6 Tips to Protect Yourself From Ransomware

Security,
30
Aug 2016

ransomware-expert-tips-featured Ransomware is a fairly new security risk, but one which is on the rise and it’s vital that you know how to protect your data from ransomware attacks.

I’ve covered ransomware attacks on this blog on a number of occasions and detailed the damage it can do to businesses. It’s a particularly nasty evolution for hacking and one which often leaves you no option but to pay the ransom to decrypt your data.

Obviously, no business wants to find itself in the position where it has to give in to the hackers’ demands, so prevention is the key. And to help you get your defenses more secure, I’m going to share 6 tips to protect yourself from ransomware.

Backup Your Data

backup_banner_resized

If your data becomes the victim of a ransomware attack then it may seem as though you have no option but to pay the attackers to release your data. However, the simplest way to reduce the damage in this instance is to ensure that your most crucial data is backed up offline. This can be as simple as backing up data to portable storage devices.

Create Strong Passwords

To cut hackers off early on in their ransomware attacks, it’s crucial that you ensure your systems are protected by strong passwords. Whilst you might think that no one is going to predict that you’ve used your mother’s maiden name, it’s relatively easy to hack this through brute force. To make this harder, you should add numbers and symbols to prevent the password being cracked.

Identify Suspicious Email Attachments

Shackleton-Phishing

The most common route for ransomware to infiltrate your systems is through seemingly harmless email attachments. And it’s important that your staff know what makes for a suspicious attachment.

In particular, emails which contain attachments from senders you don’t recognize should always be double checked. However, you need to be aware that people in your contacts list could be hacked and then used to distribute the ransomware, so vigilance is always important.

Disable Macros

Many ransomware attacks involve Microsoft Office documents which are loaded with malicious macros which allow backdoor access into networks. Thankfully, Office documents will always give you the option to enable or disable macros; if you suspect that anything about the Office document doesn’t seem right then disable the macros or, more simply, just close the document.

Install Patches ASAP!

Ransomware loves finding vulnerabilities in software and this underlines the importance of installing updates released by software publishers. It may seem a little time consuming – particularly when you need to shut down your system – but it’s essential that you install all patches immediately to provide you with maximum protection.

Shut Down Your Network

Once a piece of ransomware has breached part of your network it can spread very quickly. Therefore, the best course of action may be to simply disconnect your network. This may cause a huge disturbance to your businesses activities, but it may be less painful than compromising your data. With the spread halted, you can then investigate your options for decrypting any affected data.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Wendy’s Getting Hacked Teaches Us a Valuable Lesson

Security
16
Aug 2016

wendys-623x425

At fast food restaurants you know what to expect: value and speed. Fast food joint Wendy’s, however, has also been unknowingly serving up credit card fraud.

In the last week, Wendy’s has had to contact customers who have used their credit cards in over 1,000 restaurants. That’s nearly 1 in 3 Wendy’s restaurants and it makes for a huge number of affected customers.

Wendy’s are currently unable to tell just how many customers have been affected, but they do know that this attack was delivered by malware. Now, we all love a bit of a fast food, but we most certainly do not love cyber-crime!

And that’s why I want to show you what happened to Wendy’s and how your own business can avoid a similar situation.

Wendy’s Attacked

The hackers have been able to take control of Wendy’s point of sale (POS) systems which are comprised of the cash register and credit card devices. Although it’s not been discovered how Wendy’s POS systems have been compromised, it’s been identified as a traditional malware attack.

It’s believed that malware has been used to infect franchised stores through the theft of login credentials. This could, for example, be through phishing methods whereby information is extracted by employees through dishonest means e.g. spoof emails from head office requesting login details for “security checks”.

Whatever the method, it’s been successful enough for hackers to then access the POS systems and, potentially, take sensitive credit card information about every single card which has passed through the systems. And you’ve seen the queues at Wendy’s, so you know that’s a lot of credit cards.

Wendy’s was first hacked in January 2016 following unusual activity on credit cards which had recently been used at a number of Wendy’s stores. Similar attacks have intensified recently and this has led to Wendy’s having to release a statement on the situation.

Protect Yourself and Your Customers

wendy_s-e1468008491980

Your customers are your businesses lifeblood, so it makes sense that you want to protect them and their finances. And the first line of defense is your staff, so it’s crucial that they’re well versed in how to deal with any suspicious activity they may encounter.

Hackers, you see, are unable to deploy their malware if they’re unable to breach your system’s defenses. And, for most businesses, this will be the good old fashioned ‘username’ and ‘password’ combination. It’s a popular choice as it’s a difficult combination to crack.

Employees, though, can quite innocently slip up and fall prey to the deceptive and sophisticated methods of hackers.  However, an increasingly popular way to reduce the impact of compromised login credentials is to employ multifactor authentication. This provides additional walls of defense such as requesting a unique code which is emailed to an employee when they need to access specific systems.

Final Thoughts

Wendy’s isn’t the first fast food chain to have credit card details stolen, but it’s certainly the biggest so far and this will send out alarm bells across the industry. It’s a troubling cyber-attack and another one which highlights the importance of a strong front line defense. Multifactor authentication is certainly useful, but a concentrated effort towards recognizing initial threats is key.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Tech Support Scams Are on the Rise

Security,
02
Aug 2016

We all rely on tech support at some point during our working week, but hackers are now using this as a front to scam businesses out of thousands of dollars.

It’s a scam which is becoming so widespread that the FBI have stepped up and announced that, in the last three months, close to two and a quarter million dollars have been stolen from businesses. These losses are the result of just over 3,500 separate incidents, so they can’t be dismissed as isolated incidents.

The actual scam involves hackers impersonating tech support teams and taking control of users’ PCs, so this is a very deceitful scam and one which we need to investigate.

Understanding the Scam

mac-popup-tech-support-scam

This latest attempt at swindling businesses out of money is a particularly clever one as it preys on the anxiety of computer users. Those affected find that they will receive one of the following prompts which all demand handing over remote access:

  • A pop up message which states that viruses have been detected on the PC and that it’s under attack. A ‘helpful’ phone number is then provided for that individual to contact technical support.
  • A telephone call from a tech support employee – usually with a foreign accent – who claims to have evidence that the PC is infected and sending out error messages. This tech support employee will claim that they can help resolve the attack.
  • A ‘Blue Screen of Death’ will be displayed which warns that the PC has become infected and that the PC user needs to contact a technical support number.

All these methods lead to direct communication with a shady individual who will request that any mobile devices are connected to a PC to carry out detailed security scan. Naturally, these ‘scans’ always reveal numerous viruses and a fee is then demanded to eradicate these viruses.

Resisting the Tech Support Scam

internet-computer-securityAs you can see, from the amount of money stolen so far, this is a very serious scam, so you need to make sure that your employees know what to do if they’re affected. Therefore, you need to communicate the following advice:

  • Make sure that all security software is up to date. There have been some reports that security software has given alerts just before these scams have been attempted online.
  • Once one of the suspicious pop up messages or Blue Screens of Death are received, the user should shut down their device straight away. This will usually clear the intrusive demands for action.
  • The hackers will try and instill a sense of fear and urgency to scare users into making quick payments, so users must remain calm and disconnect the call.
  • Users must avoid giving over any remote access to unauthorized individuals who are posing as tech support employees. Reputable tech support teams will never demand this sort of access.

Final Thoughts

It’s important that PC users are aware that hacking doesn’t always involve downloading malicious software. Sometimes, the age old act of deception can be employed to create a sense of fear which leads to people making snap decisions and losing money as a result.

If you have been affected by this particular scam then you should report it at www.ic3.gov

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Increased Necurs Botnet Activity Means More Malware

Security, ,
26
Jul 2016

serveimage Malware is often forwarded by swarms of infected PCs known as botnets; just recently the Necurs botnet has really ramped up its activity to cause havoc.

The Necurs botnet, which has been active for several months, suddenly went quiet for three weeks, but, on June 22, it was responsible for sending 160 million malicious emails. This is a huge amount of traffic and particularly troubling for businesses.

It’s important that you understand what the Necurs botnet is capable of and how to avoid being swallowed up in its activities, so I’m going to run through how it works.

Understanding a Botnet

First off, we need to understand what a botnet is, so let’s take a look at that.

Although it sounds like a futuristic android, it’s much more contemporary than that. Also known as zombie computers, a botnet is a collection of PCs which have become infected and allowed external users to access them.

In these cases the hackers are looking to exploit these PCs and their bandwidth to carry out all manner of dubious actions. These can range from crippling websites with huge amounts of traffic they can’t cope with (a Distributed Denial of Service Attack) or mass email campaigns containing malicious software.

The botnet ‘army’ is created by exploiting open ports on PCs which allow Trojan viruses to gain access and deliver their payload. The botnet controller then has remote access to many thousands of PC to carry out bigger attacks very quickly.

What Does Necurs Contain?

serveimage

Necurs main operation, at the moment, is to deliver two particularly nasty packages in the form of Locky and Dridex.

Locky is part of an increasingly popular attack known as ransomware. This malicious software is most often sent as an Office document which requests that you enable macros to translate some nonsensical text. Once this request is approved then Locky gets to work by encrypting your personal files and demanding payment to decrypt them.

Dridex is a piece of malware, also activated by Office documents, which looks to cause financial chaos by stealing banking information such as login credentials. It carries this out by monitoring network activity and taking screenshots of user activity.

Protect Yourself From Necurs

serveimage (1)Becoming part of a botnet not only threatens your own security, but also risks the security of millions of other users all over the world. That’s why you need to make sure you’re fully aware of how your PC can become enslaved, so it’s crucial you take the following steps:

  • Ensure you have a firewall which is turned on at all times. This provides a first line of defense which can monitor any unusual network activity on your PCs.

Even if you’re not part of a botnet you still need to remain vigilant due to the emails being sent by infected computers. Both Locky and Dridex can create a lot of trouble for businesses, so it’s vital that you don’t fall foul to their deceptive attachments.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Why Bank Robbers are Going Digital

Security, ,
19
Jul 2016

Digital-MoneyBank robberies have long since put the fear of god into bank tellers, but bank robbers are now turning increasingly towards more sophisticated digital attacks.

Whereas a good old fashioned bank heist would involve shotguns and masks, the contemporary bank robber relies on nothing more than a keyboard and a mischievous sense of ingenuity. And, whilst you would think banks were pretty keen on cyber security, two major banks in Vietnam and Bangladesh have recently fallen victim to cyber hackers.

It’s always important to understand the methods and motivations of hackers, particularly when finances are targeted, so let’s take a look at what’s been happening.

A Digital Crime

The banks that have been attacked recently are Vietnam’s Tien Phong bank and the Bangladesh Bank. Luckily for Tien Phong the attack was intercepted, but the Bangladesh Bank was less lucky and lost close to $81 million.

But how did these attacks happen in the first place? After all, our money is surely safe in a bank, isn’t it? Unfortunately, in this day and age, nothing which involves computerized systems appears to be safe. And, in both of these bank robberies, our old foe malware was responsible yet again.

Hacking the Banks

Security concept: Lock on digital screen

Financial institutions are constantly in communication with one another in order to complete transactions. Naturally, the numbers of transactions that take place in any one day are astronomical, so they rely on the SWIFT network to facilitate all these transfers.

It’s believed that the attackers were able to glean login details for SWIFT from bank officials, but how this occurred is not exactly clear. Unfortunately, due to human error and naivety, login details can easily fall into the wrong hands. Anyway, this entry to the system gave the hackers free reign to conduct a number of lucrative transactions which would swell their own bank accounts.

Malware was then executed within the SWIFT system to alter payment confirmations; the malware’s aim was to cover up the illegal transactions which had been carried out. And the malware, although slightly altered, was the same code used in both Bangladesh and Vietnam.

Tien Phong managed to intercept the hack on their finances as they noticed a number of shady transactions taking place; this allowed them to prevent the fraudulent movement of funds. Bangladesh Bank, however, did not manage to block all the transactions and lost around $81 million – although up to $1 billion worth of illegal transactions were attempted.

Is Your Money Safe

Thankfully, your money is pretty safe within a bank. Even if they do suffer any losses through cyber-crime, it will be the bank who takes the hit and not your personal account. However, it does raise some interesting questions about security.

The complexity of banking systems means that it’s likely an insider was used to help gain access to SWIFT and then understand how to complete the transactions. And SWIFT was compromised far too easily by the hackers, so this indicates a major lapse in the network’s preventative measures.

Hopefully, the banks and SWIFT will move to adopt more cautious approaches to security clearance and protecting their systems.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 27 28 29 30 31 … 47