Panda Malware Continues to Thrive and Make Money

malware, Ophtek, Panda Malware, Security, , , ,
08
Oct 2019

One of the biggest threats to data security over the last few years has been crypto-malware. And, as the Panda malware proves, it can be a persistent danger.

We may think of pandas as gentle, beautiful creatures but that notion only applies when we’re talking about mammals. When it comes to malware, Panda is far from gentle. The malware in question has been active in the digital landscape since 2018 and, since then, has managed to secure close to $100,000 in cryptocurrency ransoms. And it has achieved this by constantly reinventing itself and modifying its structure. Staying one step ahead of the security experts is crucial for malware and Panda has done this with aplomb.

Understanding the motives and mechanics of Panda is important in strengthening your organization’s security, so let’s take a closer look at how it works.

What is Panda?

First identified in 2018, Panda is a form of malware which combines crypto-malware with remote administration tools (RATs) to render any infected PC under complete control of the hacker. Not only is the victim at the risk of having their data encrypted, but there’s the added danger of unauthorized access to their PC at any time. Panda achieves all of this by exploiting web applications, spreading via infected Word documents and unauthorized downloads by compromised websites. Web applications that have been found to be infected include a wide variety of industries such as social media, financial, web services and digital analytics.

How has Panda Managed to Persist?

Most malware has a relatively short lifespan due to design flaws and the talents of security experts, but Panda has persisted for over a year now. It owes this longevity to its coders and the speed at which they evolve Panda. The malware has always been an expert in stealth and this has allowed it to escape the attentions of antivirus software. Most concerning, however, is the number of additions that have been added to Panda’s arsenal since it first appeared. Reports have indicated that Panda now includes highly sophisticated exploit tools originally designed by the NSA. It’s that most dangerous form of malware: one that continues to grow in strength.

Protecting Your Business from Panda

Panda is a dangerous piece of malware, but it’s not one that you need to live in fear of. Instead, make sure you remain vigilant by implementing the following:

  • Regular training for your staff is essential in keeping your defenses as strong as possible. The knowledge that these training sessions provide is invaluable for keeping your staff up to date on current threats.
  • Crypto-malware’s main objective is to encrypt your data and then demand a ransom. Therefore it’s important that you establish a backup routine that ensures your files are kept securely in more than one location.
  • Monitor any unusual network activity. Panda may be highly skilled when it comes to stealth, but its operation is likely to lead to unusual traffic in and out of your network. Identifying this early on may allow you to limit the damage caused.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Just How Safe is Your Data with Kaspersky?

Data Security, Javascript, Kaspersky, Online Security, Ophtek, , ,
01
Oct 2019

Cyber-security providers should be able to guarantee you one thing: security. However, it appears that Kaspersky isn’t as secure as you would imagine.

It’s fair to say that, with revenue hitting $726 million in 2018, Kaspersky is a major player in the cyber-security world. And it’s this success that has cultivated the high levels of trust placed in their products. Many would say that going without Kaspersky products in the 21st century is a foolhardy move. And they certainly are effective at preventing security breaches when it comes to PCs. But stories are now emerging that your data isn’t necessarily safe when it’s in their hands.

We live in an age where it’s important to stay safe online and, accordingly, many people reading this will be using Kaspersky products. It’s crucial to be aware of any potential data risks, so we’re going to examine this story a little closer.

What’s happening with Kaspersky?

Malicious websites can be a nightmare when it comes to protecting your data. Kaspersky understands this threat and has designed software which can identify whether a website is malicious or not. It achieves this by injecting your internet browser with a Javascript code that evaluates the safety of every website you visit. If the evaluation flags a website as unsafe then Kaspersky will prevent you from visiting it. This is all well and good, but the Javascript code employed has a major flaw.

The code injected into your browser is unique. And it can be read by any website. This means that your online activity can be tracked. For example, if your unique code shows up on ophtek.com and avg.com then online marketers would be able to identify a specific interest of yours: internet security. It’s known as cross site tracking and is a method used to tailor online advertisements that are likely to appeal to those viewing them. While this is nothing new, especially when you consider how cookies are used online, it’s unheard of to hear of a cyber-security provider facilitating this.

Avoiding the Security Risks of Kaspersky

Kaspersky has been keen to reduce the concerns of worried consumers and has advised that any data breaches are highly unlikely. Naturally, this is very easy for a multi-million pound corporation to say and has all the hallmarks of a damage limitation exercises.

What has been more useful is the patch released which removes the unique ID associated with the Javascript code. The cross-site tracking issue should, therefore, be remedied with this patch. However, this updated version will still identify users as using Kaspersky – a valuable piece of information that can easily provide a hacker with an insight into your defenses. The only way to truly protect yourself while working with Kaspersky is to go into the settings and untick the ‘Inject script into web traffic to interact with web pages’

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

New Domen Malware is Highly Advanced and Dangerous

Domen, malware, Ophtek, pop ups, Security, Security Threats, , , ,
24
Sep 2019

There’s only one thing worse than malware: clever malware. If it’s clever then it will to be difficult to detect and remove. And Domen is exactly that.

You probably haven’t heard of Domen before, but that’s because it’s a brand new toolkit. And it’s a toolkit which is fiendishly clever. What a hacker classes as ‘good’ malware is one that is deceptive and skilled in the art of subterfuge. If it can adapt to different scenarios and conditions that it’s even better. And, again, Domen ticks these boxes.

It certainly doesn’t sound appealing, does it? And I’ll bet my bottom dollar that you don’t want your organization to fall victim to it. Well, to help you avoid the perils of Domen, let’s hold it up to the light and see what we can make of it.

What is Domen?

Social engineering is a key part of the modern hacker’s arsenal, so it’s no surprise to see Domen clutching it so closely to its digital chest. A toolkit, of course, is much more than one single application. As the name suggests, it’s packed full of different applications that can work individually or side by side to maximize its impact. Domen is most likely to be found housed within the code of a compromised website – sites based upon WordPress are particularly affected – where it lurks discreetly and quietly.

However, Domen will not lurk discreetly for long. Nonetheless, when it does make an appearance it takes a keen eye to spot that anything is amiss. The infected website will generate a pop-up window that contains a link to a malicious download. This download will initiate a PowerShell attack that leaves your PC at the mercy of hackers who will gain full control of it. Dangerous pop-up windows are nothing new, but Domen differs in that it’s adaptive to the PC it’s attacking.

Domen has been designed so that it identifies the operating system, the user’s location and their browser. It’s at this point that the social engineering aspect comes into play. Domen uses this unique data to tailor a specific pop-up window that urges the user to download a necessary update. So, for example, if you’re using a Chrome browser then a pop-up will appear for a Chrome update.  And, if you’re based in France, for example, the content will be written in French.

Protecting Your Organization from Domen

It’s important that you practice vigilance when working with PCs as malware is so prevalent in the digital age. Evidence of malware such as Domen being present can include:

  • Your default browser homepage changing to something new without your authorization
  • New software installed and loading at startup
  • Evidence of remote access to your PC taking place

Thankfully, the PowerShell attack – initiated by the download of a .hta file – can be thwarted by protecting yourself with any good cyber-security suite. The tools contained with these suites should be able to identify the malicious .hta file and prevent it from executing on your PC. However, this can all be prevented by being vigilant and ignoring any suspicious pop-ups.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

What are the Most Common Computer Network Problems?

Data Security, Internet, IT Best Practices, Network, Ophtek, Windows Server, wireless network, , , ,
10
Sep 2019

 

Getting to grips with problems relating to your computer network can be a frustrating affair, but it’s one which is likely to happen on a daily basis.

Computer networks are, after all, highly complex systems that comprise various components and are in use by multiple users. These structures may bring many benefits, but they can also be a recipe for disaster. And, if your network fails or experiences any issues, then your organization’s productivity is going to be affected.

Your main objective, with your computer network, should be to keep it online and functioning correctly. But you can only do this if you know what the most common computer network problems are, so let’s take a look:

  • Slow Connectivity: If there’s one thing that frustrates an employee then it’s slow connectivity over a network. PCs can grind to a halt and even the simplest task can take an age to complete. It’s often caused by large file transfers, so a limit should be put in place on the size that is permitted e.g. no email attachments that total more than 20mb as a standard rule. Sometimes this lag can also be caused by faulty network cards, so it’s important to investigate this possibility. 
  • IP Conflicts: Each PC on your network should have a unique IP address such as 209.85.255.255, but sometimes two PCs can be assigned the same IP address. And this can create major connectivity issues for both parties. Sometimes these conflicts will work themselves out, but you can help speed up the process. Restarting the router is the simplest approach as it should assign new IP addresses to every PC on the network. 
  • Unable to Connect to Local Printer: Printers on a network tend to be shared by multiple users, but occasionally an error can arise that leaves people unable to access the printer. This problem is often caused by a sharing issue whereby different security settings between PCs and the printers fail to agree with each other. When this occurs it’s recommended that you check firewall settings and that your Windows network adapters have printer sharing enabled. 

  • Faulty Cables: A computer network relies on cables to facilitate its connectivity. And when just one cable fails it can have massive implications for your network. However, it’s easy to overlook cables as the source of network issues. People tend to concentrate on software and hardware troubleshooting first. Nonetheless, investigating the condition of cables in the affected network area is vital. Cables can easily become dislodged or damaged, so sometimes the fix can be as simple as plugging them back in or replacing. 
  • Weak Wi-Fi Signal: If you rely on wireless connections in your organization then you will be well aware of the issues caused a weak signal. This can often be caused by environmental issues such as the presence of a microwave or even the layout of an office. It’s important to eliminate these factors to identify the cause of the fault. Alternatively the connection issues could be caused by out-dated firmware, so make sure all updates are installed. 

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 48 49 50 51 52 … 57