Emotet: A Clever and Dangerous Brand of Malware

Emotet, malicious code, malware, Security, Security Threats, Trojans, , , , ,
11
Dec 2018

There’s no such thing as good malware, but some is certainly less trouble than others. And, when it comes to the Emotet malware, some are very dangerous.

First discovered in Europe in 2014, Emotet soon began to spread around the world and, before long, was infecting PCs in the US. Comprising several different functions and methods of attack, Emotet is a type of malware which has persisted in the digital landscape due to its constant evolution. Taking advantage of user errors and vulnerable systems, the hackers behind Emotet have managed to infect huge numbers of systems over the last four years. And it would appear that those who are coding Emotet are getting even cleverer.

Due to the severity of Emotet, and the lessons you can learn from it, I’m going to take you through the basics of Emotet.

What is Emotet?

Emotet is known as a banking Trojan due to the way it specializes in stealing user credentials including banking data as well as numerous other credentials. This is achieved by the injection of malicious code into infected computers which allows Emotet to transmit sensitive information.

As with numerous other brands of malware, Emotet delivers its payload through a combination of malicious URLs and infected attachments. Key to spreading the Emotet malware throughout a network is the way that Emotet takes advantage of the EternalBlue vulnerability, an exploit which affects unpatched versions of Windows XP through to Windows 7.

There is, however, more to Emotet than just stealing sensitive data. Adding another string to its bow, Emotet is also responsible for downloading other types of malware to infected PCs. These can include further banking Trojans such as TrickBot or modules as diverse as Outlook address book grabbers and spambots.

Why is Emotet So Clever?

The hackers behind Emotet are highly talented and this is why Emotet is so difficult to detect. Dedicated to their software, the hackers regularly update the code behind Emotet and this is then communicated to compromised systems. This change in Emotet’s DNA allows it, therefore, to remain undetected. Just as security experts believe they had identified the key signature of Emotet, they’re faced with a new variant which renders their work redundant.

New research has also revealed that Emotet’s Command and Control (C&C) server is split into two separate clusters. By designing their C&C server in this manner, the hackers can ensure that the source of Emotet is harder to track down. Additionally, this split of the C&C server allows Emotet to keep functioning if either of the clusters suffers a technical issue. For authorities, disabling this setup is highly difficult and underlines why Emotet has been so successful.

How Do You Protect Your PC from Emotet?

It’s important to protect your organization from malware at all times and variants such as Emotet are the perfect demonstration of why it’s crucial. So, if you want to maximize your defenses, make sure you follow these best practices:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Security Trends to Look Out For in 2019

Cyber Attack, Encryption, Hacking, Internet of things, Ransomware, Security, Security Threats, , , , , , ,
04
Dec 2018

2018 has been a year where malware, ransomware and data breaches have barely been out of the headlines, but what’s in store for cyber-security in 2019?

As long as there’s a digital landscape, hackers will continue to launch an array of attacks that take in numerous different techniques. And, most importantly, they will continue to evolve their methods to avoid detection and cause more damage to networks and the PCs on them. With this in mind, it’s perhaps the best time to take a look at the security trends which will be most important for your organizations defenses next year.

To help you get prepared for next year, we’re going take a look at some of the major security trends to look out for in 2019.

Backups will continue to be Crucial

With ransomware still remaining a prevalent and major threat to secure and essential data, backing up your data regularly and rigorously will be a vital task for all organizations. Backups may seem a costly affair in terms of budget and time, but it only takes one employee to fall victim to a ransomware scam for your entire network’s data to be compromised. And with new ransomware scams such as Zenis deleting backups, it’s essential that offsite and non-network backups are also held.

Coinminer Malware Remains a Threat

Cryptocurrency is still a lucrative business and mining for cryptocurrency continues to generate large amounts of cash. However, whilst this is perfectly legal and above board, the use of coinminer malware is far from legal or ethical. Due to the amount of processing power involved in mining for cryptocurrency, hackers are using malware to enslave PCs remotely and using their processor power to mine for cryptocurrencies. This form of malware has become harder to detect and more sophisticated throughout 2018, so expect it to evolve further in 2019.

The Hacking of IoT Devices will Increase

Close to 27 billion IoT devices will be connected in 2019 – an increase of nearly 3 billion compared to 2018 – so you can bet your bottom dollar that the number of attacks in this arena will increase accordingly. Unfortunately, many owners of IoT devices are still neglecting to change the default password to access these devices and this is giving hackers free rein to take control of them. Not only does the default password debacle remain an issue, but hackers are now designing malware to take advantage of vulnerabilities in IoT devices.

Security Training

Due to the threats already presented, security training will become paramount in 2019. As hackers evolve their methods of attack at a rapid pace, keeping your organization’s staff aware of these threats is one of the best forms of defense you can employ. Awareness training hammers home the basics of good security practices and you’ll find that these can also be used to combat the new threats which will no doubt go head to head with your security defenses.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Twitter Accounts Hacked for Bitcoin by a Fake Elon Musk

bitcoin, cryptocurrency, Cyber Security, Elon Musk, Hackers, Hacking, Security, Twitter hack, , , ,
27
Nov 2018

Bitcoin remains a lucrative cryptocurrency and hackers are keen to cash in on it. And they’ve now scammed $180k in one day through hacking Twitter accounts.

With around 336 million active users, Twitter is one of the most popular social media sites and has attracted a number of authority figures in almost every niche you can think of. As a result, it’s fair to say that if your organization isn’t on Twitter then it needs to be on Twitter. It’s a fantastic marketing tool that can be used to engage customers, promote products and deliver instant marketing all over the world. However, it’s this level of interest in Twitter and the trust which users invest in official accounts that makes it susceptible to hackers.

Due to a recent hack of several major Twitter accounts, with large numbers of followers, hackers managed to deceive these followers by impersonating Elon Musk and requesting Bitcoin. Unbelievably, this approach was successful and the hackers managed to obtain around 28 Bitcoins valued at roughly $180,000. And this is all thanks to hacking successful Twitter accounts. As it’s likely that you run a Twitter account to support your business, we’re going to take a look at what happened and how you can protect your Twitter account.

What Did This Fake Elon Musk Do?

Elon Musk needs little introduction due to his fame which has been generated by co-founding PayPal and designing Tesla’s electric car range. Known as a man who can make money happen, he recently appeared on several major Twitter accounts such as Pantheon Books and UK clothing range Matalan. However, this wasn’t the real Elon Musk as these official Twitter accounts (complete with blue ticks) had simply had their user name changed and their profile picture replaced with a picture of Musk. These hacked accounts then promised that, as part of a Bitcoin giveaway, he would exchange a substantial amount of Bitcoin for a verification payment of anything from 0.1 to 3 Bitcoins.

The hackers were clever enough to even hack other Twitter accounts such as the National Disaster Management Authority of India and use these to send out fake ‘verification’ tweets that they had received multiple Bitcoins in exchange. Despite sounding too good to be true and requiring very little investigative work to discover that something wasn’t quite right, 392 transactions took place in just one day and allowed the hackers to make a small fortune very quickly. Although this behavior clearly violated Twitter’s guidelines, the anonymous nature of Bitcoin transactions means that there was relatively little risk for the hackers.

Protecting Your Twitter Account

It’s not known how the hackers behind the Elon Musk scam managed to breach so many official Twitter accounts, but it’s important that you ensure your Twitter account is secured. To help protect your organization’s Twitter account make sure you practice the following:

  • Keep your password secure through regular changes, long passwords and combination passwords
  • Twitter allows you to use two-factor authentication so that access is only granted to your account when a randomly generated code sent to a mobile device is entered
  • Try not to install third-party Twitter apps which request access to your Twitter account as it’s very difficult to monitor what they do with your data

If you can regularly follow these three steps then you’re going to significantly reduce the chances of losing control of your Twitter. And, remember, even if the hackers aren’t using your account to demand Bitcoin, losing control of your Twitter account, which is a crucial communication channel in modern business, could still be disastrous for your reputation and revenue.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

385,000 Online Transactions Hacked at British Airways

British Airways, Hacking, Magecart, Secure Website, Security, Security Threats, , , ,
20
Nov 2018

British Airways recently had 385,000 online transactions hacked due to a code weakness on their payment processing pages. And customers were not happy.

Reputation is important for any organization, so limiting bad news is crucial to ensure that consumers can trust your brand. British Airways, however, have experienced a significant blow to their public image due to a recent hack which ransacked their customers’ confidential data. The attack that took place was an example of cross-site scripting, a method of hacking which may not grab as many headlines as ransomware and malware but is still very dangerous.

Processing online payments is part and parcel of any business with a digital presence these days, so I think it’s important we take a look at what happened to British Airways.

Who Hacked British Airways?

It’s believed that Magecart are the hacking group behind the British Airways hack due to the similar techniques used to execute the attack. Magecart first emerged in early 2016 and was linked to numerous hacks that affected online shops and sought to steal credit card details during online payment processing. Previously, Magecart had targeted third party payment processors rather than payment systems embedded within websites. However, the attack on British Airways demonstrated that Magecart were now developing tailored code to attack their targets’ websites directly.

How Did Magecart Launch Their Attack?

Unlike ransomware and malware, there was no need for Magecart to dispatch an email containing a malicious payload. Instead, they targeted the code of British Airways’ website. By exploiting weaknesses in the website’s code, Magecart were able to ‘inject’ 22 new lines of code into the British Airway’s website. And it was this small amount of code which made the hack so devastating.

Lying silently in the background, this new code would log keystrokes from the payment processing section and, once the victim hit the ‘submit’ button, it would transmit these keystrokes to the attackers’ server. Not only were credit card details compromised, but also a significant amount of sensitive, personal data. To help reduce the chances of being detected, the hackers even loaded their own server with an SSL security certificate to make it appear genuine. Sadly, it was far from genuine. The attack managed to remain undetected for 15 days and, as a result, managed to infiltrate a huge number of online transactions.

The Dangers of Cross-Site Scripting

Combating cross-site scripting attacks is not easy due to the difficulty in spotting previously unknown vulnerabilities contained within website codes. However, progress is always being made and it’s now possible to employ automated tools that can identify when the code behind a website has been changed remotely. Alternatively, disabling scripts on your website is a guaranteed remedy, but that comes with the headache of reduced functionality which could easily eat into your revenue.

Regardless of whether your website’s code is secure or not, the activities of Magecart are proof that hackers are looking for new and cunning ways to breach your defenses. What’s most important is that you monitor all network activity and analyze any activity which is unusual otherwise you could find yourself with a huge number of unhappy customers at your door.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

GandCrab Ransomware Continues to Cause Huge Problems

Cyber Attack, Cyber Security, GrandCrab, Hacking, RaaS, Ransomware, Ransomware-as-a-Service, Security, Security Threats, , ,
13
Nov 2018

Defeating a particular strand of ransomware doesn’t mean it’s dead and buried; you only have to take a look at GandCrab to see how it can evolve.

GandCrab first emerged online at the start of 2018 and began to spread rapidly across the globe. Known as a Ransomware-as-a-Service (RaaS) attack, GandCrab has been able to continue causing chaos thanks to its code receiving regular updates. Now, as ransomware is such a pressing concern at the best of times, the realization that it can rapidly evolve is very troubling for anyone who heads online.

Due to the economic impact, not to mention the effect on productivity, that ransomware can cause to organizations, we’re going to take a close look at GandCrab to understand how and why it has evolved.

What is RaaS?

GandCrab is classed as a RaaS, but what exactly does this mean? Well, RaaS is built upon an attack where ransomware is written by cyber-criminals and then sold on to attackers who may not have the technical knowledge to write their own ransomware. Sometimes, however, the attackers may be perfectly capable of writing their own ransomware, but they don’t have the time and are just looking for a quick buck instead. Nonetheless, RaaS is highly popular due to the ease with which it can be deployed and the ready availability of the code. And this is exactly how GandCrab has been operating since the start of the year.

How Does GandCrab Operate?

Rather than concentrating on just one deployment method, GandCrab is particularly virulent thanks to its multifaceted approach which includes spam emails, exploit kits and malvertising. Once executed, GandCrab begins compiling information on the victim’s PC and scans for file extensions that it’s capable of encrypting. Early versions of GandCrab would encrypt files with a .CRAB extension, but the latest versions have begun encrypting files with 5 digit extensions that are randomly generated. GandCrab is also different to most other ransomware as it demands its ransom in Dash, a cryptocurrency which launched in 2015, rather than Bitcoin.

The Evolution of GandCrab

In total, there have been five versions of GandCrab released since its initial detection. Being a RaaS, the writers of GandCrab are keen to keep the money flowing in and this has fuelled their determination to update their product. Those who were infected by versions 1.0 and 1.1 were in luck early on as BitDefender managed to code a decryptor to retrieve files which had been compromised. However, this setback only served to inspire the hackers behind GandCrab to update the code significantly in GandCrab 2.0. Since then, less significant, but regular updates have allowed GandCrab to stay ahead of the security experts and keep their product bringing in its illicit income.

Can GandCrab be Defeated?

Despite the strength of GandCrab’s defenses, it appears that the security experts may be getting closer. Recent developments have seen BitDefender refining their decryptor software to unlock files encrypted by GandCrab versions 1, 4 and 5. Unfortunately, progress on decrypting files encrypted by versions 2 and 3 has been much slower and these files remain encrypted unless the victims are willing to pay the ransom. Ultimately, the best way for your organization to protect its data from the threat of ransomware such as GandCrab is by practicing best security practices and not having to decrypt any files whatsoever.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 14 15 16 17 18 … 47