Month: May 2016

Ransomware viruses regularly attack personal and business computers across the globe. They encrypt or otherwise deny access to files and programs. Malware developers demand payments in exchange for allowing users to recover their data. Depending on the quantity and value of the files, ransoms range from hundreds to thousands of dollars.

Such viruses remain difficult to counteract. As a researcher at a major anti-virus company recently said, “There is no cure to the ransomware threat today.” Nonetheless, it has started evolving into an even more dangerous form of malware known as a “cryptoworm.”

These highly sophisticated viruses have the same goal as conventional ransomware, but they spread far more efficiently. Worms automatically transmit themselves from one place to another with no need for human control. This development greatly increases the likelihood of an attack.

Losses

Computers at a medical center in California recently became infected with a cryptoworm. The virus encrypted hospital files and forced the institution to pay a $17,000 ransom. Brown University also suffered a ransomware attack. The Financial Times reports that Brown was able to restore backup data and remove the malware.

Prevention

Collectively, criminals have employed ransomware and cryptoworms to accumulate hundreds of millions of dollars. Businesses can often avoid their demands by taking preventive steps. For example, companies benefit from training employees to identify dangerous e-mail attachments, harmful websites and phishing attempts.

• Well-configured firewalls
• Quality anti-virus software
• Restrictive network settings
• Regular application updates
• Computer security training

Firewalls and anti-virus programs can’t always stop this malware, but they successfully intercept many ransomware viruses. Consider setting up a firewall to protect your network from the “Dark Web” by suspending access to I2P and TOR.

Use extra caution when opening Word documents, even if they seem to come from familiar people. It’s best to disable macros; these codes can trigger cryptoworm infections. At the same time, don’t assume you’re safe if you avoid Microsoft products. Ransomware also attacks Android and Linux machines, according to PC World.

Remember to remove unnecessary programs and update software whenever possible. Applications like Web browsers, PDF viewers and video players frequently contain defects that make them vulnerable to these infections. Although hackers usually find more flaws to exploit, the latest updates can patch known security holes and minimize risks.

A network administrator should only permit each staff member to access the computers, drives and directories that he or she truly needs to use. This will limit the ability of cryptoworms to spread throughout the network and infect every file. It also protects servers from any “rogue” employees.

External vendors may inadvertently expose a company to viruses. Business owners ought to thoroughly examine the details about security in contracts with vendors. Companies can benefit from insisting that such firms take extensive precautions and alert them to any system breaches as soon as possible.

Backups

Preventative measures don’t always succeed in averting ransomware or cryptoworm attacks. The most effective way to avoid paying a ransom is to frequently back up your files. Businesses should inspect and test backup systems to confirm they can actually restore the data if necessary.

Don’t put files on a storage device that remains attached to the network or a PC; this will allow a cryptoworm to scramble your backup data. These viruses can even attack files stored on off-site “cloud” servers. Be sure to keep one backup completely disconnected from other devices.

The bottom line is prevention delivers the best results, but thorough backups provide a crucial fail-safe. A wide range of businesses trust {company} to help them stay informed about the most recent IT news and maintenance techniques. Please contact {email} or dial (469) 635-5500 for further details.

If you work as any kind of computer or network security employee, one of the hardest things to deal with is keeping one step ahead of the constantly-changing landscape of cyberattacks. Cybercriminals work tirelessly to find holes, exploits or other vulnerabilities; they then exploit those vulnerabilities once they have discovered them. Security experts can work to block these vulnerabilities; they can work with software developers to patch software, they can warn the public about spam or phishing attacks designed to steal data, or they can work to keep a network’s resources firewalled and free of malicious programs. It seems like, as soon as one vulnerability is shut down, cyber criminals have opened up another one, which may or may not be harder to counter.

One of the latest scams to be aimed at businesses is Secure Document Phishing. This scam takes advantage of the technology that allows us to view and sign contracts and other important documents electronically. Instead of either mailing an important document and waiting for it to be mailed back, or sending it via e-mail and waiting for the e-mail to be printed, signed, scanned and sent back as an attachment, secure documents allow for online viewing and signing of important documents using a PD reader or DocuSign document.

When cybercriminals attempt a secure document phishing attack, they send either a fake DocuSign or PDF attachment to a potential victim, sometimes using a spoofed e-mail address to lower the victim’s guard. Or, the malicious contents are hidden in what appears to be a news story or other current event, a court subpoena or an alert from your financial institution. In the message, the victim is asked to do one of the following things:

• Click on a link to ‘receive a document’. This opens a fake web page asking for credentials, likely for e-mail or credentials phishing.
• Click what appears to be a normal link in a PDF document. This will open a malicious website that will facilitate the downloading of malicious software.
• Open a Malicious document in Word and enable macros. The macro will initiate the download of malicious software, such as ransomware or Trojans.

Fortunately, there are steps you can take to secure your networks from this type of cyberattack. These steps will either help prevent or mitigate any harm.

• Make sure all anti-virus and anti-malware programs are up to date. If you’re especially concerned about cyberattacks, you might want to look into ways to restrict downloads by PCs on the work network.
• Inform employees about the scam and make sure they know not to click strange links in e-mails. Tell them to delete the messages if they do not know the recipient and were not expecting the ‘documents’.
• Remind employees to follow up if they receive an attachment from a contact. Since many cybercriminals spoof e-mail addresses in order to trick potential victims, it can be easy to assume the ‘document’ being sent is legitimate. Show employees how to tell if an e-mail address is real or has been spoofed to cover the criminals’ tracks. Make sure employees remember to pick up the phone and call contacts whom they receive attachments from. This will help to ensure the message was legitimately sent and isn’t simply a phishing or malware attack, and help the employee ascertain the purpose of the message.
• If an error is made and malicious software does get onto a workstation, act quickly to isolate and clean the affected machine. Not only will this prevent ransomware or other malicious software from damaging the computer, it will also keep other computers on the network safe should the malicious software be able to spread via network connections.

FireEye, a network security firm based in Milpitas, California, recently issued a report detailing how malevolent hackers are using Google Docs and PowerShell to transmit a Trojan virus referred to as “Laziok”. Anyone who owns or manages a business should be aware of this Trojan attack. Even those who use personal computers at home for non-business purposes are vulnerable to the attack as well.

About the Laziok Trojan Attack

The Laziok Trojan was first identified a year ago when employed in a multi-tiered attack against energy companies across the Middle East. The virus was actually pinpointed on a Polish hosting service website used by those energy businesses. Laziok is best described as a combination of a program that steals information and a reconnaissance tool. The malware was employed through a threat group’s exploitation of an antiquated Windows weakness tracked with the label of “CVE-2012-0158”. This vulnerability implements the Trojan directly onto users’ computers.

Google Docs and Laziok

The FireEye report indicates that hackers apparently devised a highly creative method of bypassing Google’s stringent security checks. The hackers then uploaded the Laziok Trojan to Google Docs. The malware was originally uploaded last March and remained in place until FireEye made Google aware of its presence. Google regularly scans and blocks potentially harmful content on Google Docs to prevent such malware from harming its customers’ computing devices. It was widely assumed that Google Docs users would not be able to download malicious files from the popular file sharing / editing service until Laziok hit. It is clear that the malware found a way to slide in past Google’s extensive security scans. Thankfully, the malicious file has been successfully removed by Google so that users can no longer fetch it.

How the Laziok Trojan Attack Occurs

The attack was launched by uploading a highly complicated JavaScript code to take advantage of the aforementioned Windows vulnerability that is now being referred to as “Unicorn”. A VBScript was used to exploit the vulnerability upon users’ requests to access the particular page in question through the popular web browser Internet Explorer. Attackers relied on a means of exploitation referred to as “Godmode” that permits code written with VBScript to compromise the web browser’s sandbox. The script then proceeds to leverage Microsoft Windows’ PowerShell, a management program that automates and configurates computing tasks. PowerShell has been regularly abused by cyber thieves, especially throughout the past couple of years. PowerShell is used to download the Laziok Trojan from Google Docs and promptly execute it. This management framework is also favored by hackers as it is able to quickly and easily evade anti-virus software as it injects payloads right into memory. After infecting a computing device, Laziok proceeds to gather extensive information about the system including all of its antivirus programs.

IT Assistance for Small to Medium-sized Businesses