security flaw in the company’s products that impacts many of their secondary defensive measures.

Normally, when an Apple device detects an action that is potentially malicious, Apple’s OS will block it, then display an alert box to let the user know.

Unfortunately, as Wardle demonstrated, it is a trivial task for a hacker to generate a “synthetic click” to dismiss the warning box. This could be done in the blink of an eye, or with only slightly more effort, and be made utterly invisible to the end-user.

As Wardle puts it, “The ability to synthetically interact with a myriad of security prompts allows you to perform a lot of malicious actions. Many of Apple’s privacy and security-in-depth protections can be trivially bypassed.”

This is hardly a new trick. Over the years, several malware strains have used synthetic clicks to dismiss warning boxes, so Apple is certainly no stranger to the strategy. In response, they have given their OS some ability to detect and ignore synthetic clicks, but as Wardle demonstrated, it’s far from perfect and even a fully updated High Sierra system was not completely protected.

Wardle concluded his presentation with the following: “I wasn’t trying to find a bypass, but I uncovered a way to fully break a foundational security mechanism. If a security mechanism falls over so easily, did they not test this? I’m almost embarrassed to talk about it.”

Apple has not yet responded to Wardle’s presentation.

Used with permission from Article Aggregator

Joseph Martin

Contact Info

Navigation