Malware and Virus Protection

Fax Machines Might Be Gateway To Next Hacker Attack

August 24, 2018 by Joseph Martin

Nothing bad could possibly happen to your company’s network if the only piece of information the hackers have is your fax number, right?

Unfortunately not, according to recent research by employees at Check Point.

They recently revealed details about not one, but two different REC’s (Remote Code Execution) techniques that exploit flaws in the communications protocols of tens of millions of fax machines spread all over the globe.

If you think the Fax machine has largely gone the way of the dinosaur, think again. Many printers sport “all in one” functionality, which includes both scan and fax functionality, and therein lies the problem. Since these printers are invariably attached to your network, your fax number is a good a way in, since most people don’t even think about it.

Called the “Faxploit,” the new attack type involves a pair of known buffer overflow vulnerabilities, CVE-2018-5925 and CVE-2018-5924, which allows anyone who takes advantage of them to have the ability to execute code remotely.

The researchers who discovered the issue created a proof of concept video demonstrating the attack in action. In their demo, they made use of an HP Officejet Pro 6830 and an OfficeJet Pro 8720, sending an image file with a malicious payload through the phone line. The moment the fax machine receives it, the image is decoded and uploaded into the fax/printer’s memory.

From there, the sky is the limit. Having gained a foothold on the network, what happens next is entirely dependent on the nature of the payload delivered. One thing you can be sure of, however, is that none of the outcomes you can expect will be good.

The researchers point out that there’s nothing special about the two all in one printers they selected, and the vulnerability will work on just about any make or model. Something new to be worried about.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Connecting To Aiport Wi-Fi Puts Your Data At Risk

August 9, 2018 by Joseph Martin

File this away under things you already knew. Coronet recently released a report entitled “Attention All Passengers: Airport Networks Are Putting Your Devices & Cloud Apps At Severe Risk,” and the news is about what you’d expect.

The report was more than five months in the making. The analysts poured over oceans of data on device vulnerabilities and Wi-Fi network risks from more than a quarter of a million consumer and corporate endpoints that passed through the 45 busiest airports in the United States.

The bottom line is simply that airport Wi-Fi is woefully unsafe, especially as compared to most corporate networks, and anyone connecting to those networks is asking for trouble.

Some offenders proved to be worse than others. The report names the San Diego International Airport, John Wayne Airport – Orange County (CA), and the William P. Hobby International Airport (Houston, TX) as being among the least secure in the nation.

The risk is that while traveling, most people don’t think about what network they’re connecting to or how secure it might be. This is an incredible opportunity for hackers, because once an employee’s laptop or mobile device is infected, the integrity of the employers’ cloud-based work apps is jeopardized.

Coronet’s founder, Dror Liwer, had this to say about the findings:

“Far too many US airports have sacrificed the security of their Wi-Fi networks for consumer convenience. As a result, business travelers in particular put not just their devices, but their company’s entire digital infrastructure, at risk every time they connect to Wi-Fi that is unencrypted, unsecured, or improperly configured.

Until such time when airports take responsibility and improve their cybersecurity posture, the accountability is on each individual flyer to be aware of the risks and take the appropriate steps to minimize the danger.”

Be sure your employees are aware of the risks any time they travel. Your company’s future might depend on it.

Joseph Martin

E-Mail Is A Big Threat To Your Organization

August 4, 2018 by Joseph Martin

Mimecast’s 2018 “State of Email Security” report is out, and although it’s contents are hardly a surprise, the news it contains is mostly bad.

For starters, it confirms what most IT professionals already know:

Email continues to be a big threat for organizations of all sizes.

Unfortunately, the C-Suite (CEO’s, CIO’s, CFO’s, and the like) are a major part of the problem, representing a significant weak link in Enterprise security. Not only are they a prime target for hackers, but according to the survey, 40 percent of respondents agreed that their organization’s CEO was a painfully “weak link” in their organization’s cyber-security operations.

Just as alarming, 31 percent of respondents said that C-level employees are very likely to have accidentally sent sensitive or proprietary information to the wrong person, a statistic up 9 percent from last year.

In addition to that, email is the primary means by which ransomware winds up getting inside company networks. This comes with a staggering 92 percent of successful ransomware attacks arriving via that channel, resulting in three or more days of downtime for the impacted companies.

Phishing attacks also continue to be a major issue, with 90 percent of respondents reporting an increase in the number of phishing attacks they were subjected to.

In light of these statistics, one would imagine that companies would be devoting significant resources to countering the threat. Unfortunately, that’s just not happening. Sure, money is being spent on infrastructure, but humans are the weakest link in this chain, and not just in the C-Suite. According to the survey, only 11 percent of organizations continuously train their employees on how to spot cyberattacks, and just over half (52 percent) perform training just once a year.

Matthew Gardiner, a cyber-resilience expert at Mimecast, summarizes it this way :

“Security awareness is an important part of any high-functioning security program. But like all security controls, there is no silver bullet solution. The best security programs seek a balance between technical controls, boosting their human firewalls, and having IT enabled business processes that are resilient to failures, whether man-made or caused by technology.”

Indeed.

Joseph Martin

New Report Shows 32 Percent Increase In Cyber Attacks

July 28, 2018 by Joseph Martin

Positive Technologies has just released a new report that paints a grim picture for IT professionals. If your sense is that the number of cyberattacks are increasing, you’re not wrong. In fact, it’s probably worse than you realize.

So far this year, we’ve seen a staggering 32 percent increase in the total number of cyberattacks in the first quarter of 2018, compared to the same period last year. Even worse, malware attacks have increased by a mind-bending 75 percent since the first quarter of 2017.

Individuals were far and away the most frequent target (28 percent), but government agencies came in a reasonably close second (16 percent), with business in the healthcare, finance, and IT sectors rounding out the top five (8 percent, 7 percent, and 5 percent, respectively).

Of the malware deployed against targets this year, spyware was by far the most common, with stealth cryptocurrency mining software not far behind.

Leigh-Anne Galloway, the cyber security resilience lead at Positive Technologies explains in more detail:

“Our research shows that 63 percent of attacks included use of malware. Spyware, in particular, is used most often because it allows obtaining not only personal information and corporate secrets, but credentials for the services and systems needed to attack internal corporate infrastructure.”

Long story short, the prevalence of spyware seen in this report is likely to have cast-off effects in the future. Hackers will gain a sufficient level of access and information, courtesy of their successful spyware attacks, to launch even more harmful attacks against both individuals and government/corporate institutions in the future.

Positive Technologies warns that the number of attacks is likely to continue to escalate, and that there’s no clear end in sight.

The report is dark news if you’re in the digital security business. If your business hasn’t been hit yet, it seems that it’s just a matter of time.

Joseph Martin

Malware Created Using Stolen Legitimate Security Certificate From D-Link

July 21, 2018 by Joseph Martin

Researchers from the digital security firm ESET have recently spotted a new malware campaign with a nasty twist. It was created using a legitimate security certificate stolen from D-Link.

The malware appears to be the work of an Advanced Persistent Threat group known as BlackTech, which primarily targets high profile users and firms in Asia, with a

particular emphasis on Japan, Hong Kong and Taiwan.

BlackTech is responsible for two different malware families, PLEAD and the DRIGO exfiltration tool, both of which have been found to be using the stolen certificate. ESET has also found the compromised certificate in the source code of a password stealer designed to scrape passwords from Google Chrome, Internet Explorer, Mozilla’s Firefox, and Microsoft Outlook.

ESET reported their findings to D-Link, and company officials opened a formal investigation into the matter. They ultimately discovered not one, but two compromised certificates, both of which were revoked immediately.

Even so, this latest discovery underscores one of the dangers of our current global security architecture. Any central point is a source of weakness. In this case, certificates are issued by a central body to provide a layer of trust. Software developers use certificates to demonstrate that they are legitimate pieces of code.

That system works well, right up until the point where a hacker manages to steal one of the “trusted” certificates. Then, the weakness of the security paradigm is revealed.

This is just one of many areas of global network security that needs a top-to-bottom rethink and overhaul. The old methods of securing our vast oceans of data just aren’t working any more. Until something is done to change the game in the favor of security personnel, the hackers are going to have an increasingly easier time breaking in.

As ever, vigilance, however imperfect, is the best defense.

Joseph Martin

Americans Want Local Governments To Spend More On Cyber Security

July 16, 2018 by Joseph Martin

While a significant percentage of Americans are suspicious of government spending beyond the essentials, there’s at least one notable exception, according to a recent survey conducted by SecurityFirst.

A majority (74 percent) of Americans want their local governments to spend more money on cybersecurity.

Here are a few of the highlights from the survey:

64 percent believe that a ransomware attack on local government installations could have serious, long-term impacts

Only 33 percent of respondents believe that their local governments are capable of keeping their data safe in the event of an attack

60 percent believe that a cyberattack could jeopardize essential services, and 77 percent fear that fallout from such an attack could hinder first responders

In terms of the biggest concerns of the citizenry, the data broke out as follows:

74 percent cited potential dangers to local utilities

68 percent cited potential dangers to our court system

68 percent cited potential dangers to local schools

Not long ago, the city of Atlanta suffered just such an attack, which cost them millions of dollars and erased several years’ worth of critical data. The city is still working to recover from the incident. It underscores the fact that the concerns brought to light by the survey are all too real, that citizens are right to worry, and they demand more from their local governments.

Unfortunately, in an age where government spending of any kind almost reflexively comes under intense scrutiny and debate, it remains to be seen whether this and similar surveys will provide any traction to the idea of greater government spending on cybersecurity.

If it does not, then we can expect to see more incidents like the unfortunate attack on Atlanta, with similar consequences. If the past is any indication, the survey will generate a few conversations, but not much in the way of action. Sadly, it will probably take a major attack that costs lives before we start getting serious about protecting local governments and critical infrastructure. Here’s hoping it doesn’t come to that.

Joseph Martin

Watch Out For Rise In Microsoft Office Attacks

July 6, 2018 by Joseph Martin

Menlo Security has recently published a new report that will probably dismay you if you’re a business owner.

Microsoft Office has been named as the attack vector of choice for hackers around the world. The most common form of the attack is a malicious Word document or other office document attached to an innocent looking email.

There are, of course, plenty of other ways to take advantage of various security weaknesses in MS Office and Office 365. These include the use of remotely hosted malicious components embedded within documents that deliver zero-day exploits when the document is opened.

The reason MS Office is such a wildly popular choice isn’t because it has an unusual number of security loopholes that can be exploited (although it’s certainly got its share). Rather, it has everything to do with the overwhelming popularity of the office suite. Simply put, lots of people use it on a regular basis, and that means the pool of potential victims is enormous.

As the report explains:

“There is likely to be an increase in attacks via malevolent email attachments using stealthily embedded, remotely hosted malicious components that leverage applications and operating system vulnerabilities, both old and new.

With CVE-2018-8174 and CVE-2018-5002, the attackers leveraged Word as a vector to exploit Adobe Flash Player and Internet Explorer. By using Word as the vector, the attackers were able to exploit a browser, even if it is not the default browser, and exploit Flash, even though Flash is blocked by most enterprises…Microsoft is therefore undoubtedly going to become the platform that attackers leverage most to deliver their zero-day exploits.”

All true, and beyond troubling. If your business uses Microsoft Office or Office 365 (and odds are excellent that it does), continued vigilance is the key.

Joseph Martin

New Trick Lets Hackers Bypass Office 365 Email Security

June 29, 2018 by Joseph Martin

What’s old is new again.

Hackers have recently begun re-deploying a decade-old trick called ‘ZeroFont’ to get around Microsoft’s security filters and deliver phishing and spam emails to Office 365 email accounts. The gimmick? Zero-point fonts.

As anyone with even passing familiarity to Office 365 knows, if you’re drafting a document, you can change the font size to suit your tastes and preferences. What few people realize is that you can use html code to set your font to zero-point size.

Of course, such a move has no practical application in everyday usage, because no one could read a zero-point font. Hackers, however, can make cunning use of it, and Office 365 is unable to detect the presence of zero-point fonts. Since they’re not detected, they’re not marked as malicious and sail right through the security filters.

By itself, the zero-point trick is useful, but not inherently deadly. Unfortunately, it can be combined with other tricks like Punycode, Unicode, or Hexidecimal code to insert malicious commands into what appears to be a totally innocent email.

It gets better (or worse, depending on your point of view). Just last month, researchers at a company called Avanan discovered that it was possible to use the HTML tag in an email or Office 365 document, point it at a malicious site, and the security filters would blithely ignore it.

Again, it should be noted that these tricks aren’t new. They’ve been around for years, fell out of favor in preference for newer techniques, and now are being recycled. Apparently, they’re so old that they skate right past modern security flags and filters.

Expect updates soon to catch these types of things, but in the short run, just be aware these types of attacks are not only possible, but trivial to execute.

Joseph Martin

Majority Of Web Apps Found To Have Security Vulnerabilities

June 29, 2018 by Joseph Martin

How many web apps do you have on your phone? Probably a ton. Here’s something you likely didn’t know. Based on the latest research from Positive Technologies, nearly half of them (48 percent) are vulnerable to unauthorized access.

As bad as that is, it’s just the tip of the proverbial iceberg.

Here are some additional disturbing stats from their report :

44 percent of the apps with vulnerabilities place the user’s personal data at risk

70 percent are prone to leak critical information stored on the device

96 percent of them contain flaws that would allow any malicious actor to exploit them to launch an attack on the target device

Of those, one in six (17 percent) has a flaw severe enough that it would allow an attacker to assume complete control over the app, and from there, the device itself

The majority of these flaws (some 65 percent) are the result of simple coding errors, with improper configuration of web servers being the most common of these.

There is one bright spot in the otherwise dismal report, though. The percentage of apps with critical vulnerabilities has declined slightly, down from 52 percent last year, and 59 percent the year before. So the numbers, while frustratingly large, are trending in the right direction.

Ed Keary, the CEO of Edgescan had this to say on the topic:

“DevSecOps needs to be embraced such that security is throughout the development pipeline. Application component security management (software components used by developers) is still not commonplace in terms of supporting frameworks and software components and is a common source of vulnerability.”

If your firm designs such applications, pay special attention to this report and review your code base at the earliest opportunity. Even if you don’t, it pays to be mindful of the percentages, because odds are that your employees have several at-risk apps on the devices they’re connecting to your network.

Joseph Martin

Another Vulnerability Found In Intel CPU’s

June 27, 2018 by Joseph Martin

More bad news for Intel. Yet another security flaw has been identified in the processors the company makes. This one is so newly discovered that the full technical details have yet to be released. Here’s what we know so far, from a recent Intel announcement:

“System software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch…Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other process through a speculative execution side channel that infers their value.”

In simpler terms, what this means is that a hacker could use this exploit to gain partial cryptographic keys used by other programs running on the target computer.

While related to the recent Spectre and Meltdown security flaws, this one is different in two ways. First, it’s not quite as severe as the formerly discovered flaws in scope or scale. To make use of this, one would require an incredibly exotic attack that would simply be beyond the capabilities of most hackers.

Also, it should be noted that where Spectre and Meltdown impacted dozens of chipsets dating back more than a decade, the “Lazy FP State Restore” flaw only impacts chips beginning at Sandy Bridge.

The other key difference is that the flaw in this case, does not reside in the hardware. That’s good news for businesses of all shapes and sizes, because it means that when Intel and their hardware vendors have a patch ready, it will be quick and relatively painless to install it.

Unfortunately, since the initial discovery of Spectre and Meltdown, a number of variants of those flaws have emerged, and now this new one. It’s unlikely that this will be the last we’ve seen of these types of issues, so if you’re using Intel equipment, brace yourself. There’s likely more to come.

Joseph Martin

Fax Machines Might Be Gateway To Next Hacker Attack

Connecting To Aiport Wi-Fi Puts Your Data At Risk

E-Mail Is A Big Threat To Your Organization

New Report Shows 32 Percent Increase In Cyber Attacks

Malware Created Using Stolen Legitimate Security Certificate From D-Link

Americans Want Local Governments To Spend More On Cyber Security

Watch Out For Rise In Microsoft Office Attacks

New Trick Lets Hackers Bypass Office 365 Email Security

Majority Of Web Apps Found To Have Security Vulnerabilities

Another Vulnerability Found In Intel CPU’s

Contact Info

Navigation