Cuttlefish Malware is Putting Your Routers at Risk

bash script, brute force hacking, Cuttlefish, Data Breach, HiatusRAT, malware, Ophtek, router firmware update, zero-day vulnerabilities, , , , , , , ,
11
Jun 2024

A new strain of malware, dubbed Cuttlefish, which attempts to hijack your router has been discovered, and it poses a major threat to your data.

The experts at Black Lotus Labs recently discovered a number of routers had been compromised by a previously unseen malware. The security researchers named the malware Cuttlefish, and found it had compromised numerous enterprise-level and small office/home routers. The threat actors are not currently known, but the main impact of Cuttlefish is that it stealthily steals data once it has a foothold. Data breaches, of course, represent a major incident for businesses, so it’s crucial you keep your routers safe.

Decoding the Danger Behind Cuttlefish

The exact attack method behind Cuttlefish is unknown, but it’s been revealed there are similarities between its source code and that of the HiatusRAT malware. Black Lotus Labs believe Cuttlefish may launch its attack either through a zero-day vulnerability or by using good old fashioned brute force hacking methods.

Whatever the nature of its attack, which was first executed in July 2023, Cuttlefish hands control of the compromised router over to a set of threat actors. This is achieved by instructing an infected router to execute a Bash script – a text file containing a set of commands – which sends data to a remote Command & Control (C2) server. The first action taken by the C2 server is to send back the Cuttlefish malware, this is then installed on the compromised router.

From here, Cuttlefish can monitor all traffic passing through the router and any devices connected to it. Cleverly, Cuttlefish is designed to establish a VPN tunnel, which is then used to extract sensitive data, such as login credentials, from the router’s traffic. These attack methods mark Cuttlefish out as a highly stealthy and dangerous strain of malware, one with the ability to expose and misuse confidential data.

Fighting Back Against the Threat of Cuttlefish

As very little of the mechanics behind Cuttlefish are known, it’s difficult to pinpoint a single solution. For now, all the attacks have been focused on routers based in Turkey. But this can quickly change if threat actors behind Cuttlefish decide to start targeting global victims.

While there isn’t, for example, a simple security patch to install, you can still protect your organization’s routers by following these best security practices:

  • Always Install Updates: routers, like all hardware, rely on firmware updated and patches to maintain their security and maximize performance. But not everyone prioritizes installing these updates. And this approach can put your router at risk of being exploited by a vulnerability. Therefore, where possible, automate updates for your routers (and all devices) or manually install updates as soon as possible.
  • Regularly Change Your Router Credentials: it’s vital you regularly change the password associated with your router. Otherwise, you run the risk of allowing external threats to essentially live on your router. And as well as regularly changing your password, it’s important that you generate strong and unique passwords every time.
  • Monitor Network Traffic: unusual activity on your network, such as high-volume traffic to unknown destinations should always be scrutinized. Accordingly, you need to implement specialized software and hardware tools to analyze your network traffic and raise alerts when abnormal traffic patters are detected. This will maintain both the integrity and security of your network.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The Best Ways to Secure Your Digital Documents

Backup, Data Breach, Data Security, digital documents, Ophtek, password protection, strong passwords, windows encryption, , , , , , ,
14
May 2024

Every business relies on digital documents, but the threat of data breaches and cyberattacks mean these documents must be correctly secured.

There are many types of documents a business uses daily such as Word, Excel, PDF, and digital images. All of these can contain sensitive information, and it’s no surprise threat actors want to get their hands on them. Not only can a threat actor use these to compromise other accounts, but they can cause real financial damage with them. Accordingly, it makes sense to secure your organization’s digital documents to keep them safe.

Securing Your Digital Documents

Your business may contain numerous files in different locations, but the good news is that securing all of them is straightforward. Just make sure you follow these best practices:

  • Password Protection: the simplest way to secure your digital documents is by implementing password protection. A common security measure for decades, passwords put a major barrier in the way of unauthorized access. Not all files can be password protected, but common files such as Microsoft 365 documents and Adobe PDF documents can.
  • Use Strong Passwords: central to good password protection is strong passwords. Never use passwords which are easy to guess e.g. using “password” or “admin”. Instead, always use passwords which combine upper and lower case characters with numbers and symbols. It’s also recommended that passwords are longer than 8 characters and different passwords should be used for different documents.
  • Restrict Access: it’s important to remember not every employee needs access to every single file within your organization. Your marketing team, for example, doesn’t need access to your finance team’s documents and vice-versa. Accordingly, you need to restrict access to only those who need it. The best way to achieve this is by setting up ‘restricted’ drives for each team to store their department-specific documents.
  • Use Windows Encryption: compromised devices present a goldmine of data for threat actors, but it’s possible to avoid this disaster by encrypting your devices. Yes, if you’re running Windows 10/11 Pro or Enterprise versions, it’s possible to encrypt data and provide access only to those with authorization. This is easy to put in place and, if Windows encryption is not available on the device, you may still be able to use BitLocker encryption to encrypt it.
  • Always Create Backups: in the event of a ransomware attack, your organization could find all of its documents encrypted and inaccessible. This is why creating backups is the surest way to enhance the security of your digital documents. The preferred method for executing this is with the 3-2-1 backup method, as this provides you with multiple copies in different locations. Complete loss of your data is minimized and there’s no need to pay any ransom fees.

Final Thoughts

All it takes is for a single file to be compromised by threat actors to cause major damage, so it’s crucial that you prioritize securing your digital documents. Putting the suggestions above into practice is relatively easy, and it ensures your data remains safe. So, don’t delay, secure your digital documents today and benefit from the peace of mind it provides.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Data Breach at Norton Healthcare After Ransomware Attack 

ALPHV, Data Backup, Data Breach, Employee Training, Norton Healthcare, partition hard drives, Ransomware, , , , , ,
30
Jan 2024

Healthcare data is some of the most sensitive and confidential data to exist in IT systems, so the ransomware attack at Norton Healthcare is a big deal. 

Based in Kentucky, Norton Healthcare is a provider who delivers health services to adults and children in over 40 clinics. Their objective, as with all healthcare providers, is to improve the lives of their patients. However, a recent data breach has done little to inspire a sense of wellness in their patients. The breach, which occurred in May this year but is only just being reported, was part of a ransomware attack. Norton Healthcare’s network was breached for two days, but there appeared to be no evidence that their medical record system had been accessed. 

Nonetheless, healthcare data should always be secure, and breaches in local networks represent a major cause for concern. 

The Norton Healthcare Attack 

The exact nature of the attack has, at present, not been released. But we do know what the impact of the breach was. After discovering that an attack was taking place, Norton was forced into turning its network off, the last thing a healthcare provider wants to do. As the attack was unfolding, Norton received, in a novel twist, a faxed ransom note featuring threats and demands. Later that month, a ransomware group known as ALPHV claimed responsibility for the attack. 

ALPHV released a statement to the dark web which claimed that they had managed to compromise 4.7TB worth of data from Norton Healthcare’s servers. As proof, ALPHV uploaded numerous files – containing patients’ bank statements and Social Security numbers – to backup their claims. Norton’s official line is that only some network storage devices were breached, and these only contained identifying information rather than any medical data. 

How Can Healthcare Providers Protect Themselves?

With more and more healthcare providers coming under attack from threat actors, it’s important that they understand how to minimize their risk. In fact, these lessons are valuable for any business running an IT network, so it’s time to find out how. So, to stay safe from ransomware attacks, make sure you follow this best guidance: 

  • Regular backups: it’s vital that you perform regular backups of your data to ensure, if it becomes encrypted by ransomware, you still have access to it. Ideally, these backups should be completed daily at the very least, and they should always be saved to secure locations. It’s important to keep copies of your backups offline as well, this will allow you to access your data even if you need to take your network down. 
     
  • Partition your hard drives: to minimize the impact of a breach, it’s a good idea to partition you hard drives and data storage. By separating these from your main network, and from each other, you’re limiting the files and data that malware can access. This minimizes the risk of data loss and allows you to keep important systems online. 
     
  • Employee training: educating your staff about the dangers of social engineering and phishing emails is one of the most important steps you can take. Ransomware, such as the strain encountered by Norton Healthcare, is often spread through emails and your employees need to be able to identify these threats before clicking on them. 

For more ways to secure and optimize your business technology, contact your local IT professionals. 

Read More

The Dangers of SIM Hijacking

Data Breach, Data Security, Ophtek, SIM Hijacking, TMobile Breach, , , ,
23
Aug 2021

A recent security breach of the T-Mobile network has resulted in two issues: the loss of confidential data and the risk of SIM hijacking.

Data breaches are commonplace in the world of hacking, but SIM hijacking is less familiar outside of the telecoms industry. SIM cards, of course, are used in mobile phones to identify users to networks and allow them to make calls. These SIM cards are highly secure given the amount of data they contain and the finances associated with them e.g. contracts. And mobile phones are now a crucial part of any modern business for communications to run smoothly. Accordingly, protecting SIM cards for organizations should be a major concern.

But what is SIM hijacking? And what can you do to protect your SIM cards?

The T-Mobile Breach

In what is the fourth such attack in 18 months, around 48 million customers – many of them former customers – have been affected by the latest T-Mobile breach. Quickly Check If You’re Email Was BreachedThe cause of this breach has not, as of yet, been identified, but the data in question has. Stolen data includes:

  • Names
  • Social security numbers
  • Birthdates
  • Driver’s license details

Around 850,000 customers who hold pre-paid accounts have also had their names, phone numbers and account PINs stolen. All of this data is currently being sold online and represents a major security threat to those involved. And, for those whose number has been exposed, there is also the very real risk of falling victim to SIM hijacking.

What is SIM Hijacking?

SIM hijacking is a process where a hacker attempts to obtain control over a mobile phone account by moving the associated number to a new device. This is achieved by contacting a service provider – such as T-Mobile – and adopting a false identity. You may wonder why people want to steal a mobile number. After all, having access to a set of phone numbers isn’t overly exciting for a hacker. But we live in a world where mobile phones are regularly used for two-factor authorization. Therefore, having access to a phone number can open all manner of opportunities to a hacker.

How Do You Prevent SIM Hijacking?

Once a hacker has your phone number there is little you can do to stop them attempting to hijack your SIM. Naturally, the simplest option is to limit the number of times you give out your mobile number. But this is difficult when we live in an age when so many companies request your number for contact purposes. Nonetheless, it is possible to limit the damage by carrying out the following:

  • Certain service providers such as T-Mobile and Verizon offer security features which block SIM swaps by either requesting a security PIN or using the existing device to authorize the swap

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The Benefits of Cyber Security Insurance for Your Business

Cyber Attack, Cyber Security, Cyber Security Insurance, Data Breach, Data Security, Ophtek, , ,
18
May 2021

We’re all used to dealing with insurance for both our personal and business needs, but did you know it was possible to arrange cyber security insurance?

2020 saw financial losses caused by cyber crime topping $1 trillion. Yes, you read that right, $1 trillion. This is a phenomenal figure and one which underlines the damage that cyber breaches can cause. Ransomware, as you would expect, is a major contributor to this figure of $1 trillion and confirms just how important cyber security is. However, no set of defenses are 100% perfect. Accordingly, it’s possible for any organization to suffer financial losses. And this is where cyber security insurance comes in.

To help you understand the benefits of cyber security insurance and how it works, we’re going to take a quick look at the subject.

What is Cyber Security Insurance?

The impact of a data breach can be catastrophic for a business. Not only is there the damage to your reputation, but there are also the financial effects. Ransomware, of course, can pose an immediate financial risk. And many organizations feel pressured into paying the ransom fees demanded by hackers. There’s also the major risk of hackers causing direct damage to your hardware which, in turn, may need replacing. Compounding the impact even further is the threat of legal action from customers who feel as though their data has not been protected effectively.

Clearly, a cyber attack can quickly become very costly for your business. And it won’t be covered by your general liability insurance. This is why cyber security insurance has been developed. It serves to protect your business by covering your organization’s liability for any cyber attacks. This insurance is available from a wide range of vendors and is similar to almost all other forms of insurance. Each policy, which can be tailored to your specific needs, is costed accordingly and then registered against your business.

The Benefits of Cyber Security

But what exactly are the benefits of cyber security? Let’s take a look:

  • Recover Ransomware Losses: The funds demanded by ransomware can be costly and, if paid, can put a serious dent in your finances. Thankfully, with cyber security insurance in place, you can recoup any ransom funds through your insurance vendor.
  • Help Notifying Customers: By law, an organization needs to contact all affected parties when a data breach occurs. The time and energy required to carry out such a communication can be expensive. But the cost behind this exercise can be negated when you have taken out cyber security insurance.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 2