The Threat of Malvertising

Security,
20
Dec 2016

malvertising

Some websites are seen as trusted, but malvertising is a new threat to the world of cyber security and may cause every website to be viewed with caution.

Now, we’ve all been irritated by online ads whilst trying to enjoy our favorite websites, but, with the advent of malvertising – short for malicious advertising – they’ve reached a new level of irritability. And it’s a threat that has the potential to affect everyone with popular sites such as Spotify and Reuters already falling victim.

As it’s such a new threat, it’s a good idea to familiarize yourself with the signs and symptoms of malvertising in order to protect your data and feel safe.

What is Malvertising?

online_shopping_scam

Popular websites tend not to handpick their adverts and, instead, they turn to third party ad networks who are able to use complex algorithms and read cookies (tracking files left legitimately by websites) to deliver bespoke adverts to visitors.

And, what many people are unaware of, is that when you connect to sites such as Spotify and Reuters, you’re also connecting to a number of other web addresses and these can include third party ad networks. Naturally, this instantly provides a number of routes for hackers to exploit that the web user is completely unaware of.

With malvertising, hackers use these footholds to deliver malicious adverts which may appear to be genuine, but contain malware. Sometimes the web user will need to click on the ad to activate its payload, but many other forms of malvertising will embed scripts in the affected webpage to automate the execution and infect the user.

Malvertising is also particularly effective as it’s able to ascertain details of the user’s operating system and web browser which is crucial for hackers to launch specific attacks e.g. Firefox running on Windows XP will have different vulnerabilities to Internet Explorer running on Windows 8.

Hackers can also target specific individuals by infecting ads which use specific keywords e.g. a lawyer looking for “lawyer briefcase”, so this, again, highlights just how sophisticated and bespoke a method of hacking malvertising is.

Combatting Malvertising

protect_against_advertising

Malvertising may be new, but it doesn’t mean you need to panic about being defenseless. In fact, if you follow the advice below then you should find you’re well protected from malvertising:

  • Keep your browsers updated – Internet browsers such as Chrome and Internet Explorer are designed with safety measures in place to identify websites exploited by malvertising. However, you need to ensure that your browser is up to date to ensure you’re protected from the latest threats.
  • Update Flash – We’ve discussed the security flaws in Abobe Flash before and it’s no surprise to discover that malvertising just loves to exploit Flash. Therefore, it’s crucial that all patches and updates are installed as soon as possible. Or, alternatively, just disable Flash from running at all times.
  • Use ad-blockers – Popular with many users, ad-blockers prevent ads from being displayed and prevent users clicking on them and activating malware. These may, however, block genuine adverts that are necessary, but these can easily be put on ‘exceptions’ lists.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Security Fatigue Is a Threat to Data Security

Security
13
Dec 2016

confusion

We’re frequently bombarded with requests to remember and reset passwords, but this taxing memory drain is causing security fatigue and making us less safe.

And this security fatigue is causing PC users to take shortcuts with their cyber security e.g. using the same password time and time again across all the online platforms you have to sign in to. Whilst this is a simple solution, it’s also incredibly unsafe as it’s compromising the security of almost all your data.

As this is a security threat which is entirely rooted in the user base, it’s one that’s relatively simple to treat, but in practice it’s one that’s overlooked. Let’s take a look at exactly what’s happening and how you can tackle it.

What Is Security Fatigue?

It seems that not an hour goes by where we’re not prompted to change a password, verify an incoming connection or download a security patch. And this can be a time consuming affair when we’re in the middle of something important, so many PC users begin to experience security fatigue and go for the easy option: ignore everything.

Unfortunately, this puts you at a high risk of susceptibility to hackers. If we go back to our password example, from earlier, we can begin to understand the risks of security fatigue – you won’t just lose one account’s data, but all your data period. And, obviously, overcoming this security fatigue and creating multiple passwords is going to contribute heavily towards damage limitation.

Tackling Security Fatigue

security-fatigue-a-wakeup-call-for-business

The use of computers in our daily business lives has rapidly expanded in the last 15 years, so the need for security has rapidly increased accordingly. Whereas you once needed just one password to log on your PC, you now probably have to have a whole host of passwords for accessing databases, online portals and emails etc.

As a result there’s no going back to the days of single passwords – we now require around 25 daily to cover all our needs – so we need to learn how we can adapt to this new landscape. And there’s no use dismissing the threat of hackers targeting your data simply because it doesn’t relate to anything important. If a hacker can find even the most insignificant entry point into your network they’ve got a huge head start on causing damage within.

Organizations, therefore, need to work towards lightening the load on their user’s security requirements, but at the same time keep their data secure. This is not an easy problem to solve, but by employing the services of security companies you can gain professional insights on the best way to create a simple security system which reduces the difficulty of decision making and prevents security fatigue setting in.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Cyber Crime as a Service – A New Threat

Security, Uncategorized, ,
08
Nov 2016

Computer crime concept

The latest evolution in hacking is here and it’s known as Cybercrime as a Service (CaaS) and it promises to create faster, more powerful hacks, but how?

Well, many people have a need to carry out hacking operations, but don’t have the technical skills to design or even launch these types of cyber-attacks. Therefore, there’s a niche in the market for those who do know how to design a piece of malware to monetize their skills. And this is what the foundations of CaaS are built upon – money and cybercrime.

How exactly does it work, though? And what does it mean for the future of cyber security?

What is CaaS?

Hacking has rarely been referred to as an ‘industry’ despite a few individuals willing to carry out cyber-attacks in exchange for money. However, with CaaS, hacking appears to be turning into an industry which means big bucks and nightmares for computer owners all over the world.

Say, for example, a disgruntled ex-employee wants to sabotage their previous employer’s website to cause disruption to their activities. Now, it’s highly unlikely that this employee would be skilled in the world of cyber-crime, so what would they do? Well, previously they would have tried reading a few online articles about hacking and then given up when they realized how difficult it was.

With the advent of CaaS, though, this ex-employee could easily purchase the software or the execution services of a skilled hacker. Naturally, this is a highly illegal act for both parties, so the resources for these types of services tend to be hidden on the dark web to lower the chances of identification.

Consumers can expect to find malware kits, access to infected computers and even botnet rentals which allow the initiation of Denial of Service attacks. Therefore, it’s somewhat of an Aladdin’s Cave for someone who is looking for quick, easy access to cybercrime e.g. exploit kits can be purchased for just $50 per day and, believe me, they can cause a lot of damage in one day.

What Does CaaS Mean for Hacking?

mobile phone crime concept of thief stealing money when mobile phone is on insecure network

CaaS is making hacking much more accessible for the average computer user whereas, before, it was purely the preserve of those who had the skill to design malicious software and carry out sophisticated attacks. This means that we can expect to see an increase in attacks in the future, so safeguarding your networks is more important than ever.

One of the most troubling aspects of CaaS, though, is that when a service becomes a business it drives competition amongst the vendors. And this means that those hackers who are designing exploit kits and various other hacking tools are going to have to up their game to remain in the market.

Therefore, we’re going to see a rapid evolution in the capabilities of hacking tools, so expect faster and more devastating attacks which are harder to stop. In order to protect yourself from these enhanced attacks you’re going to have to ensure that your cyber security protocols enhance visibility of such attacks and prevent them taking hold of your systems.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Malware is Evolving and Getting Harder to Stop

Security, Uncategorized,
01
Nov 2016

new-hempacks-logo

We like to think that once a cyber-attack takes place that a solution will be found. However, malware is evolving and becoming harder and harder to stop.

In Q1 2016, Kaspersky prevented just over 228 million malware attacks and this is a   figure which has been increasingly rapidly for the last few years. In fact, several years ago, it would have been unlikely to see pushed 228 million malware attacks in an entire year.

Malware, therefore, remains big business for hackers so, naturally, they’re constantly looking to upgrade their weaponry to beat the firewalls and antivirus software we rely on. And it’s a digital arms race which the cyber security experts are struggling to keep up with.

Let’s take a look at why malware is getting harder to stop.

Ransomware Arrives

499979-ransomware-feature

One of the most reported evolutions in the malware landscape has been the rise in ransomware attacks such as Locky.

Ransomware is a form of malware which encrypts users’ files and then demands a ransom to decrypt them. Being a relatively new form of malware, knowledge regarding their build and execution capabilities is somewhat limited, so this is making them particularly difficult to combat.

What’s also crucial to the success of ransomware is that the majority of attacks are routed through anonymous Tor servers which mask the attacker’s true IP address. This means that identifying the hackers becomes very difficult and they’re able to continue operating impeded and improve their malware. And this evolution of existing ransomware is best demonstrated by the Locky Trojan which began as a .DOC file, but is now being identified as a .ZIP archive in order to evade detection.

Targeted Attacks

Malware has, traditionally, followed the same execution regardless of which network it has been deployed upon. However, hacking groups such as Poseidon are now ensuring that their attacks are, after the standard breach, able to customize the attack depending upon the network.

Poseidon maps their victims’ networks and harvests all the available credentials to ensure they can gain the maximum privileges on the network. And the reason for this customized attack is because Poseidon is actively hunting the computer which operates as the local Windows domain controller. If the hackers are able to take control of this computer then they will have free rein over the entire network.

It’s this type of attack which is a cyber-security firm’s worst nightmare as it involves extensive research into the intricacies of individual networks. This is very time consuming and underlines how hackers are actively looking to make themselves more powerful.

Long Term Evolution

adwind-rat-console

One of the biggest problems with Malware is that certain strains are constantly evolving into new strains. The best example of this is the Adwind RAT (remote access tool) which first appeared in 2012 as a tool for online spying.

Originally debuting under the name Frutas, it evolved into Adwind, Unrecom, AlienSpy and JSocket over the next three years. Starting off as a Spanish language piece of software, it soon received an English language interface which allowed it to spread worldwide.

All these changes have allowed the Adwind RAT to enjoy a long career and cause so many cyber-attacks. By actively changing its exterior appearance and name, it has fooled firewalls and antivirus software to leave security experts scratching their heads.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The 4 Biggest Myths of Computer Security

Security
25
Oct 2016

Computer security. Isolated on white with clipping path for laptop.

The fear of losing control of your computer network results in good security practices, but it also leads to half truths about security being shared.

And when myths about computer security begin to circulate, they soon begin to take on a voice of authority. This results in businesses taking these myths as facts and concentrating resources on areas of computer security where it’s not necessary.

To help you avoid falling into this scenario, I’m going to show you the 4 biggest myths of computer security.

1. All Security Threats Are External

It’s common to assume that all security threats originate from outside your organisation, but the truth is that sometimes the biggest threats are within your business. After all, those individuals that already work for your company have much freer access to your systems.

And this takes them one step closer to accessing your secure data without all the hassle of breaking through firewalls etc. Therefore, in the case of a security breach you also need to look at your own employees as, for example, an individual who was missed out on a promotion can easily become aggrieved enough to seek revenge.

2. One Piece of Software Is All You Need

Too often, businesses feel safe in the knowledge that they have an amazing piece of software which is a one stop shop for all their security needs. And, yes, this type of software certainly makes things look neat and tidy, but what if a security flaw is discovered in that piece of software? Suddenly, all your security practices are at risk.

In order to avoid this, you should aim to have different pieces of software in place to deal with security threats e.g. firewalls, antivirus, mail wash etc. With this setup you can rest assured that it’s much harder for hackers to carry out a theft of all your data at once.

3. Windows Is Not Safe

Windows 10 has certainly come in for criticism regarding security and this has led many critics of Microsoft claiming that Windows is a liability in terms of security. However, this is a little unfair.

Whilst PCs running Windows are certainly at risk of more cyber-attacks than Macs, Microsoft are constantly monitoring security threats and issuing patches when necessary. What’s particularly unsafe about Windows is its users.

And this is because users of Windows ignore automatic updates too often. Perhaps this is because they’re too busy checking Facebook, but if they’re not careful their Facebook, and much worse, will be hacked before they know it.

4. Computer Security Is Too Confusing

Many PC users struggle to deal with security threats as they’re very defeatist when it comes to learning about the basics of computer security.  And it’s not a surprise when you consider the amount of technical jargon involved.

However, the basics of computer security aren’t too confusing, so there’s no excuse for not getting to grips with them. If your staff members are able to embrace the core concepts of computer security – good password practices, understanding the threat of email attachments – you’ll find that the risk of succumbing to an attack is reduced.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 25 26 27 28 29 … 47