Phishing Attacks Skyrocket by 250% Between Oct 15 – Mar 16

Security,
05
Jul 2016

phish

Phishing attacks have long been a concern for anyone using computers, but a recent report has highlighted how these attacks have now risen by 250%.

Compiled by the Anti-Phishing Working Group (APWG), the report states that, during Q1 2016, there were nearly 290,000 active phishing sites online. This may not sound huge considering that there are around a billion websites online, but this is the highest number of phishing sites online since records began in 2004.

Phishing, therefore, is a credible and growing threat, so I think its best we get up to date with what phishing is and how these attacks are taking place.

What is Phishing?

spear-phishingPhishing is the process of stealing personal information (login details, credit card details etc) from consumers through the following methods:

  • Social Engineering – This is perhaps the most well-known method for extracting sensitive information from individuals. Using emails which convincingly spoof official emails, from corporations such as banks, they use disguised links to send victims to fake sites which contain features such as login screens. Obviously, these are false and simply record login credentials which can then be executed on the genuine site by the phishers.
  • Technical Subterfuge – This method employs the use of crimeware which is a type of software that hides in the background and records sensitive information such as login credentials. Also, many crimeware kits hijack users’ browsers to redirect them to phishing sites where the users unwittingly provide personal information.

What Does the Report Show?

A number of interesting insights have been provided by APWG’s report, so let’s take a look at these to understand how they unfold:

  • The most infected country is China where 57% of all computers are infected with malware. Considering how productive China is, at present, this makes for an alarming statistic as it’s likely that any business involved in production will be receiving emails containing crimeware from China on a regular basis.
  • Around 77% of all phishing websites are based in the US and the majority of these are forcibly set up by phishers who break into web hosting networks. This highlights major security flaws in US web hosting networks which is of particular concern for US businesses who own a website.
  • The two most affected industry sectors are Retail (43%) and Financial (19%). These two also happen to be two of the most popular industries housed online. After all, who doesn’t shop or bank online these days? Therefore, it’s a clever move by phishers to target these industries and use them to deceive consumers.

How Do You Combat Phishing?

browser-safety-built-in-phishing-protectionOnce phishing has completed its mission of stealing personal information, it can create utter chaos for those affected. And, for a business, this could include gaining access to sensitive areas of your network e.g. confidential client information such as financial records. This is bad news for any business, so remember the following:

  • Just because an email features an official logo it doesn’t mean it’s an official email from that company, so don’t rely on this for authenticity.
  • Safe websites will always begin https:// and not http://, so make sure you always check whether that all important “s” is present.
  • Although phishing is best known for stealing bank information, phishers are likely to target anything from your personal email details to your Facebook login credentials.
  • Credible companies will never ever request that you email personal information to them. If you receive emails demanding such information then just delete them as soon as possible.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Fears Raised over TeamViewer Hack

Security,
27
Jun 2016

unnamedRemote software has been vital for conducting online meetings and sharing desktops for years, but one of the most popular, TeamViewer, keeps getting hacked.

TeamViewer has regularly been the go-to option when it comes to businesses communicating online with colleagues, customers and technical support teams. Naturally, the procedures behind using remote software require a high level of trust.

And that’s why it’s worrying that a program which already asks you to relinquish control is at risk of being hijacked itself. This is potentially very troubling for businesses, so I’m going to take a look at what’s happening with TeamViewer.

TeamViewer Hack

The first rumblings of a hack emerged at the start of June when a disturbingly high number of TeamViewer users found that their PayPal accounts had been accessed. This was achieved by hijacking the users’ web browsers and accessing webmail and PayPal where users where still signed in.

What’s particularly worrying here is that many users reported having high levels of security in place. Even two-factor authentication (a gold standard of security) was not enough to stop the hijack taking place. Some of the hackers’ targets were lucky enough to be at their PC when the attacks took place, so were able to disconnect or revoke privileges, but others were not so lucky.

TeamViewer has not been keen to accept any liability for the attack. In fact, they have pointed the blame at their users re-using their TeamViewer login credentials on other websites which have then been hacked. However, it remains curiously strange that TeamViewer’s website went down for three hours at the height of the attack.

TeamViewer have since released a statement which confirmed their website outage, but claimed this was down to a denial-of-service and not a security breach.

TeamViewer’s Response

ximg_574f98a4ce746.png.pagespeed.gp+jp+jw+pj+js+rj+rp+rw+ri+cp+md.ic.Q8u1TYoCvPDespite TeamViewer not wanting to take any responsibility, they have since released two new additions to their software to increase security:

  1. Trusted Devices – By activating Trusted Devices, users are given the ability to approve any new device which is trying to connect to a TeamViewer session.
  2. Data Integrity – This feature is particularly clever as it monitors for any unusual behavior within the TeamViewer session. And, if this is detected, TeamViewer will not allow the session to continue without users resetting the password.

These are certainly useful features, but given the precious nature of remote sharing software, many users are wondering why these were not in place already.

Login Credentials Theft

Although many TeamViewer customers are upset over the company’s reluctance to accept any responsibility, TeamViewer may have a point about the theft of login credentials.

Just recently, a hacker has been trying to sell a mammoth database of stolen login credentials totaling around 640 million passwords. This is a major security threat and highlights the importance of protecting your passwords.

The best advice I can give, regarding passwords, is to remember the following:

  • Don’t reuse passwords on different accounts
  • Do not write down or tell other people your password
  • Use two factor verification wherever possible

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Insiders: How to Tackle Your Biggest Security Threat

Security
07
Jun 2016

Insider_Threat

There’s a lot written about the wide range of external security threats to your business, but what about internal security threats? Do they exist?

Yes, they most certainly do! Your staff – or insiders as they’re known – pose the biggest security risk going for your business. Whilst there can be malicious intent on the part of insiders, the threat is more likely to come from an innocent mistake.

It’s crucial, therefore, that your business doesn’t allocate all its security energies purely on external risks. Instead, you need to make sure that there’s a well maintained program for monitoring the activities of your staff as well as educating them.

In order to understand these security threats and minimize their chances of occurring, I’m going to discuss the security phenomena of insiders.

Who Is an Insider?

The most important thing to note about insiders is that they’re not necessarily drawn exclusively from your pool of employees. What actually defines an individual’s status as an insider is whether they have access to your systems and data.

Now, whilst this immediately points towards your employees, it also indicates that the following individuals can be considered insiders:

  • Contractors such as IT teams and cloud suppliers
  • External auditors
  • Visiting customers accessing your Wi-Fi connection

Naturally, this opens up your businesses data to a large number of insiders who can pass easily in and out of your system.

What Risks Does an Insider Pose?

email_attachments

Once an insider has access to your system there is a potentially huge list of activities they could carry out to breach your security and leave your data in a precarious position.

The actual nature of these breaches may seem relatively crude and simple, but they can have a particularly devastating effect. Say, for example, you keep a monthly spreadsheet of all your dealings with clients, wouldn’t it be an absolute nightmare if it fell into your competitors’ hands?

With a malicious insider at work this nightmare could soon become a reality with just one email attachment.

Of course, there still remain more sophisticated security breaches that can be instigated by an insider. Malware can be installed through USB sticks which can leave your network at the mercy of trojan horses, ransomware and potentially crippling system crashes.

And we can’t forget the good old fashioned carelessness of human error. It’s very easy for a naive employee to fall for an email scam and disclose sensitive details such as logon names and passwords, so this remains a major security risk.

Tackling the Threat of Insiders

Thankfully, businesses aren’t helpless in the face of insider security threats. In fact, they’re some of the simplest security breaches to prevent. Let’s take a look at what you can do:

  • Monitor abnormal behavior of employees such as accessing data and areas of the network not associated with their job role
  • Impose a strict level of access to third parties working on your network and ensure their activity can be monitored
  • Allocate access permissions based on employee roles in the organization to minimize the number of people accessing secure data
  • Prevent the usage of unauthorized external devices on your network e.g. employee’s personal USB sticks

Keeping the Insiders Out?

Now, it may seem as though this article points the fingers at your employees and third parties whilst screaming “DANGER!” but this isn’t the case! What I want to do is make you aware of how important it is to protect your business from all angles. The threat may come externally or it may come internally, but either way a threat is a threat and it’s crucial you counter all of them.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Adobe’s Emergency Patch against Ransomware

Security, ,
24
May 2016

635957083271499585-AP-ADOBE-PARENTAL-LEAVE-75052044

Adobe’s Flash Player – no stranger to security concerns – has recently been forced into issuing an emergency patch to protect its users from ransomware.

Despite the repeated horror stories of Flash Player’s buggy and easily exploited software, it’s still used on a regular basis by a huge number of people. That’s why any vulnerability which comes to light can have an impact on millions of systems.

This time, it’s that contemporary marvel of security scares known as ransomware which is making the headlines again. So, to keep your systems protected, let’s see what we can learn from Adobe’s latest debacle.

Adobe’s Zero-Day Flaw

The vulnerability at the center of Adobe’s woes is known as a zero day flaw, but what does this mean? A zero-day flaw refers to a software vulnerability which is completely new and unheard of. Due to its unexpected emergence, the team behind the software then, quite literally, has zero days to prepare a response.

And it’s this level of precarious defense which means zero-day flaws can spread like wildfire and cause absolute mayhem.

In this particular instance, Flash Player was discovered to contain a memory-corruption vulnerability which allowed hackers to hijack user’s systems. To take remote control of user’s systems, the hackers employed the use of the Magnitude exploit kit.

Using Magnitude, hackers were then able to download ransomware software – such as Locky and Cerber – onto user’s systems. This ransomware was then primed to encrypt personal files and demand a ransom to unlock these files.

All versions of Flash Player up to version 21.0.0.197 have been affected. And it’s not just limited to systems running Windows – Macs, Linux and ChromeOS are all vulnerable as well.

The Emergency Patch

Adobe-Patchday-658x370-6fda846fec7c4caa

The threat was first discovered when security experts Proofpoint were investigating recent changes made to the Magnitude exploit kit. Once the magnitude of Magnitude had been established, Proofpoint swiftly contacted Adobe who was quick to rush out an emergency patch.

Thankfully, for Adobe, they had previously built in an exploit mitigation technique into Flash Player version 21.0.0.182, so this minimized the malicious impact of this zero-day flaw. However, you would be surprised by the amount of users who don’t update their software when prompted. As a result, a significant number of systems were compromised.

Once the emergency patch had been released, Adobe was also quick to advise all its Flash Player users to upgrade to the latest version. This would, hopefully, minimize the risk of further exploitations on older versions of the software.

Is Adode Safe?

This is a question which seems to get asked on a daily basis at present. And unfortunately for Adobe, things do not look great.

Hackers are clearly targeting Flash Player now and Adobe seems helpless in protecting its product. The knock on result of all this negative publicity is that PC manufacturers, such as Windows, are going to question whether it makes sense to bundle Flash Player with their products.

The key piece of information to take away from this article is that you should ALWAYS ensure all your software is up to date. This ensures you have the best protection possible against any potential security flaws.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

What’s a DDoS Attack and How Do You Combat One?

Network, , ,
17
May 2016

bigstock-Hacker-Typing-On-A-LaptopWebsites are vital for business, so any disruption to them can spell disaster. A Distributed Denial of Service (DDoS) attack spells it in capitals!

A DDoS attack sounds like a mouthful and very technical, but it’s something that could strike your business’ website at any time. Therefore, it’s the kind of cyber-attack that you need to acquaint yourself with before it’s too late.

Let’s take a look at the ins and outs of a DDoS attack and, more importantly, how to combat one.

What’s a DDoS Attack

shutterstock_311192399

The main aim of a DDoS attack is to take down a website. Without a website, many businesses can find their operations severely crippled e.g. if you rely on e-commerce then no website equals no business.

But how does a DDoS attack disable a website?

Well, first of all, it doesn’t work off just one computer and this is where the distributed part of DDoS comes from.  It usually takes hundreds of computers all working together to disable web servers.

The denial of service aspect of a DDoS attack literally means that users of the website are denied that service e.g. making an office or medical appointment through the wesbite.

A DDoS attack uses huge amounts of false traffic (which has no intention of using a website’s services) to overload web servers. This prevents customers from accessing the website and, eventually, takes it down.

DDoS attacks are becoming more and more popular with hackers with nearly 180% more DDoS attacks in 2015 than the previous year. And big names are being targeted; the BBC and Microsoft’s Xbox Live network have suffered at the hands of DDoS hackers recently.

How Do You Combat a DDoS Attack?

ddos-attack

There are several ways you can combat a DDoS attack, so let’s take a look:

  • Invest in more bandwidth – the reason that a DDoS attack will eventually take down your website is because your bandwidth will be maxed out. Therefore, if you can invest in more bandwidth then you think you could ever possibly use, you’ll increase the chance of keeping your website up.
  • Watch your network – You need to maintain a watchful eye on your traffic. Any sharp increases in traffic need to not just be handled, but also visible to the network. This allows you to get to work on preventing any further damage and preparing any necessary protection.
  • Know who to call – In the case of a DDoS attack you’re going to need to get in touch with your ISP. They will have the capabilities to reroute data and nullify any huge packets of traffic. This is why it’s a good idea to make sure you have all the relevant contact details at your disposal. Remember, time is of the essence here.

Final Thoughts

A DDoS attack can be a tricky piece of cybercrime to combat, so it’s important that your business is aware of the impact they can have. It’s a good idea to formulate a set of guidelines of what to do in the case of a DDoS attack and putting this into place now could save your website in the future.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 35 36 37 38 39 … 49