Virus Spreading over USB Thumb Drives
Virus Spreading over USB Thumb Drives

Spreading Viruses on USB Thumb Drives

Security, , ,
30
Jan 2015

Virus Spreading over USB Thumb Drives

To stay safe from infections, we’re going to look at how viruses spread over USB thumb drives and how you can protect yourself and your business.

Why would anyone deny the comfort level enjoyed with using USB thumb drives to conveniently transfer data? Beneath it all, there’s more to that data transference than meets the eye.

How Viruses Spread over USB Thumb Drives

It starts with attaching a USB Thumb Drive to a device for it to infect the computer. The machine is then infected using the Windows AutoRun feature which is trigger when a storage device is plugged in. Not only is the data transferred, but the device in which the data goes in becomes infected with malware (virus) and malicious software, causing damage or data loss.

autoruninf_thumb

The virus likely originates from the infected device the USB was connected to before. The process of transferring viruses can stem back through a chain of infected hosts, bringing with it a trail of disruption.

At present, it’s highly likely that most USB Thumb Drives connected to an infected device or PC hoards a virus in it. For instance, a new virus threat known as “BadUSB” works off USB thumb drives and is claimed to be unstoppable, according to security researcher Karsten Nohl.

Types of Viruses

The following types of viruses can infect a computer when the user runs or installs the infected program. Infection can occur through something downloaded from the Internet, or in most cases, loaded onto the computer from USB thumb drives.

  • Worm –a program that replicates itself by exploiting vulnerability on a network.
  • Trojan horse -appears to serve a useful purpose, but actually hides a virus, thus infecting the computer by tricking the victim into installing it willingly.
  • Rootkit – makes itself difficult to detect by hiding itself within the system files of the infected operating system.
  • Spyware -designed to covertly spy on a user and report information back to the originator.
  • Spam – common method of transmitting malware onto a user’s computer, usually via unsolicited email messages containing infected attachments or links to exploited websites.

How to Protect Yourself and Your Business

The most effective means of transferring virus for the hackers are through public data bases. Firstly, it is extremely important for anyone to restrict the use of USB thumb drives on computers based at net cafés, coffee shops, copy shops and even at an airport or a hotel, as they are for public use.

You never know which computer might be infected so plan to use business or personal systems over public computers as they are more vulerable to infected USB Thumb Drive viruses. Secondly, it’s best to run a firewall and update to the latest virus definition on any personal or business computers.

Turnoffautoplay_thumb

We suggest disabling the Auto Run functionality of the drive and avoid downloading “free online software” to better protect any USB thumb drive from adopting those menacing viruses.

For more ways to secure your business data and systems, contact your local IT professionals.

Read More

What is Remote Code Execution?

Network, Security, Uncategorized, ,
22
Jan 2015

binary stream

Why do hackers use remote code execution as a malicious attack on businesses? Here we’ll explain what remote code execution is and why most malware uses it.

Remote execution attacks are very real and should not be taken lightly. This is mainly due to the damage which can result in malware disabling parts of a system and disrupting business operations.

What is remote code execution?

Remote code execution can be best described as an action which involves an attacker executing code remotely using system vulnerabilities.

Such code can run from a remote server, which means that the attack can originate from anywhere around the world giving the attacker access to the PC. Once a hacker gains access to a system, they’ll be able to make changes within the target computer.

The attacker leverages the user’s admin privileges to allow them to execute code and make further changes to the computer. It’s often the case that such user privileges become elevated. Attackers usually look to gain further control on the system they already have a grip on and look to exert control onto other computers on the same network.

Examples of remote execution attack

Whether a business realizes it or not, malware threats are consistently looking for vulnerabilities and a chance to infiltrate past security. In essence, every attacker is an opportunist and they’re unlikely to hold back once they’ve spotted a loophole within a system.

Scenario 1:

Zero-day Internet Explorer Exploit CVE-2014-8967

An employee browses the Internet with the Internet Explorer browser and visits a website, which they were prompted to visit via an unsuspecting email message. Little do they know that the website exploits a bug on their browser, allowing for remote execution of code to occur. The code is set up by a criminal who has programmed it to run on the employee’s computer, and in turn, installs a Trojan virus. A Trojan allows a back door into the computer, which can be accessed at any time by the attacker. At this point, the criminal has complete access to the employee’s data files and will do as they please with it.

Scenario 2:

Windows_XP_End_of_Support

A business runs an unsupported version of Windows on a computer, which happens to be Windows XP.  An employee visits a website, however this website has been compromised, and a bug detects the user working on a computer that has Windows XP. Since this particular operating system is no longer patched by Microsoft, vulnerabilities are eminent. The bug picks up on this and begins remote code execution, set up by a criminal, to run ransom-ware on your computer. The ransom involves the criminal holding the company’s files hostage until payment is made.

How can you protect against remote code execution attacks?

For more ways to secure your systems, contact your local IT professionals.

Read More
Malware holding data ransom
Malware holding data ransom

Timeline of Sony Cyber Attack

Uncategorized, ,
20
Jan 2015

Malware holding data ransom

The Sony data breach in late 2014 has caused embarrassment towards their own top executives and employees. Here is a timeline of the Sony hacking events.

Here’s the timeline of the 2014 Sony Pictures Cyber-attacks:

November 24

Sony Pictures Headquarters

Early morning at Sony Pictures Entertainment Headquarters, based in Culver City, an image of a skull with long skeletal fingers simultaneously appeared on all employee’s computer screens. The image contained a threatening message saying, “This is just a beginning. We’ve obtained all your internal data.” This was noted to be the first sign of the digital break-in.

November 25

Computers at Sony headquarters in Culver City and overseas remain shut down.  The spokesperson of Sony Pictures Entertainment said that they were investigating an IT matter. However, several news organizations report that Sony has suffered a digital security breach.

November 26

Sony employees continue working even without computers and other digital technologies, such as voicemails and emails.

November 27

Mr_Turner_Promo_Poster

Five Sony films were leaked online and made available on on-line file-sharing hubs. Four of the five films are yet to be released. Included in the films are Brad Pitt’s Fury, Annie, Still Alice, Mr. Turner, and To Write Love on her Arms.

November 28

Initial reports surface that Sony Pictures Entertainment suspects North Korea being the one responsible for the attack. Sony beleives that the attack is in retaliation for the film “The Interview”. The story is about a plot to assassinate the North Korean dictator.

November 29

Computer_Turned_off

Sony’s computers are still shut down.

November 30

The speculation and reports indicate that North Korea is behind the cyber-attack.

December 1

Multiple confidential Sony documents were leaked including the pre-bonus salaries of Sony’s executives. The information also includes salary details of more than 60,000 Sony employees. Executive figures are published in many sites, including Deadline. Sony works with the FBI to investigate the attack.

December 2

A company-wide alert was delivered to employees about the attack, which was issued by Sony’s chiefs Amy Pascal and Michael Lynton.

December 3

Critical information has been extracted from a big dump of stolen data which included a large list of account credentials, YouTube authentication credentials, UPS account details, all in plain text. To add to this, it also included a collection of scathing critiques of Adam Sandler movies along with files containing information on passports and visas of crew and cast members who have worked on Sony films. Some of this confidential information is published on online sites, including a 25-page list of workplace complaints of Sony employees.

Sony stated that the investigation is on-going.

December 4

FBI_Seal

A Flash warning from the FBI is made regarding the malware attack, named Destover Backdoor, and alerted all large American security departments.

Press reports also stated that some cyber-security experts found out some significant similarities between the codes used in the cyber-attack of South Korean companies and government agencies, which were also blamed on North Korea and the codes used in the Sony attack.

December 5

The Sony attackers who are claiming to be the “Guardians of Peace” sent Sony employees an e-mail threating them that they will hurt their families if they don’t sign a statement disclaiming the company.

December 7

Further data leaks occur involving the financial details from Sony Pictures. According to Bloomberg, the leak traces back to a hotel in Thailand where an executive from Sony was lodging there at the time.

North Korea praised the attack by calling it a “righteous deed” and denied any involvement in the attack.

December 8

More leaks, which were uploaded to pastebin, were added but were soon taken down. This information illustrated details of email archives belonging to two executives; the President of Sony pictures and his co-chairman, Steve Mosko. This leak was believed to have not been North Korea; it most likely came from a disgruntled employee group.

December 10

The_Pirate_Bay

More legitimate leaks are disclosed, this time pertaining to details of tracking film piracy activities. Such activities include showing Sony’s internal anti-piracy procedures and details regarding the five ISP (Internet Service Provider) giants, used to monitor illegal downloads.

December 12

News reports from Buzzfeed, Bloomberg News, and Gawker stated that stolen documents from Sony were released, which included the medical records of Sony employees. The listed medical conditions include liver cirrhosis, cancers, and premature births.

December 13

Further genuine leaks are involve financial account information, showing revenues, expenditures, past and current projects, and deals, of which are all current still to Sony.

December 14

Spectre

The latest batch of stolen Sony documents was released by the hackers. Included in these documents is the latest version of the script of “Spectre” which is the next James Bond Film. Sony hired famous litigator David Boies who sent a letter to different news organizations demanding that they erase all stolen information that the hackers had provided them.

December 15

Former employees of Sony filed a class-action lawsuit against the studio with the claim that Sony took inadequate security measures to protect their personal data.

December 16

The hackers sent an e-mail to reporters threatening to attack movie theaters that will show “The Interview”, which was set to premiere on Christmas Day. The communication sent by the cyber terrorist to the reporters even mentioned that they should  remember the 11th of September 2001.  They also threatened to fill the world with fear to show to the people that Sony Pictures Entertainment has created an awful film (The Interview).

Another batch of data was released including a huge number of e-mails stolen from Sony’s co-chairman and CEO Michael Lynton. Former Sony employees filed a second class-action suit with the claim that Sony was negligent in not protecting their personal data.

In connection with the threat made by the hackers to theaters, Sony told theater owners to cancel the showing of the film “The Interview” if the threats of the hackers worry them. In response to this, Carmike was the first chain to declare that it will not show the film. Landmark Theaters also said that the New York premiere of the same film was been cancelled.

December 17

The_Interview_Poster

Sony Pictures Entertainment pull the planned release of the film “The Interview” on Christmas Day in connection with the threat of the cyber terrorist to attack theaters that show the film. Moreover, Sony also pulls every TV advertisement of the film.

December 18

The hackers praised Sony’s decision of pulling the premiere of the film and said that as long as the film was kept out of theaters the threat will end. However, there is still a high chance of attack if the film is to be released in VOD (video on demand).

December 20

North Korea invites the United States to take part in a joint investigation regarding the Sony attack as a proclamation of their innocence. However, they warned the United States of “serious consequences” if ever they retaliate.

December 23

Sony decided to move ahead with the release of the film on Christmas day and allow it to be screened across participating theaters.  Simultaneously, the film would be planned to be released in VODs. Sony claimed victory for this decision since they have never given up a film before.

December 30

Sony made the film available for rent online.

Final thought …

This timeline for Sony Pictures Entertainment Cyber Attack serves to create a better picture of what all the fuss was about. With so many events, it can be confusing to keep up with the news; therefore, we hope some value is found from understanding what such a run of malicious attacks can do to a company, even as big as Sony Pictures. Stay safe and always keep your systems and networks up to date.

For more ways to secure your data and systems, contact your local IT professionals.

Read More
Wiper malware attack on Sony Pictures
Wiper malware attack on Sony Pictures

Sony Under Attack: The Wiper Malware

Security, , ,
29
Dec 2014

Wiper malware attack on Sony Pictures

The sophisticated Wiper malware which was launched against Sony Pictures does exactly what it sounds like: wipes anything and everything from systems.

“Wiper” uses a malicious set of attacks:

  • Wipe out all information held on hard disks
  • Reboot servers
  • Prevent access to Exchange emails
  • Close down networks
  • Used on all versions of Windows

How Wiper malware works:

  1. The Wiper executable file, recognized as exe, is known as a “dropper” file.
  2. This file will install itself over supporting files and as a trusted Windows service.
  3. It also creates a network share within the system root directory. This allows any other computer over the network to reach it.
  4. It uses the WMI (Windows Management Interface) to communicate with other machines and run code to and from them to spread itself further across the network.
  5. This allows wiper to gain access to any machine on the system via a computer network exploitation (CNE).
  6. Broadcasts are sent out to remote command networks via a “beacon” message, the malware is already accessing the hard drive to delete data by each sector.
  7. It overwrites data with ordinary user privileges by disguising itself as a USB 3.0 device driver.  This is a commercially available disk driver, made by EldoS.
  8. It then instructs the operating system to halt for a couple of hours then wake up with a reboot. By this time, all the data is wiped clean by the malware.

Wiper attack on Sony Pictures

Sony Pictures is a prime example of being on the receiving end of the “Wiper” attack. This particular attack recently gained media attention, got the FBI involved and caused a stir at Antivirus companies.

Wiper malware memo from FBI

A snippet from the FBI memo about Wiper

Speculation at Sony from a Re/code analysis reports links the attack to North Korea. This is partly due to a near identical attack carried out against South Korea by their northerly neighbors. Originally it was claimed the attack was motivated by disgruntled ex-workers who were laid off due to a company restructure earlier in the year.

What can you do?

It’s likely that this kind of attack is mostly aimed at very high profile companies, like in our example above. In general it’s wise to do the following to keep on top of your business or home security:

  • Update Anti-virus definitions. Be sure to have the latest updates from you Antivirus provider. Updates are added regularly to detect and quarantine suspicious files from doing further damage.
  • Verify your backups, and opt for an offsite or Cloud solution, in the case of a catastrophic data loss.
  • Update your critical Windows Servers and desktops with the latest operating system security patches.
  • Avoid being spear fished. Do not open unknown emails which contain attachments or files. Be conscious of spoof emails that may trick you into clicking attachments.
  • Lock down USB usage. With the help of an endpoint management solution, you can set policies to only allow authorized USB devices, which can help prevent this type of attack.
  • Revise your IT policies to only give specific administrators privileges to run, execute and share resources.

For more information about the Wiper virus and how you can protect your business from malicious malware, contact your local IT professionals.

Read More
Why it's important to update Flash
Why it's important to update Flash

Malware Spreading Through Adobe Flash Exploit

Office IT, Security, ,
21
Nov 2014

Why it's important to update Flash

Flash is common enough to be a prime target for malware.  A new Adobe Flash exploit has been found allowing criminals to run malicious code.

Flash is susceptible to tampered files used to display multimedia, videos and animations while you are browsing the internet. This mainly affects desktops; however, it’s not an issue with servers since servers are less likely to have users on them browsing the internet.

Understanding the new Adobe Flash vulnerability

  • Taking a closer look at the cause for infections spreading through Adobe Flash, the risk usually lies in binary browser vulnerability within the .SWF files, where it is dropped by an undisclosed iframe.
  • Iframe is an inline frame. Back in the 90s, Microsoft came up with the idea for basic webpages to point to another page. This allowed a website to combine the content of its page with another. An iframe allows you to embed one site into another one seamlessly, with two different webpages displaying as one. Sounds like a great idea at the time, right?
  • It initially worked very well for Internet Explorer. What wasn’t foreseen was malware authors exploiting these iframe features.
  • This exploit affects only Internet Explorer users, which is why we urge everyone to use a more secure browser such as Firefox or Chrome. 

What does this Malware vulnerability do?

  • The injected iframe may have something subtly embedded such as a single pixel within the SWF file.
  • It’s high risk to Internet Explorer Users, where the Iframe can identified by its negative absolute positioning and random number approach.
  • The usual behaviour from these types of files will eventually take you to a currently black-listed blank domain.
  • This, of course, could change at any time. It could pose as a spoof site, aiming to steal data or to install malware.

How to protect yourself

The solution is simple, stay on top of your Adobe Flash updates. This is very important, especially if you use your web browser to do online gaming, stream music, watch videos and animations, such as on YouTube, which nearly always uses Adobe Flash Player.  By keeping updated with the latest Adobe updates, you’ll help to close down those vulnerabilities discussed above, and more.

Update_Adobe_Flash_Message

It’s good news if your choice of browser is Google Chrome. Chrome automatically updates your browser to the latest version of Adobe Flash.

All Onsite PC Solution Managed Services clients are automatically protected during their monthly maintenance.

To learn how to update Adobe Flash, please see our article Here (https://www.ophtek.com/should-you-update-adobe-flash/)

 

Read More
1 … 25 26 27 28 29