CopperStealer Malware Shows the Dangers of Illegal Downloads

CopperStealer, Cyber Security, Data Security, Illegal Downloads, malware, Ophtek, , , ,
23
Mar 2021

The world of illegal downloads is a dangerous place to travel to and the emergence of the CopperStealer malware demonstrates why.

Ever since the dawn of the world wide web, there have been illegal downloads. And pretty much anything that runs on a PC can be downloaded illegally. The new Kings of Leon album, the latest Marvel movie or even the most up-to-date version of Microsoft Office can be found online for zero dollars and zero cents. However, the fact that these downloads are illegal means that, aside from the fact that you’re committing a felony, you could download more than you bargained for.

CopperStealer is the perfect example of this dangerous activity, so we’re going to show you exactly what can happen.

What is CopperStealer?

The CopperStealer malware is believed to have been active in the wild since 2019, but its malicious activity has only just been detected. CopperStealer relies on illegal downloads to infect workstations and does this by either masquerading itself as, for example, a Windows 10 install file or by bundling itself with a genuine piece of software. Either way, when the person downloading the file tries to install their illegal software, they will inadvertently install CopperStealer on their system. This allows the malware easy access to PCs and does it with the help of the unwitting victim.

Once CopperStealer has taken hold on a PC it begins working quietly in the background as it harvests user information. In particular, it’s exceptionally hungry for login credentials; details for major platforms such as Amazon, Google, PayPal and Twitter have all been targeted by CopperStealer. These are all websites that are used by organizations to store huge amounts of personal data, so the threat that CopperStealer represents is serious. As well as this major threat, CopperStealer also finds time to download additional malware in order to compromise infected systems even further.

How To Protect Yourself from CopperStealer

There is one simple move you can make to defend yourself against CopperStealer: don’t get involved with illegal downloads. Not only is there the threat of unwanted malware being bundled with them, but you risk installing unpatched software without the safety net of available support. Thankfully, CopperStealer is far from sophisticated, certainly compared to other contemporary malware, and can easily be removed with anti-malware software such as AVG and Kaspersky products. Naturally, you will want to make sure that your anti-malware application is fully up to date to protect against all the latest threats.

Final Thoughts

The temptation of illegal downloads, especially when we are living in a time of economic turbulence, is strong, but it pays to resist it. If, for example, your PayPal credentials are stolen then you and your customers could face some significant financial hardship. Therefore, it’s crucial that you always pay for your software. This will, as discussed, ensure you receive regular updates and patches as well as providing you with peace of mind that your software is clean.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

RAM: What Is It and Why Do You Need It?

Clipboard, Maximum RAM, Memory, Ophtek, RAM, , ,
16
Mar 2021

RAM is one of those terms which is frequently mentioned by IT professionals, but rarely understood by the average PC user. So, what is it?

Random Access Memory (RAM) may sound like a confusing combination of words, but without RAM your PC wouldn’t be able to do a single thing. Therefore, it’s as crucial. The most important element of RAM to focus on is the M for Memory. Much like humans, a PC needs memory to carry out certain tasks. However, RAM is different to human memory in numerous ways. And the best way to understand what it is and what is does is by looking at our lowdown on RAM.

What is RAM?

RAM is the part of a PC which acts as the machine’s memory. Information can be stored and read from the RAM in milliseconds. This allows the RAM to act as a temporary store for data that is either in use or will be required next. The speed with which this data can be accessed is exceptionally quick. Data can be accessed and processed in RAM much quicker than any hard drive, so it should always be the go-to option for loading applications. And, as you would imagine, the more RAM installed on your PC, then the quicker the performance e.g. applications loading quicker.

Why Do You Need RAM?

It wouldn’t be inaccurate to describe RAM as the backbone of your PC’s performance, but a more accurate term to use would be its memory. RAM allows you to carry out the following:

  • Switch Tasks: If you’ve ever switched between applications with the ALT + TAB shortcut then you have your RAM to thank. If you’re working in Excel and then move into Outlook, this order is stored in the RAM. That’s why, if you then press ALT + TAB again, your PC knows to send you back to Excel from Outlook.
  • The Clipboard: The ‘copy’ command is an invaluable process on PCs that allows you to copy information from one location and then ‘paste’ it into another. So, for example, you can copy a paragraph of text from Word and then paste it into an Outlook email. Once you copy the text in question, it is stored on the ‘clipboard’ which is located in the RAM.
  • Loading Applications:When you load up an application, RAM is the starting point. The application will partially be loaded into the RAM to facilitate a fast loading time. However, the application will not be fully loaded into the RAM. The operating system will then head to the hard drive to retrieve the next part of the application and move this into the RAM.

Final Thoughts

The minimum amount of RAM a modern PC should be running with is 4GB, but the amount required is dependent on your needs. If, for example, your PC work involves complex graphic rendering then you would need up to 32GB to handle your workload. RAM is a form of hardware which requires installing into your PC, so always seek advice to determine how much you need.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Microsoft Exchange Email Vulnerability Hits 30,000 US Firms Hard

Cyber Security, Data Security, email security, Hackers, Microsoft, Online Security, Ophtek, Software Security Patches, , , , ,
09
Mar 2021

Vulnerabilities in the Microsoft Exchange Server software have led to 30,000 US businesses being hacked. And it’s a very dangerous hack.

A total of four vulnerabilities have been discovered in Microsoft Exchange Server (MES) which has allowed hackers to carry out numerous attacks. The hackers appear to be part of a Chinese cyber-espionage group who specialize in stealing email communications. It’s believed that hundreds of thousands of firms have been attacked with at least 30,000 of them being US-based. As email is a crucial part of any modern business, it’s not an exaggeration to say that the MES hack is a major threat.

What is the Microsoft Exchange Server Hack?

The MES hack appeared, at first, to be concerned with stealing email data from organizations that were running the server through internet-based systems. The four vulnerabilities, present through MES versions 2013 – 19, allowed the hackers easy access to emails. However, the hackers – who Microsoft have called Hafnium – did not stop at stealing emails. Once they had access to affected systems, they also installed a web shell. This granted Hafnium the opportunity to gain remote access and full administrator privileges. The web shell is password protected and ensures that disrupting the hackers’ access is highly difficult.

Microsoft quickly formulated a security patch to eliminate the vulnerabilities, but many organizations have failed to install the MES patch. As a result, these organizations remain at risk. And, to make matters worse, Hafnium still has them in their sights. Using automated software, Hafnium is actively scanning the internet for any organizations using unpatched versions of MES. This allows the hackers to continue their campaign of data theft and disruption. It also appears that Hafnium is not fussy about who they target. Industries as wide ranging as NGOs through to medical researchers and legal firms have all been infiltrated by the MES hack.

Protecting Against Vulnerabilities

When it comes to attacks such as the MES hack it’s vital that patches are installed as soon as possible. The longer your system is unpatched then the chances of it being breached are exceptionally high. And, if you give a hacker enough time, there’s the chance of additional malware such as ransomware being installed. Setting your updates to ‘automatic install’ is the simplest and quickest way to minimize this risk. This will ensure that any security updates are in place the moment they are available.

But you can’t rely on a patch alone. Patches are not always available in time. And this means that you run the risk of having your systems breached and data stolen. Therefore, make sure that you also implement these procedures:

  • Monitor traffic entering and leaving your network to identify any potential breaches. Unusual levels of traffic can often indicate that hackers have taken control of your network.
  • Segment your network where possible. By separating your network into several different segments, you are limiting the access that a hacker has if they infiltrate your system.
  • Employ two-factor authentication procedures for gaining administrator privileges. This should make it next to impossible for hackers to take full control of your network.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The Danger of Supply Chain Attacks

Hackers, Hacking, Ophtek, Shylock, SolarWInds, Supply Chain, , , , ,
16
Feb 2021

The supply chain is a crucial element in the business world and, accordingly, this makes it the perfect target for hackers to attack.

When a finished product ends up with a consumer it’s the culmination of a lengthy business process. The supply chain is the succession of activities which are involved in sourcing materials, processing materials and delivering products. Naturally, this process can involve numerous different processes and the involvement of many different organizations. Therefore, the number of opportunities to discover a backdoor or a vulnerability are attractive to a hacker. By infiltrating just one stage of a supply chain, a hacker is granted the chance to attack a large number of individuals.

Supply chain attacks have received a number of headlines over the last few years, so it’s important to arm yourself against them with knowledge.

How Does a Supply Chain Attack Work?

Hackers tend to focus on specific supply chains and carry our research on which part of the process is weakest. This gives the hacker the best opportunity of exploiting the entire supply chain. Typically, these attacks concentrate on smaller firms but, as we will see later, larger firms are also susceptible. The attack will generally be focused upon a target company and hackers will seek to disrupt their operations by infiltrating a third-party supplier e.g. a company which supplies bespoke parts to a manufacturer. The main strategy for a supply chain attack involves disabling IT systems with malware.

This image has an empty alt attribute; its file name is code-1839406_640.jpg

Examples of Supply Chain Attacks

There has been an increase in supply chain attacks in the last few years and some of the most notable ones are:

  • SolarWinds: In late 2020 it was discovered that IT infranstructure company SolarWinds had been the victim of a supply chain attack. Having gained access to SolarWinds’ network, hackers were able to insert malware into SolarWinds’ software. Due to the stealth employed, SolarWinds were unaware that they were distributing this malware. The malware involved allowed hackers to disable system services, transfer files and reboot infected PCs.
  • Shylock: A banking trojan which emerged in 2014, Shylock targeted websites based in the creative and digital industries. The authors of the Shylock trojan used a redirect script that sent victims to a malicious website. However, the team behind Shylock did not directly target these victims. Instead, they infiltrated a creative agency that designed website templates. This allowed the hackers to conceal their malicious script within legitimate website templates.

How to Protect Against Supply Chain Attacks

Defending against a supply chain attack is difficult due to the number of third parties involved. Each one that your organization works with has the potential to create a supply chain breach. However, by implementing the following measures you should enhance your protection:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The Return of the Trickbot Malware

anti malware, malware, Ophtek, trickbot, two-factor authentication, , , , ,
09
Feb 2021

Some malware is incredibly difficult to remove, but it is removable. However, that very same malware could come back stronger than ever before.

We first reported on the Trickbot malware back in 2017 when it was being used to target banks in the US. Back then it was using web-injection techniques to infect users and steal login credentials. But much can change in three and a half years. Trickbot has steadily evolved to become a much stronger strain of malware. And this, naturally, means that its more dangerous. Therefore, even if you managed to beat Trickbot before, it’s going to require an even stronger battle this time around.

The good news is that we’re going to give you a lowdown on the latest variant of Trickbot and, more importantly, how to beat it.

What is Trickbot?

Trickbot has changed significantly since we last encountered it, so it’s crucial that we take a comprehensive look at it. Since its early days as a banking trojan, Trickbot has evolved several times. Enhancements to its design has allowed it to spread through networks rapidly and with stealth on its side. Trickbot has also been re-engineered to become a malware loader meaning that it can download even more malware to an infected system. It had appeared, last year, that a collection of tech companies had managed to take the Trickbot network down. But it appears that Trickbot is still active.

The latest Trickbot attack uses a social engineering approach to unleash its payload and is targeting legal and insurance companies in the US. Phishing emails are being distributed which inform the recipient that they are responsible for a traffic violation. A link contained within the email promises to deliver proof of this violation. But the true destination of this link is a website which will download an infected ZIP file. This infected file will then connect the user’s PC to a remote server and completes the infection by downloading further malware.

How to Beat Trickbot

Good security practices are essential when it comes to beating malware such as Trickbot. Protect yourself by carrying out the following:

  • Install Your Updates: Vulnerabilities in your hardware and software allow malware such as Trickbot easy access into your system. Plug this gap by installing all updates when prompted to and, where possible, set these to automatic installs.
  • Teach Email Safety: The busy pressures of the working day mean that we can sometimes switch to automatic when checking our emails. However, by taking a few moments to carry out some basic checks you can make sure you don’t fall victim to malicious emails.
  • Two-Factor Authentication: Trickbot is well known for being able to spread through networks like wildfire, but you can limit this spread. By installing a method of two-factor authentication on your network you can make this spread much harder.
  • Use Anti-Malware Software: A wide range of anti-malware software is available – much of it at no cost – that can protect your PCs from malware. Windows itself has Windows Defender built into it as standard, so make sure you have something in place. And, don’t forget, make sure the software is turned on.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 7 8 9 10