Author: admin

SecuriThings’ CEO Roy Dagan tackles the sometimes overlooked security step of physical security maintenance and breaks down why it is important.

We all love to spend time surfing the web — whether we’re shopping, paying bills, or reacting to funny memes. The internet has also allowed many of us to keep working from home even during the pandemic.  

The internet is great, but the best way to keep enjoying it is to know where and how bad actors can pop up in our computer systems. 

One way is through the use of ransomware, which is a type of malware that threatens users with blocked access or doxing (exposing personal information) if they don’t pay money to the cybercriminals who sent the malicious software.  

We’ll explain what ransomware is, how it works, and how to defend against it so you can stay one step ahead and continue enjoying life online. 

What is ransomware?

Ransomware is malware that uses encryption to hold your information at ransom. This might mean you can’t access critical data in files, databases, or applications. The cybercriminal will then usually demand a ransom to provide access.  

Often, ransomware includes a deadline to add a sense of urgency to the threat. Typical ransomware attacks might suggest that your data will be lost or published on the web for the world to see if you don’t pay. Ransom demands generally ask for payment in Bitcoin or some other form of cryptocurrency, where transactions are less regulated and traceable. 

Unfortunately, ransomware is often designed to spread across a network and target database and file servers — quickly paralyzing an entire organization. Ransomware attacks represent a growing problem, generating billions of dollars in payments to cybercriminals and inflicting damage and expenses for businesses and governmental organizations.  

However, if you have a basic understanding of how ransomware works, you can take steps to protect yourself. 

How does ransomware work?

Ransomware uses asymmetric encryption, which uses a mixture of symmetric and asymmetric encryption methods to make it more difficult to decrypt ransomed data files. Put simply, cybercriminals using asymmetric encryption generate a public key to encrypt files and a separate but private key to decrypt the same files. As a result, the victim has to rely on the hacker for the decryption key — for a price, of course — because the private key to decrypt the files is stored on the attacker’s server.  

The attacker then makes the private key available to the victim only after the ransom is paid, although this isn’t always the case, as seen in recent ransomware campaigns. Without access to the private key, it can be difficult to decrypt the files being held for ransom. 

Many forms of ransomware exist. Often, ransomware (and other malware) is distributed using email spam campaigns or through targeted attacks. Malware needs an attack vector, which is how a cybercriminal gains access to a device to deliver malicious software. This might take the form of an email attachment, webpage, pop-up window, or even instant message. After malware establishes its presence, though, it’ll stay on the system until it finishes its task. 

After a successful exploit, ransomware drops and executes a malicious binary on the infected system. This binary then searches and encrypts valuable files, such as Microsoft Word documents, images, databases, and so on. The ransomware may also exploit system and network vulnerabilities to spread to other systems and possibly across entire organizations. 

Once files are encrypted, ransomware prompts the user for a ransom to be paid within 24 to 48 hours to decrypt the files, or they’ll be lost forever. If a data backup is unavailable or those backups are encrypted, the victim might have to pay the ransom to recover their personal files. 

Examples of ransomware attacks

Cyberattacks, including different types of ransomware, occur and evolve all the time, but there are several ways to avoid them. 

It all starts with looking to the past to protect your sensitive data in the future. In the next few sections, we’ll cover how hackers have engaged in extortion across computer systems over the years. 

CryptoLocker

CryptoLocker was one of the earliest adopters of this type of malware — demanding a ransom payment in cryptocurrency for a user to get their data back. In fact, it was probably the first time many people had heard the term “ransomware.” 

In 2013, CryptoLocker attacked through an email attachment that looked like the tracking notifications of shipping companies like UPS and FedEx. It resulted in more than 250,000 infected computer systems and up to $27 million in extorted money. 

Although a decryption key has existed for CryptoLocker since 2014, it can still cause problems for users who may not recognize the presence of the ransomware before opening the attachment. 

WannaCry

In 2017, Wannacry took the “worm” approach to ransomware, spreading across Windows PCs through shared networks. At the time, the ransomware turned everything on the computer into encrypted data, with the hackers threatening not to return the data until the ransom was paid (in this case, cryptocurrency). Estimates point to over 200,000 computers being infected around the world.  

A killswitch was created to help operating systems infected with WannaCry, but the hacking group is still out there posing new threats. 

Kaseya

The Kaseya ransomware attacks occurred on July 2, 2021, and led to an FBI response because this represented a global cybercrime event. In this instance, though, the ransomware group REvil made damaging use of vulnerabilities found in the on-premises software of Kaseya VSA. The hackers then demanded $70 million in Bitcoin. 

The company managed many service providers, so the attack affected all of the downstream customers of those service providers. In fact, the malware attack may have affected around 1,500 organizations across the world.  

The good news is that patches have now been developed for affected servers. 

JBS

You might not immediately think of the world’s largest meat supplier as being one of the victims of ransomware, but that’s exactly what happened to JBS Foods.  

Threatening to disrupt the food supply chain in May 2021, organized cybersecurity attacks by REvil targeted JBS’s North American and Australian plants, encrypting data that was then ransomed for over $11 million worth of Bitcoin by the company.  

Colonial Pipeline

On May 7, 2021, hackers made malicious use of a single leaked password belonging to a virtual private network (VPN) account associated with the Colonial Pipeline Company.  

Even though the breached account had been dormant for some time, it was still successfully used as an entry point to the Colonial network. The password to this account was linked to a batch of compromised passwords on the dark web, leading officials to believe it could have been an employee who re-used the same password for other accounts.  

 

This major cybersecurity event showcases the ways that ransomware can set up camp inside computer systems without the use of phishing. 

How to defend against ransomware

Being proactive is one of the best things you can do to safeguard against ransomware attacks. This means thinking ahead to what vulnerabilities may exist in your current computer network setup and addressing them before they’re used for cyber extortion.  

There are several ways you can help reduce your exposure to cybercriminals by simply being alert to where they usually get in. The following sections offer information on how to set up the best possible defense against ransomware. 

Back up your data

The best way to avoid the threat of being locked out of your critical files is to ensure that you always have backup copies of them, preferably in the cloud and on an external hard drive. This way, if you do get a ransomware infection, you can wipe your computer or device free and reinstall your files from backup. This protects your data, and you won’t be tempted to reward the malware authors by paying a ransom. Backups won’t prevent ransomware but they can help mitigate the risks. 

Secure your backups

Make sure your backup data isn’t accessible for modification or deletion from the systems where the data resides. Ransomware will look for data backups and encrypt or delete them so they can’t be recovered, so it’s important to use backup systems that don’t allow direct access to backup files. 

Use security software and keep it up to date

Make sure all of your computers and devices are protected with comprehensive security software and keep all of your software up to date. Make sure you update your devices’ software early and often, as patches for flaws are typically included in each update.

Practice safe surfing

Be careful where you click. Don’t respond to emails and text messages from people you don’t know and only download applications from trusted sources. This is important since malware authors often use social engineering to try to get you to install dangerous files.[Text Wrapping Break] 

Only use secure networks

Avoid using public Wi-Fi networks since many of them aren’t secure and cybercriminals can snoop on your internet usage. Instead, consider installing a VPN like McAfee Secure VPN, which provides you with a secure connection to the internet no matter where you go.[Text Wrapping Break] 

Stay informed

Keep current on the latest ransomware threats so you know what to look out for. In the case that you do get a ransomware infection and haven’t backed up all of your files, know that some decryption tools are made available by tech companies to help victims. 

What to do if you’re the victim of a ransomware attack

Ransomware attacks don’t have to spell disaster if you catch them in time and know what to do. If you suspect you’ve been hit with a ransomware attack, it’s important to act quickly.  

Fortunately, there are several steps you can take to address ransomware issues quickly and have your computer systems return to business as usual in no time. 

1. Isolate the infected device. Many antimalware programs start by discovering where the ransomware has made its home. This might be on a single device within your network or on many devices. Whatever the case, separating infected computers and other devices from the primary network and any other avenues to your sensitive data should be step one.
2. Assess the damages. Understanding what the ransomware on your computer has had access to is the next step. Is it just your password-protected online accounts, or have your financial and health care records also been involved? Sometimes, the extent of the damage is immediately obvious. Other times, as with many phishing emails, you’ll be able to see that only certain aspects of your private information have been hijacked.
3. Identify the ransomware. Finding out who and what has actually breached your privacy is crucial. Well-known hacker groups like REvil and Darkside often restrict their attacks to giant corporations, but the advent of things like ransomware as a service (RaaS) means that bad actors can and will target anyone now.
4. Report the ransomware to authorities. Whether you discover that you have been hit by a somewhat vintage ransomware group like Petya or a more sophisticated modern program like Ryuk, always report your ransomware experience to law enforcement. The main reason for this is to help officials continue to develop decryptor systems until there’s no more ransom software to worry about. The secondary reason is so you aren’t seen as complicit with the actions of any hacker group that has targeted your information.
5. Evaluate your backups. Lastly, take a good look at your storage and backup systems once you’re through the first hassles of a ransomware attack. Make sure that any external hard drives or cloud storage spaces have remained clean. If these safe spaces still exist, you can usually use them to help restore most of your sensitive data. 

Get a personalized protection plan

We’ve all spent more time online recently in the wake of the pandemic, and no one needs cybersecurity issues on their plates during this or any other time. The good news is that antivirus software is evolving rapidly and there are plenty of steps you can take to shield your computer systems from needless attacks like ransomware. 

One surefire way to get peace of mind against hacker groups is to put your trust in the expert care of Total Protection services from McAfee. All of our plans come with a private VPN, antivirus protection, and safe-browsing features. This means you can live your connected life free from threats like ransomware, malware, and more.  

With multiple affordable plans, there’s a McAfee protection plan for every person. It’s a small price to pay for staying one step ahead of ransomware attacks.  

The post What Are Ransomware Attacks? An In-Depth Guide appeared first on McAfee Blog.

Smartphones and personal computers have enhanced our lives in so many ways that it can be hard to even imagine a world without them. The internet is an awesome place with endless opportunities and possibilities, but it’s also home to some seedy characters that can expose us to certain risks, like malvertising. 

Malvertising, which is short for malicious advertising, attacks and compromises systems by spreading advertisements injected with malicious code. Legitimate advertising networks can then display these malicious advertisements without even knowing they’re infected.  

In this article, we’ll take a closer look at what malvertising is and what you can do to secure your data and keep your information safe online. We’ll also provide some examples so you can fully understand how malvertising might be used.  

Having a thorough understanding of malvertising is the first step toward keeping the internet a safe place for you and your family. 

How does malvertising affect you online?

Since malvertising disguises malicious code inside legitimate online advertising, ad networks may find it hard to stop malvertising from appearing as legitimate ads.  

Viewing malvertisements can put your personal information at risk, such as your identification information, contact details, and financial data. It can also alter or delete your information, hijack your computer functions, spy on your computer activities, and steal your data. And this all can happen without your knowledge.  

The type of risk, though, depends on the programs that the malvertising successfully downloads onto your device. These programs can include: 

• Malware: This includes any malicious program that can harm your device or steal your information. 
• Ransomware: Ransomware is exactly what it sounds like. It encrypts your files or locks your devices and requires you to pay a ransom to use them again. Cybercriminals generally require the ransom to be in cryptocurrency because it is untraceable.  
• Spyware: This is a type of malware that spies on your online activities without your knowledge. Spyware puts your device’s security at risk and violates your privacy.  
• Adware: Adware is short for advertising-supported software and hides on your device while serving you pop-up ads. This can slow down your device and install spyware or viruses on it.  
• Viruses: A virus is a computer program that replicates itself onto computer programs and is designed to steal data or damage the device.  

Examples of malvertising 

Cybercriminals use various methods to inject infected code into online ads. Below are some examples of the types of malvertising that can pose a risk to your cybersecurity and exploit vulnerabilities on your devices. 

• Ad creative containing malware: Text or banner ads can contain embedded malware. The infected ads — even if they’re display ads that aren’t clicked on — can put all of the devices that displayed the ad at risk for scams or malicious software.  
• Ad calls containing malicious code: A cybercriminal can add infected code to an ad payload and infect any devices that display the ad.  
• Video containing malware: Video players are vulnerable to malware since they don’t have any protection against it. Videos can display malicious links and, consequently, infect your device.  
• Compromised URLs: Whenever a user clicks on an ad, it directs them between several URLs that eventually lead them to a landing page. If any of these URLs get infected with malicious code, the user’s computer can be at risk of a cyberattack.  
• Landing page with a malware-infected element: Legitimate websites can also contain elements infected with malware. When you click on an ad and get directed to a legitimate landing page, your device can still be infected by a malicious element on the page.  
• Pixel containing malware: Cybercriminals can intercept the delivery path of a pixel and send malicious code to your browser.  
• Flash video containing malware: Flash files can load a pre-roll banner injected with malicious code. This can infect your device once it gets exposed to it without you having to click on the video.  

Even highly reputable and popular websites, such as The New York Times, the BBC, Spotify, and AOL, have been targeted in the past by malicious ads, putting billions of visitors at risk. Any website can become a target.  

What’s the difference between malvertising and adware?

Malvertising is often confused with ad malware. Both are forms of malware and involve infected advertisements, but they’re fundamentally different.  

Malvertising uses malicious code that can cause harm to anyone viewing the infected advertisement, while adware is used to target individuals by forcing ads onto their devices to generate clicks. Users can get bombarded with pop-up ads, which can affect their devices. Adware also collects browsing information to sell to advertisers. This is often referred to as browser hijacking. 

How to avoid malvertising as a web user

Taking the necessary steps to protect your online activities and personal identifying information can help shield you from malvertising attacks. Massive volumes of online ads are displayed every day, so it’s never been more important to safeguard yourself against any shady activity on the internet.  

Taking a few steps can help you avoid malvertising and minimize your risk of identity theft.  

• Take advantage of identity protection software like McAfee. We can help you stay protected against cybercrime with identity monitoring and identity restoration services (in the event of identity theft).  
• Always ensure that your ad blocker and antivirus software are up to date. These can help reduce the risk of malvertising. Keep in mind that outdated software becomes less effective with time.  
• Don’t use Java or Flash. The Flash player is vulnerable to cyberthreats since it’s an outdated plugin. Java is another plugin that allows software to be executed within your browser and carries a high risk of being abused to circumvent security measures on your device. You can disable the plugins or uninstall them entirely.  

Keep your information secure online with McAfee

With so much sensitive information being shared online, it’s never been more important to take the necessary steps to help keep your data and privacy safe.  

McAfee Total Protection services can help increase cybersecurity on your devices and keep your identity private from hackers. We offer all-in-one protection so you can get the peace of mind you deserve while enjoying the internet. 

All products include identity monitoring, automated privacy using a virtual private network (VPN), a password manager, a firewall, and much more. We also offer identity restoration assistance and up to $1 million in identity theft coverage to help relieve the burden of data breaches.  

Get comprehensive identity protection from McAfee and get back to surfing the internet with confidence.  

The post What Is Malvertising and How Do You Avoid It? appeared first on McAfee Blog.

Ever hear of a crime called skimming? It may not be as dramatic a crime as assault or Ponzi schemes, but it can cause significant problems to you as your  savings account can be wiped out in a flash.

Picture a scrawny nerd tampering with an automated teller machine (ATM)—the machine you use with your debit card to get cash. The thief places a device over the slot through which you slide your debit card. You have no idea it’s there. You swipe your card, and the device “skims” or reads your card’s information. In the middle of the night, the thief creeps back, removes the skimming device, downloads your data, burns it to a blank ATM card, makes a fat withdrawal and goes home with the loot. Or they could download your information from the skimmer and then use your information to make online purchases or access your account. Either way, they could clean you out before you wake up next morning!

Now, to be successful, the criminal not only needs a skimming device, they also need to attach a tiny wireless camera to capture your PIN.  These cameras are usually concealed in the lighting fixture above the keypad, in a brochure near the machine, or attached directly to the ATM.

To protect yourself from being skimmed, and generally staying safe when using your debit or credit cards, follow these tips:

• Scrutinize the ATM. This means every ATM, even ones from your bank. You also want to check any of the card sliders like ones at gas stations, etc, especially if you’re using your debit card. If the scanner does not match the color and style of the machine, it might be a skimmer. You should also “shake”  the card scanner to see if it feels like there’s something  attached to the card reader on the ATM.
• Cover the keypad when entering your PIN. In order to access your bank accounts, thieves need to have your card number and your PIN. By covering the keypad, you prevent cameras and onlookers from seeing your PIN.
• Check your bank and credit card statements often. If someone does get your information, you have 60 days to report any fraudulent charges to your credit card company in order not to be charged. For a debit card, you only have about 2 days to report any suspicious activity.
• Be choosy. Don’t use general ATMs at bars or restaurants. These are not usually monitored and therefore, can be easily tampered with by anyone.

Stay safe from skimming!

The post What is ATM Skimming? appeared first on McAfee Blog.

Firm urges password reset despite claims attacker has live access

Threat actors combine techniques to trick users

Many left in the dark due to immature approaches

The so-far unidentified hackers broadcasted reports that Zelensky was hospitalized “in an intensive care ward”

The Android Developers team said it reversed the decision due to customer feedback

It is easier than ever to launch cyber-attacks due to the rise of malware-as-a-service