‘WannaCry’ Ransomware Attack Spreads to 74 Countries

12th May 2017/in Security

A wave of ransomware infections took down a wide swath of UK hospitals and is rapidly moving across the globe.

The so-called Wanna Decryptor ransomware is currently moving like wildfire across 74 countries in more than 45,000 attacks, including a massive takedown of several UK hospitals today.

The number of infections across the world is quickly growing, according to Kaspersky’s Twitter post. So far, some of the countries that have been hit include Britain, Spain, Russia, Taiwan, India, and the Ukraine, according to various reports streaming across the WannaCry Twitter feed.

Security experts say the ransomware attack is exploiting the Server Message Block (SMB) critical vulnerability that was patched by Microsoft on March 14, MS17-010. The 0day exploit, aka ETERNALBLUE, believed to be an NSA exploit tool, initially was leaked by Shadowbrokers, prompting a patch from Microsoft.

“There is nothing comparable to date. This is a massive global ransomware operation, the largest and most effective to date. Unfortunately, not all organizations patched against ETERNALBLUE/shadowbrokers exploits,” said Kurt Baumgartner, principal security researcher, Global Research and Analysis Team (GReAT) for Kaspersky Lab.

According to an Avast blog post, Telefonica in Spain and the National Health Service (NHS) hospitals in England have been hit.

In the UK, a large scale attack hit a number of hospitals across the region, forcing medical staff to re-route emergency patients to other hospitals in the area, according to a report in The Guardian.

The malware struck NHS hospitals around lunch time, with an initial email going out to employees that the email servers were encountering difficulty, followed by clinical and patient systems going down, the Guardian reported. That was followed by a ransom note appearing on employees’ computer screens, demanding $300 in Bitcoins to be paid in three days, otherwise the ransom would double. And if no payment was made after seven days, then the files would be forever lost, according to the report.

The NHS issued an alert and confirmed 16 medical centers had been hit, according to Kaspersky Lab.

This ransom message also appeared in Spain, where telecom giant Telefonica was also targeted, the Guardian noted.

“The suspected syndicated attack is unique in that it’s not targeted at any one industry or region, and is using a particularly nasty form of malware that can move through a corporate network from a single entry point,” says Simon Crosby, co-founder and chief technology officer at Bromium.

“As usual, it’s leveraging a recently patched vulnerability that many have failed to implement in a timely matter,” he says. “As long as the industry continues to play this never ending cat and mouse game of patchwork systems, sophisticated attackers will easily find ways to exploit the public in increasingly large scale attacks such as this.”

How WannaCry Makes You Cry

The ETERNALBLUE exploit tool surfaced on the Internet via the Shadowbrokers’ dump on April 14. Although Microsoft had issued the March patch, many organizations have not yet installed it, according to Kaspersky’s blog post on WannaCry.

The security firm said WannaCry initiates through an SMBv2 remote code execution in Microsoft Windows and then encrypts data with a file extension “.WCRY.” It then drops and executes a decryptor tool that was designed to hit users in multiple countries with a ransom note translated to the appropriate language for that country, according to Kaspersky Lab.

Kaspersky’s Baumgartner describes the attack this way: “It is a worm over SMB and the communications are over TOR, directly to hidden services, so I would not call it a peer-to-peer worm.”

Researchers recommend installing Microsoft’s patch, which closes the affected SMB Server vulnerability used in the WannaCry attack.

For organizations that have older equipment or legacy software, such as hospitals, manufacturing plants, and power plants, deploying a patch can be complicated and disruptive, which may in part explain how a wide swath of NHS hospitals fell victim to WannaCry.

11 things you shouldn’t put on your Facebook

4th May 2017/in Blog, Security

What do you put on your Facebook profile and on your wall? Anything? Everything? Well, according to a hacker, you should be very careful what you put on your Facebook, or you could lose a lot, from money, to even your life.

Some of these things include the sort of details many people use for their passwords – things like their maiden name, first pet, or their favourite album, which seem innocuous when in this other context of a personality list.

Below is a list of some of them:

1. Photographs of your children

While it might seem cute, putting up photographs of your young ones could expose them to pedophiles. Also, what type of information or pictures would your children want to see about themselves online at a later date?

2. Phone number

Your privacy is important, so unless you have a phone number for business purposes, putting up your personal number online could lead to unnecessary phone calls, stalking or even being exposed to scammers.

3. Birthday

Your birthday is one way people can access your bank account and personal details, once they link it with your name and address.

4. Location

There are location services on Android or iPhones, which means that many people know where you live including those that may wish to harm you. Please turn off your location.

5. Too many friends

Having 4,000+ friends on Facebook, when in reality, you only know about 100 is exposing yourself to a lot of unwanted information and interaction. You should definitely prune your friend list.

6. Where your child/young family member goes to school

Do not put the name of your child’s school on Facebook. Frequent offenders are prowling the internet for such information that might put your child at risk.

7. Your boss

We have heard of people losing their jobs because of Facebook posts. While you should be careful of what you post, maybe you should remove your boss, to avoid unnecessary hassle.

8. Relationship status

Your relationships are better kept private. It may not work out, and the consequent change from “in a relationship” to “single” will make you feel worse than you already do.

9. When you are going on holiday

Putting your holiday plans on Facebook is not a good idea. Burglars can choose that time to rob your house.

10. ATM card pictures

This is never a good idea as the number on your card can be used to defraud you.

11. Boarding pass pictures

Taking a photo of your boarding pass, is a way to show off. But it could have serious consequences, the barcode on your boarding pass is unique to you, and can be used to find the information you gave to the flight company.

7 Steps to Fight Ransomware

4th May 2017/in Blog, How To, Security

Ransomware can be a highly lucrative system for extracting money from a customer. Victims are faced with an unpleasant choice: either pay the ransom or lose access to the encrypted files forever. Until now, ransomware has appeared to be opportunistic and driven through random phishing campaigns. These campaigns often, but not always, rely on large numbers of emails that are harvested without a singular focus on a company or individual.

As ransomware perpetrators continue to hone their skills, we’re seeing a shift to more specific targets. The driver of this shift is the realization that companies, especially larger ones, are much higher-value targets than an average individual and are thus able to pay significantly higher ransoms.

This change has elevated the need for companies to strengthen their defensive strategies. Executives must allocate resources and ensure strategies are active against ransomware intent on paralyzing their organization.

The best defensive strategies should include the following:

1. Provide user awareness training and friendly testing. This can reduce the human attack surface.

2. Maintain a comprehensive patch management program to keep all systems up to date and reduce the endpoint attack surface.

3. Limit users’ privilege and network drive connectivity to the minimum essential for job requirements.

4. Conduct frequent backups and store them offline because many ransomware variants will spread through drive shares and can even reconnect a disconnected drive share.

5. Use network segmentation that requires authentication. For example, a user must enter a password before traversing the network. This will reduce the network attack surface.

6. Deploy advanced threat intelligence tools. Threat intelligence can be used to identify IP addresses of known command and control sites. Blocking these sites can potentially prevent malware from being able to establish its encryption routine. It’s important to note this strategy may not work on some newer versions of ransomware that operate independently and create their own encryption keys without having to communicate with a command and control server.

7. Lastly, as a final fallback, know how to buy Bitcoin (or Monero, which is emerging as an alternative means of payment.) Consider pre-purchasing some in advance in the event a ransom needs to be paid on short notice.

Should you pay the ransom to continue operations, or do you refuse to pay it as a matter of principle? The tie-breaker is the cost of downtime — measured potentially in the range of thousands of dollars per hour. One should establish in advance the financial impact of losing access to critical information or business processes, and work through the decision before facing a crisis.

Ransomware is a clear and present danger. Companies can no longer afford to take a wait-and-see attitude. If you’re vulnerable to ransomware and take no precautions to mitigate those vulnerabilities, then the only thing you’re relying upon to prevent an infection is hope — and hope is not a strategy. By implementing the seven defensive actions listed above you can greatly reduce, and potentially eliminate, vulnerabilities. Review the list again, and remember that increased security awareness training with testing can be your most effective defense.

MasterCard adds fingerprint sensors to payment cards

20th April 2017/in Blog, Hardware, Security

Our fingerprints are quickly replacing PINs and passwords as our primary means of unlocking our phones, doors and safes. They’re convenient, unique, and ultimately more secure than easily guessed or forged passwords and signatures. So it makes sense that fingerprint sensors are coming to protect our credit and debit cards. MasterCard is testing out new fingerprint sensor-enabled payment cards that, combined with the onboard chips, offer a new, convenient way to authorize your in-person transactions. Instead of signing a paper receipt or entering your PIN while struggling to cover up the number pad, you simply place your thumb on your card to prove your identity.

This Phishing Attack is Almost Impossible to Detect On Chrome, Firefox and Opera

17th April 2017/in Blog, Security

A Chinese infosec researcher has discovered a new “almost impossible to detect” phishing attack that can be used to trick even the most careful users on the Internet.

He warned, Hackers can use a known vulnerability in the Chrome, Firefox and Opera web browsers to display their fake domain names as the websites of legitimate services, like Apple, Google, or Amazon to steal login or financial credentials and other sensitive information from users.

More and more people are using VPN services to protect their privacy online — here’s how they work

16th April 2017/in Security

Internet privacy was once again thrust into the limelight recently when President Donald Trump signed a bill that would allow internet service providers to sell your browsing history to third parties like advertisers.

As much as the news rekindled concerns around internet privacy, little has actually changed. The signed bill is generally keeping things as they are. The outrage comes from the fact that the bill is rolling back an Obama-era measure to prevent ISPs from tracking and selling your browsing history, which didn’t have time to take effect before he left office.

How to stop those annoying, endless robocalls to your smartphone

16th April 2017/in How To, Security, Software

Have you noticed an uptick in those super annoying robocalls, telemarketers, and scams hitting up your smartphone all hours of the day and night? I have, and it’s driving me nuts.

Last month, I had a bogus call to lower my electricity bill. A few weeks ago, it was a pause after I said hello, then a woman saying, “Oh, I’m sorry, I’m adjusting my headset,” before launching into a sales pitch of some sort. And then there’s the daily deluge of numbers that look legit — like my daughter’s school calling, or a media outlet from Manhattan — only to end up being an obvious scam. “This is George Michael,” says a male caller with a heavy accent, “calling from your online pharmacy with your diet medication.” Talk about adding insult to injury.

Robocall rage

According to the Federal Communications Commission, there are nearly 2.4 billion robocalls made every month. That’s more than 7 calls per person, according to new research from the YouMail Robocall Index.

At best, the calls are frustrating. At worst, they’re robbing us blind. So what can we do about it once and for all?

#1 Google your own smartphone number

Let’s start with a little self-education. How the heck are these criminal-callers getting our cell numbers in the first place? If you don’t post it publicly across social media, use it on shady shopping sites, or shout it out to every telemarketer who calls — how is it getting out there? The Better Business Bureau recommends Googling your own number. Do it. I’ll wait.

Was it there? Mine was. It might not be alongside your name, but chances are it’s there, collected by a “people search” company like Nuwber that aggregates information from “White Pages listings, Public Records and Social Network Information.” Thanks to modern technology, these lists are now easy for cyber scammers to scrape. And that’s how the the robo-games begin.

#2 Add your number to the Do No Call list

If you haven’t already, add your cell number to the National Do Not Call list. I just went there to verify that I’m on the list and sure enough, I’ve been registered since February 2006. So much for that. Obviously, it doesn’t fix the issue all the way around, but it does help keep legitimate companies from cold-calling you. Sadly for us, the bad-guys have easy workarounds (like #1).

If you’re already on the Do Not Call Registry and still get hit up, report the calls to the FTC, which compiles the reports and hands out the fines. You can also block them right from your smartphone and block any spammy texts too.

#3 Blocking calls and texts

On iPhones, tap the green phone icon on your home screen, select the “Recents” tab on the bottom of the screen, then tap the blue “i” information icon next to the phone number you want to block. A screen pops up with a bunch of options and at the very bottom you’ll find “Block This Caller.” Tap it and then when the verification screen appears, confirm your decision.

On most Androids, there are two easy ways to block numbers. If you’re on the standard version of Android 6.0 you can go into your call log and long-press on the number you want to block, then select “Block number” from the pop-up menu.

If you’re using a version of Android other than the stock version (or if you don’t know which version you’re actually using) you can select “Settings” and then “Call blocking,” then tap “Add number” and type in the number you want to block.

#4 Bring in the big guns

There are a handful of apps that promise enough anti-spam ammo to stop annoying calls for good. They all require a bit of set-up, but the toughest part of that so far for me has just been remembering my AT&T password. (You’ll need the provider password for some of them.)

Nomorobo – (iOS)

This is my best of these apps I’ve reviewed to date — so it’s no surprise that it won a competition by the FTC. After you download the app onto your device, you can sign up for a free trial for 30-days, or commit right away to either $1.99 per month or $19.99 per year. (If you don’t remember to cancel your sign-up, you’ll be auto-billed.)

After you install the app, it prompts go into your iPhone’s settings, select “Phone” then tap “Call Blocking & Identification” and tap Nomorobo to enable it. Back in the Nomorobo app, it asks you to enter your phone number for verification (to make sure you’re not a robocaller yourself). After that — you’re done.

You can send yourself a test robocall to see exactly how it all works. When a sketchy telemarketer hits up your phone number, your call screen shows a big red dot and a note that says “Robocaller” so you know to avoid it. There’s even an option in the app to block these calls automatically, before they even reach your smartphone screen.

Nomorobo swears it doesn’t block legitimate calls from pharmacies, schools, or other important institutions — because it “analyzes millions of calls made to hundreds of thousands of phone lines every single day.” While it doesn’t want to say much more about its secret sauce than that, I’m using it and it seems to be working well.

Truecaller – This paid app (iPhone, Android, Windows Phone) reports that it’s collected more than 3-billion phone numbers and relies on information from users to filter out the scams. When the app identifies a specific phone number as robocall or scam, it lets you know with an alert on the call screen. The website says it gets its information from a central database that is constantly being updated with new phone numbers.

Set up is similar to NoMoRobo. Download the app, follow the prompts. I like that you get link it to Facebook to auto-fill and there’s an animated screen that shows you the entire set-up process. It doesn’t get much easier than that.

There are several pricing options, but you end up paying about $1.50 per month for the full suite of features. Because Truecaller queries a central database for information on each number, the app requires a data connection to identify new callers, so keep that in mind if you often find yourself in places without 3G or 4G available.

Enough is enough!

I posted a message on this topic in my Facebook feed, and dozens of people chimed in. Other people have good things to say about similar apps such as PrivacyStar, Mr. Number, Hiya, and YouMail. We’ll try those and deliver an updated anti-spam round-up with the next few weeks.

Have you found a clever way to outsmart robocalls? Be sure to let us know in the comments section below.

Hacking Group Claims N.S.A. Infiltrated Mideast Banking System

15th April 2017/in Security

For the past few months, an elite hacking group calling itself the Shadow Brokers has sporadically leaked sensitive data from the National Security Agency. On Friday, just when its leaks had appeared to slow, the group released what appears to be its most damaging leak so far: a trove of highly classified hacking tools used to break into various Microsoft systems, along with what it said was evidence that the N.S.A. had infiltrated the backbone of the Middle East’s banking infrastructure.

The timing of the leaks coincides with the United States’ recent shift in policy in Syria, which has escalated the conflict with the Syrian government’s main backer, Russia. The Shadow Brokers wrote in broken English in an online post, which cited the American missile attack on a Syrian air base among other reasons for the leak, that after a hiatus, it had returned to leaking because it was upset that President Trump was abandoning “the peoples who getting you elected.”

Hackers can steal your password by looking at how you tilt your phone

12th April 2017/in Security

According to a team of cybersecurity experts at Newcastle University, the way you tilt your phone could be used by hackers to break into your device.

When it comes to security and the protection of privacy, people often worry about connecting to public Wi-Fi networks, tricking face recognition technology, or bypassing fingerprint sensors. What usually gets left out of the discussion is the multitude of basic motion and orientation sensors that can be found inside most smartphones and tablets today. Well, according to cyber-experts at Newcastle University, we should be paying more attention to these sensors that we take for granted every day.

According to the paper published by the team, they were able to crack four-digit pins with 70 percent accuracy on the first guess and 100 percent accuracy by the fifth guess.

Global Surveilance: North Korea Hackers Target Nigerian Banks

6th April 2017/in Security

A new report from a Russian online cyber security firm, Kaspersky, has observed that North Korean hackers are attacking banks in 18 countries, including Nigeria.

The organisation noted in its report that this could be regarded as the biggest bank heists in world history.

Banks and security researchers have previously identified four similar cyber-heists attempted on financial institutions in Bangladesh, Ecuador, the Philippines and Vietnam.