The Danger of Supply Chain Attacks

Hackers, Hacking, Ophtek, Shylock, SolarWInds, Supply Chain, , , , ,
16
Feb 2021

The supply chain is a crucial element in the business world and, accordingly, this makes it the perfect target for hackers to attack.

When a finished product ends up with a consumer it’s the culmination of a lengthy business process. The supply chain is the succession of activities which are involved in sourcing materials, processing materials and delivering products. Naturally, this process can involve numerous different processes and the involvement of many different organizations. Therefore, the number of opportunities to discover a backdoor or a vulnerability are attractive to a hacker. By infiltrating just one stage of a supply chain, a hacker is granted the chance to attack a large number of individuals.

Supply chain attacks have received a number of headlines over the last few years, so it’s important to arm yourself against them with knowledge.

How Does a Supply Chain Attack Work?

Hackers tend to focus on specific supply chains and carry our research on which part of the process is weakest. This gives the hacker the best opportunity of exploiting the entire supply chain. Typically, these attacks concentrate on smaller firms but, as we will see later, larger firms are also susceptible. The attack will generally be focused upon a target company and hackers will seek to disrupt their operations by infiltrating a third-party supplier e.g. a company which supplies bespoke parts to a manufacturer. The main strategy for a supply chain attack involves disabling IT systems with malware.

This image has an empty alt attribute; its file name is code-1839406_640.jpg

Examples of Supply Chain Attacks

There has been an increase in supply chain attacks in the last few years and some of the most notable ones are:

  • SolarWinds: In late 2020 it was discovered that IT infranstructure company SolarWinds had been the victim of a supply chain attack. Having gained access to SolarWinds’ network, hackers were able to insert malware into SolarWinds’ software. Due to the stealth employed, SolarWinds were unaware that they were distributing this malware. The malware involved allowed hackers to disable system services, transfer files and reboot infected PCs.
  • Shylock: A banking trojan which emerged in 2014, Shylock targeted websites based in the creative and digital industries. The authors of the Shylock trojan used a redirect script that sent victims to a malicious website. However, the team behind Shylock did not directly target these victims. Instead, they infiltrated a creative agency that designed website templates. This allowed the hackers to conceal their malicious script within legitimate website templates.

How to Protect Against Supply Chain Attacks

Defending against a supply chain attack is difficult due to the number of third parties involved. Each one that your organization works with has the potential to create a supply chain breach. However, by implementing the following measures you should enhance your protection:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Understanding the Basics of Botnet Attacks

botnets, Hackers, Online Security, Ophtek, PC Maintenance, Security, Updates, , , ,
03
Nov 2020

The internet has connected us to each other in a way we would have thought impossible a few decades ago. But these massed connections can be very dangerous.

The beauty of the internet is that one PC can connect to another PC with relative ease. And these connections allow us to pool resources, share information and provide services. The foundations of almost every web service are based upon collections of PCs all working together to deliver an end result. These are often automated tasks that allow a website to continue operating correctly. But the fact that these PCs are generally left to their own devices means they aren’t actively monitored. And this situation makes them a security risk.

Known as botnets, these collections of PCs can have their cumulative power put to use for the gains of hackers.

What are Botnet Attacks?

While most botnets combine harmless coding with hardware, malicious botnets are another matter. A malicious botnet can gain access to your PC via two methods:

Regardless of the strategy involved, the end result is the same: an infection which adds your PC to the hacker’s botnet. Naturally, the more PCs added to the botnet, the more powerful it is. And, with the infection in place, the hacker will have full control of your PC. This allows them to carry out the following tasks:

  • Spread across the rest of your organization’s PCs by executing malware in order to swell the numbers of the botnet
  • Loading fake adverts in your internet browser designed to trick you into providing financial details to malicious websites
  • Use the cumulative processing power of all the PCs in a botnet to carry out DDoS campaigns in order to take websites down
  • Generating spam emails to be automatically sent from your organization’s email server

How Can You Protect Against Botnets?

As you can tell, a botnet attack will do your organization no favors and will cause untold damage to other businesses it targets. Therefore, you need to put these precautions into place:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Trickbot Malware Shows that Hackers are Getting Cleverer

Hackers, malware, Ophtek, Spam, , , ,
21
Jul 2020

Malware is a thorn which we find in our sides on a regular basis. But what happens when this thorn becomes even harder to tackle? The answer is Trickbot.

First released in 2016, Trickbot has made its name by using a variety of attack methods. The malware has been shown to steal Bitcoin, target banks and harvest login credentials. Naturally, this makes it a very dangerous piece of malware. But as with a virus that attacks humans, this malware is constantly changing its DNA. New features have regularly been added to Trickbot which not only makes it harder to detect, but also makes it more dangerous.

Trickbot has the potential to cause significant damage to your IT setup, so it’s important to know what you’re up against.

The Lowdown on Trickbot

The most common infection method used by Trickbot is through the use of malicious spam campaigns. Emails that pretend to be from financial institutions are used to distribute infected attachments and URLs that the victims are urged to action. And, once the payload has been activated, it’s unlikely that the victim will be aware. Trickbot will communicate with a remote command and control centre almost silently and, at the same time, infect other PCs on the same network.

Trickbot’s Latest Trick

As we mentioned earlier, the hackers behind Trickbot thrive upon their ability to evolve the malware. And their latest upgrade to Trickbot is both innovative and deceptive. This is most keenly demonstrated by its ‘anti-virtual machine’ strategy. One of the safest ways for security professionals to analyze malware is within a virtual machine environment. Therefore, in order to hide its operations, Trickbot will stop working when it detects a virtual machine.

And, believe it or not, one of the simplest ways to do this is to analyze the PCs current screen resolution. Any screen resolution that is set to 1024×768 and below will cause Trickbot to terminate its operations. This means that security researchers using a virtual machine to will draw a blank. This is a very clever technique and is one that allows Trickbot to reactivate once the PC is restarted into a higher resolution.

How Do You Stop Trickbot?

Anti-malware software such as Malwarebytes is capable of detecting and removing most strains of Trickbot, but there will always be a slight delay when it comes to new strains. And, of course, you should never rely on removing infections as the best strategy for defense. Instead you should make every effort to prevent infection in the first place. This can be achieved in the following ways:

  • Evaluate All Incoming Emails: It’s essential that your staff is aware of the dangers of phishing emails. Thankfully, the tell-tale signs are easy to detect and, with this knowledge to hand, it should become much harder to fall victim to Trickbot. 
  • Avoid Malicious Websites: Given their deceptive nature, it’s easier said than done to avoid malicious websites. However, it’s crucial that you have the ability to identify malicious websites. This will severely limit the chances of downloading malware such as Trickbot. 

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Government Websites Compromised in Armenia

anti malware, Cyber Attack, Cyber Security, Hackers, malicious websites, Plugins, Security Threats, , , ,
07
Apr 2020

You would like to think that governments know a thing or two about cyber security. But a recent hack in Armenia has proved otherwise.

European security experts ESET have confirmed that numerous websites belonging to the Armenian government have been targeted and compromised by hackers.   The compromised websites have been infected with malware and pose a nasty security risk to visitors. It’s suspected that the hackers behind this attack are Turla, a Russian hacking group.

We’ve discussed malicious websites before, but this latest attack is a little different. Therefore, it’s crucial that you understand the unique methods behind the infection.

What’s the Story?

The suspected hackers have targeted several websites that come under the control of the Armenian government, but the same fingerprints have also been found on a few non-government websites. Regardless of which website is infected, the methods employed are the same. However, where this attack differs from normal is its selective nature. Rather than attacking every visitor that accesses the infected websites, the malware only targets high-ranking visitors. So, for example, a civilian visitor is likely to remain uninfected, but a government official will not be so lucky.

It’s intriguing that the malware is only interested in high-ranking officials and indicates that there could be a political angle to the attack. Speculation aside, what is known for certain is how the attack unfolds. Once a visitor has been established as ‘high-value’ a command-and-control server generates a malicious JavaScript code. This code is used to deliver a popup window prompting the user to download a Flash update. But while this does, in fact, install a genuine version of Flash, it also contains PyFlash. And this backdoor application allows hackers to gain full access to the infected PC.

How Do You Protect Yourself?

Naturally, the security risk of compromised government PCs is considered high. And, while it is unlikely to affect smaller organizations at present, the selective nature of the attack is troubling. Therefore, it’s important that you safeguard your business against similar attacks. This can be achieved by following these best practices:

  • Use Website Filters: One of the best ways to protect your organization from infected websites is by integrating website filters into your IT setup. These filters are backed up by huge databases, which are regularly updated, and will prevent your users from accessing websites considered a security risk. 
  • Prevent Software Installation: The majority of applications that your employees will want to install are likely to be genuine and safe. But, as with fake Flash updates, this is not always the case. And this is why it makes sense to enforce a complete blanket ban on unauthorized installs. Accordingly, any install requests should be submitted to an IT professional who can evaluate the risk of each proposition.
  • Block Popup Adverts: It’s rare that any PC user welcomes the appearance of a popup advert. And, with the risk of malicious popups so prevalent, it’s the last thing that an IT professional wants to see as well. Therefore, it makes sense to minimize this risk by installing a popup blocker. Not only will this reduce the risk of malware being installed, but it will also provide your PC users with an enhanced experience.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

What are the Dangers of Rootkits?

Hackers, Ophtek, Rootkit, Security, , ,
27
Aug 2019

What’s worse than one piece of malware? Multiple strains of malware. And, when you encounter a rootkit, this is exactly what you’re faced with.

Rootkits are a very serious form of malware. They’re not a new method of hacking, they have been present for close to 30 years now, but they’re still notoriously difficult to treat. There are many dangers associated with rootkits with the primary concerns being that they remain hidden on PCs and grant remote access to hackers.

Understanding what a rootkit is can be complex, but we’re going to break it down into the basics for you. And, with this on your side, your organization should become that little bit securer.

What is a Rootkit?

Rootkits are a collection of tools that allow hackers to gain unauthorized access to a PC. They’re stealthy pieces of kit that can evade security software, so detecting that a rootkit has infected your system is a task all of its own. The major threat, however, comes from the payload within a rootkit. The contents of a rootkit can include the following:

  • Keystroke loggers
  • Ransomware
  • Trojans
  • Bot software for initiating DDoS attacks

And, once it has been activated, a rootkit will commonly set up a backdoor exploit. This allows the hacker to gain access, without detection, to an infected PC as and when they want. Not only will this allow the hacker to take control of the PC, but it also grants them the opportunity to download further malware to the workstation.

How are Rootkits Spread?

Rootkits are clearly a formidable foe to encounter, but how do they spread? Rootkits, as with most forms of malware, favor the standard distribution methods:

  • Email: Rootkits are most commonly found on emails as attachments, but email also has the potential to contain links to malicious websites. 
  • USB Drives: The relatively small size of a rootkit makes them perfect for loading on to USB devices such as flash drives. These can then be uploaded seamlessly to a PC once plugged in. 
  • Vulnerabilities: Hackers are often able to gain access to a PC due to vulnerabilities in the OS or a particular piece of software on that system. These vulnerabilities will often allow unauthorized access and the chance to install rootkits without detection.

How Do You Protect Against Rootkits?

The last thing that your organization wants is to fall victim to a rootkit. Their stealthy nature makes them difficult to detect and thoroughly removing every trace of their multiple payload is time consuming.

Therefore, you need to set up a system of best practices that look to minimize the risk of unleashing a rootkit on your network. Make sure that the following is in place:

  • Carry out IT Inductions: It’s crucial that all employees are put through an IT induction when they join your organization.
  • Install all Updates: Rootkits often take hold of system through the exploitation of vulnerabilities. If you make sure that system updates are installed as soon as possible then you minimize the risk of these exploits.
  • Work with Anti-Malware Software: You can’t identify every type of rootkit with anti-malware software, but you can identify a large number of them before they take hold. And this software is also capable of identifying malicious websites before they are accessed.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 3 4 5 6 7