4 Questions You Should Ask Before Clicking an Email Link

Cyber Attack, cyber attacks, email links, malware, Phishing, Ransomware, Security, security
14
Aug 2018

We receive so many emails in business now that they’re a keen target for hackers. As a result, your organization needs to be more wary than ever with email.

The most common way for a hacker to take advantage of emails is by loading them with malicious links. These can be used to extract personal information, activate ransomware or send users to dangerous websites. And these emails are more than likely hitting your organization every day. Whilst the majority of emails with links embedded in them are genuine, it only takes one rogue email to cause severe problems.

To help you avoid the wrath of hackers, we’ve put together four questions you should ask before clicking an email link.

  1. Do You Recognize the Sender?

Trust is crucial when it comes to dealing with links contained within emails. If you don’t recognize the sender then the link should definitely be treated with caution as it could easily be a malicious link. Emails from work colleagues should be more trustworthy, but it’s always possible that their email account has been hijacked. So, even if you recognize the sender, there are still plenty of questions you need to ask.

  1. Does the Link Look Genuine?

If you received an email advising you to visit the Ophtek website then it would look something like www.ophtek.com or ophtek.com. However, if a hacker is trying to trick you into visiting a malicious website then the link may read slightly different e.g. ophtek.org or ophteksupport.com. If you’re ever unsure about the URL listed in a link then try Googling the URL and see whether it brings up a genuine website.

The other factor to look out for is whether the link written in the email is genuine. While the link could say www.ophtek.com the actual destination contained within the link could be completely different. Thankfully, you can double check this by hovering your cursor over any email link to display a popup window that lists the genuine destination.

  1. Do You Even Need to Click the Link?

A high number of malicious links prey on our worries, so, for example, emails that claim your bank account has been hacked are very common. The email will usually contain a link that promises to start an authentication process to secure your account, but these links are never genuine. More often than not, the email will reference a bank that you don’t even have an account with, so there’s absolutely no need to click any links inside it.

  1. Why is it a Shortened Link?

Shortened links may save space in emails, but there’s no reason why they should be used in business emails. More importantly, shortened links – provided by platforms such as Bit.ly and Goo.gl – are yet another way that hackers can disguise the destination of a link. Shortened links are particularly difficult to judge as, even if you hover your cursor over them, it’s impossible to tell where they will send you. Help is at hand, though, from platforms such as CheckShortURL which can expand shortened links to show their true destination.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The 5 Most Important IoT Security Concerns Coming in 2018

Cyber Attack, Hacking, Internet of things, IOT, IoT Attacks, malware, Phishing, Ransomware, Security, Security Threats, , , ,
20
Feb 2018

If you want to keep the IoT (Internet of Things) secure in 2018 then you’re going to have your work cut out due to the number of threats on the horizon.

Significant progress has been made in the last couple of years when it comes to understanding the security concerns presented by IoT devices, but this is only encouraging hackers to become more innovative. And 2018 is going to deliver more IoT security threats than ever before, so you’re going to need to be ready for this surge in activity and the new hacking methods employed.

Let’s take a look at the most pressing IoT security concerns coming in 2018.

  1. IoT Attacks Being Undetectable

Many IoT attacks take place on a micro scale compared to large scale attacks such as Distributed Denial of Service Attacks. The problem with micro attacks is that conventional security systems are unlikely to recognize them as a threat, whereas major attacks are likely to ring alarm bells very quickly. Therefore, investing in highly sensitive security systems and manual monitoring may become vital to any organization using IoT devices.

  1. Automation Will Become More Important

Some organizations can have thousands of IoT devices operating on their network at any one time, so manually monitoring this activity is virtually impossible. And that’s why automation and artificial intelligence could prove highly popular in 2018 when it comes to providing a front line defence against IoT attacks e.g. installing crucial firmware upgrades immediately.

  1. The Irresistible Allure of Cryptocurrency

You only have to take a quick look at the financial headlines to understand just how valuable cryptocurrencies are at the moment. And, to a hacker, the financial rewards on offer are hard to resist. The Satori botnet, for example, takes control of IoT devices and also allows the hackers to exploit Bitcoin mining software. So, if your organization is involved with cryptocurrencies in any capacity, it’s going to pay to monitor your activity very closely.

  1. More and More Devices Will Be Targeted

Automobiles, security cameras and baby monitors are just a small selection of the IoT devices which have been hacked in the last couple of years, but this is set to increase further in 2018. In particular, devices which come with weak passwords (or even no password) are constantly being scouted by hackers. And, when they discover one, this can easily be leaked online, so the need to enforce a strong password culture remains essential.

  1. Privacy Concerns

Trusting IoT devices to transmit and receive personal and sensitive data is going to come under serious scrutiny in 2018. Due to the recent IoT attacks which have exploited weak passwords and poor security protocols in IoT devices, the public concern is growing over how their data is handled. Naturally, hackers are excited by the prospect of being given a free run at such a huge number of vulnerable devices without adequate security frameworks in place. 2018, therefore, is going to find organizations having to soothe customer concerns by only working with secure hardware and software.

For more ways to secure and optimize your business technology, contact your local IT professionals.

 

Read More

Mamba Highlights a Change in Ransomware

Mamba, Ransomware, Security, ,
12
Sep 2017

MAMBA-RANSOMWARE

We’re all aware that ransomware can hit you financially, but ransomware is now changing its modus operandi for causing chaos and becoming more dangerous.

The Mamba ransomware first appeared in September 2016 and, rather than just scrambling certain file extensions, it scrambles every single disk sector on your hard drive. And in layman’s terms this means that your whole PC will be next to useless. However, whilst ransomware usually offers you a way out of this mess through a ransom payment, this is where Mamba differs.

In recent attacks on organizations in Brazil and Saudi Arabia, the Mamba ransomware doesn’t specifically demand a ransom. Instead, it merely provides two email addresses and an ID number for you to use in correspondence. The ransom note also asks those infected to enter a key which, we can only assume, could be provided once contact has been made with the aforementioned email addresses.

Of course, much like the NotPetya attack, this could be a form of ransomware which simply sabotages a hard drive by making all its data inaccessible. Regardless of this, it’s not a situation that you want to find yourself in, so let’s take a look at what Mamba consists of. 

The Mamba Attack

There’s a lot of concern that Mamba may be another piece of ‘wiper’ malware which simply dumps data once encrypting it rather than offering a decryption service. It’s also difficult to determine who has been authoring this new Mamba variant – sure, a Russian email address is used, but it would be foolhardy to assume that the attack comes from Russia simply because of an email address.

The attack itself seems to execute the Mamba ransomware by exploiting the PSEXEC application – a piece of software which allows communication between remote systems and crucial for organizations networks to operate effectively. The malware works in two stages with the first line of attack seeing DiskCryptor – a free encryptor – installed on the infected system before rebooting the system. Upon bootup, DiskCryptor begins encrypting disk partitions and, once the hard drive is fully encrypted, the system is rebooted once more.

It’s at this point that the ‘ransom’ note is delivered to the user. It’s too early to say exactly what correspondence with the emails provided will result in, but it’s fair to assume that the hackers aren’t just going to hand over the key. Now, each infected computer has a specific password generated for it, so this hints that, perhaps Mamba isn’t a piece of wiper malware and that payment will result in your hard drive being decrypted. However, it could also just be a diversionary tactic and your files could be lost forever. 

internet-1593448_960_720

Combatting Mamba

The level of encryption carried out by Mamba through DiskCryptor is exceptionally strong, so there’s currently no way of retrieving your files without somehow receiving help from the hackers. Whether this help will be forthcoming is debatable, so it in no way represents a way out from this particularly difficult hack.

Good security practices, as ever, are essential to prevent your organization falling foul of ransomware, particularly when it’s one which appears to be very enigmatic and provides little light at the end of the tunnel. Such attacks are likely to increase, so make sure you practice the following:

  • Always backup your files and data to ensure they’re not compromised on an infected system. It’s also recommended that these are backed up to a system not connected to your network to prevent falling foul of malware which can spread throughout a network.
  • Use multi-layered security in the form of firewalls, web filtering and antivirus software in order to stop malware from either activating or even reaching your network.
  • Restrict user privileges and access on your network as, again, this can stop ransomware spreading through your network once it has started to gain a foothold in your network.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Petya Cyber Attack Goes Global with Ransomware

Cyber Attack, Petya, Ransomware, Security, , , ,
05
Sep 2017

2017_Petya_cyberattack_screenshot

A major cyber attack has swept across the globe and, once again, it’s taken the form of ransomware to shut down computers and demand Bitcoin ransoms.

Known as Petya – the Russian word for stone – has managed to halt operations at a chocolate factory in Australia and even one of Russia’s biggest oil companies, so the scale and sophistication of its attack is clear to see. Following the recent WannaCry ransomware attack, Petya has made headlines in a security landscape where safety appears to be far from guaranteed.

As this is such a widespread attack – and the fact that new ransomware attacks are appearing weekly – it seems like the perfect time to look at Petya and reinforce what you can do to protect yourself.

The Story behind Petya

Although it’s difficult to confirm, it’s believed that the Petya attack originated in the Ukraine. Reports suggest that the ransomware was spread through the update server for MeDoc which is a popular brand of Ukrainian accounting software. Consumers believed they were simply downloading a new update for their software, but it was actually a powerful slice of malware which then spread like wildfire.

Petya.Random

This latest variant of Petya, however, is even more powerful than its original incarnation. It’s believed that Petya now comes loaded with a tool named LSADump which harvests data and passwords from all the PCs located on that network. Petya also appears to be encrypting every single file on the infected PCs through the master boot record – this helps your PC boot up Windows at startup.

Most disturbingly, though, it’s being reported that Petya may not even be ransomware and may, instead, simply wipe everything from a PC with no chance of recovery. While the thought of having to pay a small ransom to retrieve data is troubling enough, the idea that your data may never be retrieved brings a whole new level of concern to Petya.

Defending Against Petya

Regardless of whether Petya encrypts or destroys files, it remains a highly sophisticated strain of malware that no PC user wants to find on their system. Kaspersky and Symantec have assured consumers that their anti-virus software will actively identify and protect against Petya, but for many users this may be too late.

cyber-security-2296269_960_720

Unfortunately, despite the spate of attacks taking advantage of Windows vulnerabilities, many PC users are still incredibly lax when it comes to installing security updates and patches. The main reason for this procrastination is an issue of time, but what’s five to ten minutes of installing updates and rebooting compared to having all the files on your entire network encrypted or even deleted?

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Ransomware Found Lurking in Skype Ads

Ransomware, ,
18
Jul 2017

skype-crossed-640x360Skype is a great tool for businesses to communicate with customers and partners, but now it appears that it’s being used as a delivery route for ransomware.

PC users who are using the Microsoft Skype App have reported that fake adverts have been appearing which contain a malicious payload in the form of ransomware. As per usual, this strain of ransomware locks the user’s computer, encrypts files and demands a ransom for unlocking the PC.

Ransomware is becoming increasingly more common and, as Skype is such an important communication tool, there’s a good chance that your business could find itself confronted with it. Therefore, I’m going to delve a little deeper into what’s behind this latest attack.

Skype Ransomware

ransomware-illustrationThe malicious adverts that have been appearing claim that a critical Flash update is required and offers a link to this ‘critical’ update. However, this advert – which appears on the Skype home screen – is actually a link to a HTML application that, although looking genuine, downloads a nasty dose of ransomware to your PC.

And it’s a particularly sneaky piece of ransomware as this malicious payload also runs a piece of code which deletes the downloaded application and then downloads a piece of JavaScript from a website which no longer exists. The domains being used are setup and then shut down almost instantly to prevent any form of registration fee being taken. It’s these seemingly odd processes which help to disguise the hacker’s activities and protect them from being detected by standard antivirus operations.

It’s believed that this new piece of ransomware is related to the Locky ransomware attack – which caused so much trouble in 2016 – as it shares a number of similarities such as utilizing JavaScript to shutdown computers and encrypt files without an additional app being used to execute this.

How to Tackle the Skype Ransomware

At present there is no solution to the Skype ransomware attack and Microsoft have only been able to offer the advice that users should refrain from clicking on unsolicited links. And, unfortunately, due to ransomware being so difficult to treat, prevention tends to be the best cure for ransomware.

There are, however, a few steps you can take to minimize the damage:

  • Ensure that your staff is educated to recognize what constitutes a piece of ransomware. This knowledge, though, can quickly expire if your staff isn’t regularly exposed to such attacks, so refresher courses are recommended to keep this knowledge fresh and provide updates on any changes in ransomware techniques.
  • If you fall victim to a ransomware attack then the first step you should take is to shut your network down as soon as possible. Going offline is the only way you can prevent the hacker from burrowing deep into your system and encrypting files.
  • Always back up your files so that, in the case of encryption, you still have access to your files and do not need to pay a ransom fee or invest valuable man power into tackling the attack. It’s recommended that these are backed up to physical media which has no connection to the internet.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 4 5 6 7