August 2017 - Ophtek

Malware Upgrades to 64-Bit

Aug 2017

Modern operating systems run on 64-bit systems, but they’re still capable of running 32-bit code and this is what hackers have always coded in. Until now.

Guy Propper – security expert at Deep Instinct – has revealed that whilst malware coded in 32-bit code is still as popular as ever, there’s been an increase in the number of 64-bit variants. This is somewhat of a game changer in terms of the cyber security landscape due to the unchartered territory that 64-bit malware operates in.

You’re probably well aware that out-dated legacy systems can provide an unsecured route into your systems, but you would think that a new, up to date system would provide you with a secure defense. Unfortunately, as 64-bit malware is so new, the amount of available knowledge on combatting it is scarce, so it’s a very real threat to contemporary computing.

And that’s why you need to learn the ins and outs of this new threat before your systems fall victim.

32-Bit vs 64-Bit Systems

Windows 95 ushered in the era of 32-bit systems and this allowed applications to use up to 4GB of memory to complete their tasks. That was more than enough for applications of the time but, as applications have become more and more advanced, they can now demand more than 4GB of memory. And this is where 64-bit systems come in due to their ability to allocate huge areas of memory over to applications.

The Threat of 64-Bit Malware

It’s only recently that 64-bit systems have begun outselling 32-bit systems, so they’re finally becoming the dominant system; as a result, hackers have started adapting their malware to suit this new frontier. Of note, the ransomware installer Zeus and the computer virus Shamoon – capable of leaving your PC unable to boot up – have been discovered to have 64-bit partners in crime alongside their 32-bit malware code.

The main problem with 64-bit malware is that it’s more difficult to detect than 32-bit malware and this is because most antivirus signatures only search for 32-bit malware. This means that they’re looking for specific pieces of code and system activity, but these are not associated with the 64-bit malware variants as they constructed in a completely different manner. Therefore, they can remain undetected on your system and remain relatively free to carry out their malicious activities.

How Do You Combat 64-Bit Malware?

As more and more consumers adopt 64-bit systems, there’s going to be an ever increasing number of 64-bit malware variants. Naturally, as time goes by, security experts are going to be able to recognize and defend against such threats in a more efficient manner. Unfortunately, that doesn’t really help people in the here and now.

However, the good news is that 64-bit malware is transmitted and executed in much the same as 32-bit malware. And this means that the traditional methods for combatting malware are just as effective, so make sure that you’re actively doing the following:

Treat all suspicious email attachments as exactly that – suspicious! If there’s even the slightest doubt about an email then don’t open any attachments, get it checked out by your IT team.
You should already be monitoring the network activity of your applications to identify any unusual behavior, but it’s worth setting up a separate monitor to keep a check on 64-bit applications. This may be the only way, at present, that you can identify an infection
Finally, educate your staff on the dangers of malware. This can take place during IT induction processes, but also regular refresher courses to keep the information fresh and relevant in your employees’ minds.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Windows 10S is NOT Immune from Ransomware

Securitysecurity, WindowsOphtek, LLC

Aug 2017

Microsoft has claimed that their latest upgrade to Windows 10 (10S) is immune to all known ransomware. However, it appears that this isn’t quite true.

Windows 10S is a streamlined upgrade of Microsoft’s current operating system (OS) and it promises increased speed, stability and security. Naturally, this claim of invulnerability is certainly impressive, but, effectively, it’s also issued a challenge to the online community to test the strength of this security.

It’s a brave move, perhaps one which was necessary after the various security issues with Windows 10 shortly after its launch, but it’s now looking rather embarrassing for Microsoft as Windows 10S has already been breached.

Hacking Windows 10S

Launched at the start of May, Windows 10S survived several weeks without having its defenses breached, but this security has now come tumbling down. Security expert Matthew Hickey of Hacker House managed to make his way through the security capabilities of Windows 10S in just three hours.

How did he do this though? Microsoft, after all, should know a thing or two about security, right? Well, Hickey actually employed an old fashioned technique of hacking called DLL injection. A particularly sneaky form of hacking, DLL injection runs malware within a running process that is deemed not capable of carrying a threat by the operating system in question.

This hack was carried out by one of the most common malware attacks seen in contemporary hacking, a Microsoft Word document packed full of malicious macros (automated commands). Although Microsoft Word now has an anti-malware system, this does not detect issues with files that have been shared on the network – which is exactly where Hickey had downloaded the infected document to.

Hickey was then able to activate the malicious payload in the Word document and found he was able to take control of the PC by giving himself full administration privileges. Using Metasploit – software designed to look for loopholes in cyber defenses – Hickey eventually managed to secure himself full system privileges. And this meant, in theory, that he could begin disabling firewalls and anti-malware software.

With the system’s defenses completely disabled, Hickey could easily have installed ransomware on the PC, but he refrained from doing this in order to protect other PCs on the network.

An Unhackable OS?

At no point did Microsoft claim that Windows 10S was 100% protected from any form of hacking, but by claiming that it was safe from ransomware they were setting themselves up for a mighty fall. And now that Matthew Hickey has revealed just how easy the hack was – and a three hour hack is relatively quick in terms of a previously unhacked operating system – it’s likely that even more exploits will be revealed.

And, although Hickey’s attack was a ‘friendly’ hack, it underlines just how fragile cyber security can be. Despite all the bold claims by Microsoft, Windows 10S doesn’t appear to be any more secure than previous versions and this is very troubling for consumers.

Once again, user knowledge and awareness is highly important as the root cause of this attack was an infected Word document. Your employees must understand the important of identifying malware and not rely on software as, even when Microsoft are involved, it’s impossible to claim something is secure enough to give you full protection.

For more ways to secure and optimize your business technology, contact your local IT professionals.

5 Ways to Combat Malware

Office IT, Securitymalware, office IT, staffOphtek, LLC

Aug 2017

The impact of a malware attack can be highly problematic for organizations, but if you know how to protect yourself, it doesn’t have to be so bad.

Whilst it’s certainly easy to know when you have been hacked, it’s just as easy to prevent falling victim to malware in the first place. And when you consider just how devastating a malware attack can be, the need for this prevention suddenly becomes apparent.

To help keep you on the right side of security, I’m going to show you 5 ways to combat the threat of malware.

Educate Your Team

The best form of defense against malware isn’t necessarily state of the art software combined with highly paid security experts, it’s actually your own employees. And this is because almost all malware attacks are down to human error such as opening an infected email attachment or falling for a phishing email scam.

However, by educating your employees, you can begin to inform them on the number of different methods that hackers may use to launch a malware attack. Knowledge is a highly valuable weapon when dealing with malware, so make sure your employees are armed with the relevant information to help protect your systems.

Run ALL Updates and Patches

Security vulnerabilities in software are one of the most common routes for hackers to deliver their malware to your system. Thankfully, many of these security vulnerabilities are picked up the software publishers and updates/patches are released to rectify these flaws.

Once these vulnerabilities are public knowledge, though, the hackers are bound to try these routes in their next set of attacks. And the hackers know that many people fail to install updates/patches as soon as they’re prompted, so this can severely compromise their system.

Segment Your Network

Older devices on your network may – due to the age of their relevant operating system – no longer receive support or patches and this puts them at an immediate risk from malware. Rather than leave these devices on your main network, it’s recommended that they’re taken offline and have a separate network for these devices with no internet connection. Immediately, by taking out the weak links, you’ve strengthened your defenses.

Use Antivirus Software

Sure, antivirus software is usually a day or two behind any major malware attacks, but it still remains a fantastic way to cope with the day to day threats of malware. Helping to identify the most well-known and common malware threats, antivirus software can help to significantly reduce the risk of a malware attack taking place on your systems. Not only can they quarantine the threat (to help aide identification), but they can also put an immediate end to that piece of malware.

Backup ALL Your Files

With ransomware becoming a bigger and bigger threat to your data, it would certainly pay to make regular backups of ALL your files. With this data backed up, even if you do fall victim to a ransomware attack, there’s no need to pay the ransom as you can simply access your backed up data. However, please note that you need to keep at least one copy of this data offline in order to protect yourself fully.

For more ways to secure and optimize your business technology, contact your local IT professionals.

IBM Ships Malware Infected USB Drives by Mistake

hardware, Securitymalware, usbOphtek, LLC

Aug 2017

Malware is a particularly virulent strain of hacking and can spread very quickly. However, when it gets help from a tech giant, it can spread even quicker.

It’s now been discovered that IBM have, quite accidentally, managed to ship USB flash drives containing malware. Now, the hacking threat of USB sticks is a readily acknowledged problem in the world of computing, but these attacks originate from anonymous, concealed hackers. IBM, obviously, haven’t gone out of their way to commit such malicious attacks, but the fact remains that it was their product which was used to help spread this infection.

It’s a highly embarrassing revelation for IBM and, once again, reinforces the fact that you need to be continuously on your guard against malware. Let’s take a look at exactly what happened and how one of the biggest names in computing found themselves duped into becoming a delivery method for malware.

How IBM Infected its Customers

Organizations are constantly facing a battle to create more storage for the increasing amounts of data involved in business, so IBM created the Storwize storage system. The installation tool shipped with the Stowize V3500, V3700 and V5000 is housed on a USB flash drive for ease of use, but it’s this flash drive which has been pre-loaded with malicious software.

Normal installation of the IBM tool usually takes place in a temporary folder on the computer’s hard drive, but the infected drives also install a malicious file to this temporary folder. This malicious file then sets about editing the user’s system registry in order to load up the malware every time the user logs on. A number of different Trojans – such as Pondre, Reconyc and Faedevour – have all been detected on the USB drives and this points towards the involvement of cybercriminals.

Naturally, IBM is very embarrassed by the whole fiasco and have been reticent to disclose information on how these USB drives came to be infected and just how many users are at risk. What they have advised is that the infected flash drives will have the part number ‘01AC585’ clearly labelled on them, so, at the very least, IBM customers can quickly check if they’re open to infection.

Treating the Infection

IBM’s immediate solutions to the infected USB drives are as follows:

Run your antivirus software to identify and remove any threats. The Trojans contained on the USB drives are well known and easily treated once caught.
Destroy the drive as soon as possible to completely eliminate the threat. IBM have now made the required (and non-malicious) software available on their website, so the need for the USB drive is now redundant.

Whilst this should rectify the risk of your system becoming compromised, it does little to quell the bad PR it’s caused for IBM. It also hammers home the fact that hackers are looking for more ingenious ways to deliver their malicious payloads, even having the nerve to piggyback their way onto systems through official IBM products. Obviously, the telltale signs of infections will still be there, so if you aren’t already running the following checks, you should certainly start:

Regularly monitor network activity to identify any unusual behavior. Malware will often cause a spike in traffic to your network.
Run regular antivirus checks to capture any malicious software.
Ensure that security patches and updates from software/hardware suppliers are quickly actioned to help secure their products and your data.

For more ways to secure and optimize your business technology, contact your local IT professionals.

4 Ways That Hackers are Targeting Your Employees

Office IT, Securityphishing, social hackingOphtek, LLC

Aug 2017

Hackers are now turning to employees of organizations to help breach their defenses and this can be knowingly or unknowingly, but how are they doing it?

As this hacking technique doesn’t rely purely on digital attacks, it’s a unique problem in the world of cyber-security. Sure, the end result is the same in that the hackers want to access digital information, but this method of getting a head start makes their attacks more covert than ever.

To help you understand how these exploits can be initiated and unfold, I’m going to show you 4 ways that hackers are hacking your employees.

USB Stick Hacks

USB sticks can cause huge issues for your PCs due to the amount of automated hacking software which can easily be loaded onto them; in some extreme cases, USB sticks can also be used to completely destroy a PC. More often than not, these attacks can be initiated by old fashioned human curiosity. A recent study showed that of 297 flash drives left in a college parking lot, over half of these drives ended up being plugged into a PC. Therefore, staff need to be made aware that unauthorized devices should never be plugged into their workstations.

Website Information

Many organizations display details of their employees on their website in order to show the people behind the business. Whilst this is a great method for engaging customers and clients, it also allows hackers to begin building a portfolio of information on targeted individuals e.g. with access to photos and email addresses, it’s possible to not only target these email addresses, but actually track them down in real life. This opens up your employees to direct approaches and is a good reason why information about employees should be minimized on the public internet.

Phishing

The oldest, and perhaps simplest, method of hacking employees is by phishing. Deceptively convincing, phishing attacks often take the form of genuine looking emails requesting personal information. The most common technique is for the hacker to fake a company email in order to obtain sensitive data e.g. emails are often dispatched which appear to originate from the organization’s IT department and request login details, but actually originate from outside the business. Employees need to receive regular training on how to spot phishing emails.

Vishing and Smishing

A relatively new approach to hacking employees is via vishing (obtaining information via phone calls) and smishing (mining for data through SMS messaging). Vishing often takes the form of a phonecall from a potential customer, but it’s actually a hacker trying to learn information about the organization’s structure and security through careful questioning. Smishing tends to target employees with links that they’re encouraged to click and then forwards them to a phishing website to extract data. Again, good training is crucial to ensure your staff can recognize these threats.

These four methods of hacking your employees use a number of highly sophisticated methods that prey on human curiosity and misplaced trust. They’re also remarkably easy to execute, so the key is to remember that regular training to increase awareness is the best defense against such attacks.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Monthly Archives: August 2017