security Archives - Page 33 of 50

Mamba Highlights a Change in Ransomware

Mamba, Ransomware, SecurityMamba, ransomware, securityOphtek, LLC

Sep 2017

We’re all aware that ransomware can hit you financially, but ransomware is now changing its modus operandi for causing chaos and becoming more dangerous.

The Mamba ransomware first appeared in September 2016 and, rather than just scrambling certain file extensions, it scrambles every single disk sector on your hard drive. And in layman’s terms this means that your whole PC will be next to useless. However, whilst ransomware usually offers you a way out of this mess through a ransom payment, this is where Mamba differs.

In recent attacks on organizations in Brazil and Saudi Arabia, the Mamba ransomware doesn’t specifically demand a ransom. Instead, it merely provides two email addresses and an ID number for you to use in correspondence. The ransom note also asks those infected to enter a key which, we can only assume, could be provided once contact has been made with the aforementioned email addresses.

Of course, much like the NotPetya attack, this could be a form of ransomware which simply sabotages a hard drive by making all its data inaccessible. Regardless of this, it’s not a situation that you want to find yourself in, so let’s take a look at what Mamba consists of.

The Mamba Attack

There’s a lot of concern that Mamba may be another piece of ‘wiper’ malware which simply dumps data once encrypting it rather than offering a decryption service. It’s also difficult to determine who has been authoring this new Mamba variant – sure, a Russian email address is used, but it would be foolhardy to assume that the attack comes from Russia simply because of an email address.

The attack itself seems to execute the Mamba ransomware by exploiting the PSEXEC application – a piece of software which allows communication between remote systems and crucial for organizations networks to operate effectively. The malware works in two stages with the first line of attack seeing DiskCryptor – a free encryptor – installed on the infected system before rebooting the system. Upon bootup, DiskCryptor begins encrypting disk partitions and, once the hard drive is fully encrypted, the system is rebooted once more.

It’s at this point that the ‘ransom’ note is delivered to the user. It’s too early to say exactly what correspondence with the emails provided will result in, but it’s fair to assume that the hackers aren’t just going to hand over the key. Now, each infected computer has a specific password generated for it, so this hints that, perhaps Mamba isn’t a piece of wiper malware and that payment will result in your hard drive being decrypted. However, it could also just be a diversionary tactic and your files could be lost forever.

Combatting Mamba

The level of encryption carried out by Mamba through DiskCryptor is exceptionally strong, so there’s currently no way of retrieving your files without somehow receiving help from the hackers. Whether this help will be forthcoming is debatable, so it in no way represents a way out from this particularly difficult hack.

Good security practices, as ever, are essential to prevent your organization falling foul of ransomware, particularly when it’s one which appears to be very enigmatic and provides little light at the end of the tunnel. Such attacks are likely to increase, so make sure you practice the following:

Always backup your files and data to ensure they’re not compromised on an infected system. It’s also recommended that these are backed up to a system not connected to your network to prevent falling foul of malware which can spread throughout a network.
Use multi-layered security in the form of firewalls, web filtering and antivirus software in order to stop malware from either activating or even reaching your network.
Restrict user privileges and access on your network as, again, this can stop ransomware spreading through your network once it has started to gain a foothold in your network.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Petya Cyber Attack Goes Global with Ransomware

Cyber Attack, Petya, Ransomware, Securitybitcoin, malware, ransomware, security, WindowsOphtek, LLC

Sep 2017

A major cyber attack has swept across the globe and, once again, it’s taken the form of ransomware to shut down computers and demand Bitcoin ransoms.

Known as Petya – the Russian word for stone – has managed to halt operations at a chocolate factory in Australia and even one of Russia’s biggest oil companies, so the scale and sophistication of its attack is clear to see. Following the recent WannaCry ransomware attack, Petya has made headlines in a security landscape where safety appears to be far from guaranteed.

As this is such a widespread attack – and the fact that new ransomware attacks are appearing weekly – it seems like the perfect time to look at Petya and reinforce what you can do to protect yourself.

The Story behind Petya

Although it’s difficult to confirm, it’s believed that the Petya attack originated in the Ukraine. Reports suggest that the ransomware was spread through the update server for MeDoc which is a popular brand of Ukrainian accounting software. Consumers believed they were simply downloading a new update for their software, but it was actually a powerful slice of malware which then spread like wildfire.

This latest variant of Petya, however, is even more powerful than its original incarnation. It’s believed that Petya now comes loaded with a tool named LSADump which harvests data and passwords from all the PCs located on that network. Petya also appears to be encrypting every single file on the infected PCs through the master boot record – this helps your PC boot up Windows at startup.

Most disturbingly, though, it’s being reported that Petya may not even be ransomware and may, instead, simply wipe everything from a PC with no chance of recovery. While the thought of having to pay a small ransom to retrieve data is troubling enough, the idea that your data may never be retrieved brings a whole new level of concern to Petya.

Defending Against Petya

Regardless of whether Petya encrypts or destroys files, it remains a highly sophisticated strain of malware that no PC user wants to find on their system. Kaspersky and Symantec have assured consumers that their anti-virus software will actively identify and protect against Petya, but for many users this may be too late.

Unfortunately, despite the spate of attacks taking advantage of Windows vulnerabilities, many PC users are still incredibly lax when it comes to installing security updates and patches. The main reason for this procrastination is an issue of time, but what’s five to ten minutes of installing updates and rebooting compared to having all the files on your entire network encrypted or even deleted?

For more ways to secure and optimize your business technology, contact your local IT professionals.

Windows 10S is NOT Immune from Ransomware

Securitysecurity, WindowsOphtek, LLC

Aug 2017

Microsoft has claimed that their latest upgrade to Windows 10 (10S) is immune to all known ransomware. However, it appears that this isn’t quite true.

Windows 10S is a streamlined upgrade of Microsoft’s current operating system (OS) and it promises increased speed, stability and security. Naturally, this claim of invulnerability is certainly impressive, but, effectively, it’s also issued a challenge to the online community to test the strength of this security.

It’s a brave move, perhaps one which was necessary after the various security issues with Windows 10 shortly after its launch, but it’s now looking rather embarrassing for Microsoft as Windows 10S has already been breached.

Hacking Windows 10S

Launched at the start of May, Windows 10S survived several weeks without having its defenses breached, but this security has now come tumbling down. Security expert Matthew Hickey of Hacker House managed to make his way through the security capabilities of Windows 10S in just three hours.

How did he do this though? Microsoft, after all, should know a thing or two about security, right? Well, Hickey actually employed an old fashioned technique of hacking called DLL injection. A particularly sneaky form of hacking, DLL injection runs malware within a running process that is deemed not capable of carrying a threat by the operating system in question.

This hack was carried out by one of the most common malware attacks seen in contemporary hacking, a Microsoft Word document packed full of malicious macros (automated commands). Although Microsoft Word now has an anti-malware system, this does not detect issues with files that have been shared on the network – which is exactly where Hickey had downloaded the infected document to.

Hickey was then able to activate the malicious payload in the Word document and found he was able to take control of the PC by giving himself full administration privileges. Using Metasploit – software designed to look for loopholes in cyber defenses – Hickey eventually managed to secure himself full system privileges. And this meant, in theory, that he could begin disabling firewalls and anti-malware software.

With the system’s defenses completely disabled, Hickey could easily have installed ransomware on the PC, but he refrained from doing this in order to protect other PCs on the network.

An Unhackable OS?

At no point did Microsoft claim that Windows 10S was 100% protected from any form of hacking, but by claiming that it was safe from ransomware they were setting themselves up for a mighty fall. And now that Matthew Hickey has revealed just how easy the hack was – and a three hour hack is relatively quick in terms of a previously unhacked operating system – it’s likely that even more exploits will be revealed.

And, although Hickey’s attack was a ‘friendly’ hack, it underlines just how fragile cyber security can be. Despite all the bold claims by Microsoft, Windows 10S doesn’t appear to be any more secure than previous versions and this is very troubling for consumers.

Once again, user knowledge and awareness is highly important as the root cause of this attack was an infected Word document. Your employees must understand the important of identifying malware and not rely on software as, even when Microsoft are involved, it’s impossible to claim something is secure enough to give you full protection.

For more ways to secure and optimize your business technology, contact your local IT professionals.

The Biggest IT Security Threats in 2017

SecuritysecurityOphtek, LLC

Jun 2017

With the ever increasing rise in cyber security attacks, PC users are becoming more vigilant. However, do they know what they should be wary of in 2017?

The IT security landscape is constantly changing, so what may be considered a contemporary threat one year, may soon fall into obscurity as defenses improve. However, certain security threats seem to be becoming more and more prevalent. Therefore, it’s make sense to acquaint yourself with the most likely attacks you’re going to experience in the near future.

And, as luck would have it, I’ve decided to take a quick look at the biggest IT security threats coming in 2017.

Rise in Ransomware

Ransomware made big headlines in 2016, but far from being swiftly dealt with, it’s expected that ransomware attacks are going to rise in 2017. With the source code for ransomware software becoming readily available online, it’s encouraged hackers to become competitive and improve on each other’s brand of ransomware. When this is coupled with the relative ease that ransomware can generate revenue for the hacker, it’s no surprise that more and more attacks are on their way.

Big Data Causes More Risk

Big Data is causing huge ripples throughout the business community as it’s an approach which is focusing IT efforts on analyzing large sets of data to improve operations. However, as big data is so new, the business community doesn’t yet know how to marshal it efficiently.

With such huge data sets being openly shared between departments and businesses, the security of this data is being severely compromised. This presents a severe problem if security is breached due to the large amount of data at risk. Big Data needs to be correctly controlled and access restricted otherwise it will be in the headlines for all the wrong reasons.

Business Email Compromise (BEC) Scams

BEC scams hit businesses all over the world last year and some high profile names fell victim to this straightforward scam. By sending emails purporting to be from company CEOs, hackers have been able to con employees in to sending out either sensitive information or, in extreme cases, transfer bank funds. And, with pay outs from BEC scams reaching as high as $140,000, hackers are going to maximize their efforts on this simple and easy attack this year.

Internal Threats to Increase

Hackers are well aware that IT security teams are gradually getting better at blocking their attempts to infiltrate their defenses, so that’s why the hackers are turning to those on the inside. Sometimes this literally means teaming up with an employee on the inside to facilitate the theft of data. However, this inside threat can sometimes be the result of blackmail following the hacking of an employee’s social media account and the threat of revealing personal information. This is a difficult form of hacking to combat, but reinforces the need of good employee education on IT security in and out of the workplace.

For more ways to secure and optimize your business technology, contact your local IT professionals.

6 Quick Ways You Can Improve Your Network Performance

Networknetwork, securityOphtek, LLC

Feb 2017

The speed of your business PC network can make a huge difference to your productivity, but not all businesses use their network as effectively as possible.

By not getting the most out of your network, you’re missing out on crucial improvements in performance which can help you remain competitive in the marketplace. Now, there’s not a business on the planet which wants to lag behind its competitors, so let’s go through 6 quick ways you can improve your network performance.

Protect Your Network

The simplest way to improve network performance is to ensure it’s protected from malware and viruses. Making sure that you have reliable antivirus software and sophisticated email filtering is key to keeping your network online. Remember: if your network goes down then – even if it’s just for an hour – it can hit your productivity hard.

Embrace Compression

Even in this modern age, bandwidth is still a valuable commodity and increasing your available bandwidth can be a costly affair. However, you don’t have to break the bank to get the most out of your bandwidth. By working with compression software you can significantly reduce the size of the data being transmitted over your network and free up valuable bandwidth to be used by other applications.

Keep Your Network Up to Date

Once you launch a new network it will be as well tailored to your needs as it could possibly be. However, over time, things change such as individual staff requirements, software upgrades which require specialist attention and numerous other factors which alter your digital needs. And this is why you need to regularly review your network to assess and identify the changes required to keep your network in touch with your current needs.

Consider Linux

Linux is a lot more secure than Windows as it’s less commonly used and, therefore, there’s less incentive for hackers to concentrate on breaching it. Now, I’m not suggesting you should migrate all your users to Linux, as it only supports certain applications. However, if you can migrate users who don’t require access to Windows-only applications then you’ve eliminated a number of potential security risks.

Identify Junk Traffic

It’s important that you understand what’s taking up your valuable bandwidth as this can often be caused by junk traffic. Say, for example, your employees are running online games through their lunch period, depending on the software involved this could be consuming large amounts of your bandwidth. Likewise, blocking large attachments which are forwarded round from employee to employee can also drain your bandwidth, so preventing this will also improve your network performance.

Educate Your Staff

It’s vital that your staff understand the best practices to optimize your network’s performance. This can be simple advice that makes up part of your company’s IT induction process and informs staff how to not only practice good network security, but also understand how to use applications correctly and not affect the network’s performance.

For more ways to secure and optimize your business technology, contact your local IT professionals.

« Previous 1 … 31 32 33 34 35 … 50 Next »

Tag Archives: security

The Mamba Attack

Combatting Mamba