Like the predictable “tick-tock” of a clock, reports are coming in of an infection spreading rapidly through Facebook via a fake Flash Update. The “tick” in this case was the report last week of a zero-day Flash vulnerability, and the subsequent legitimate update of the Adobe Flash plug-in. Not wanting to miss an opportunity, cybercriminals have released the “tock” – a video on Facebook is tricking clickers into installing a set of malware that can take complete control of the victim’s computer. Over 100k have fallen for this scam which is only 2 days old as of this writing.
What this means for you:
If you see a warning pop up on your computer that software on your computer may be out of date, it may be legitimate, and it may not be. With Adobe Flash, it’s very easy to check by going to Adobe’s own Flash website http://helpx.adobe.com/flash-player.html. Also be wary of the source of the update warning, such as that which comes from clicking on a dodgy link on Facebook or in an email. Doublecheck it against a legitimate source. Not sure what that source might be? Your trusted IT professional is only a quick call away. Spending five more minutes to vette that update warning is certainly worth avoiding a malware infection, right?
Adobe has confirmed that a recently discovered vulnerability in the current version of Flash for Windows, Macintosh and Linux is actively being exploited on the internet. Adobe is planning to release a patch the week of January 26th, but did not confirm a specific date. Though security vulnerabilities are nothing new to Flash, this particular loophole is being exploited by a well-known and widely distributed exploit “kit” called Angler which could indicate a rapid spread of compromised websites and a large spike in malware infections. Once used to gain access to a victim’s computer, the device could fall prey to any number of malicious programs, including key loggers, ratting, ransomware, and good ole-fashion zombification.
What this means for you:
According to Adobe’s own advisory, pretty much everyone is affected by this exploit, though some reports suggest that Windows 8.1 and Chrome users may be safe for the moment, but that was based upon the current version of the Angler kit in distribution. The actual security hole Angler exploits exists in every version of Flash on all OS platforms. The easiest way to protect yourself from this exploit is to disable Flash altogether. For all browsers except Chrome is usually a matter of disabling the plug-in. For Chrome, you have to type “chrome://plugins/” into your address bar to access the hidden internal plug-ins page, at which point you can disable it from there. Aside from keeping your browser’s “head” down until the storm passes, make sure your antimalware software is functioning properly and updated, and avoid any strange links you may receive over the coming week.
Laptops and cellphones were once the sole domain of high-powered business executives, but thanks to the proliferation of high-speed internet and falling hardware prices, they are pervasive not only in professional environments, but in just about any walk of life. As you can probably guess, this also means an exponentially expanded attack surface for cyber criminals who are no longer focusing on traditional targets. Anyone who has a bank account or credit history is a potential victim, and younger targets can be exposed to potentially dangerous privacy invasions. Rather than enumerate the various ways in which your security and safety could be violated (we all have enough nightmares as it is), I’d like to focus on some positive actions you can take to make your mobile, digital life safer and more secure.
- Password protect your devices.
Even the most careful professional will misplace their mobile device on occassion. While passwords won’t stop determined hackers, it will keep most everyone else out until it can be recovered or remotely wiped. Laptops normally do not have remote wiping capabilities, so don’t stop at just a password for protecting these types of devices. - Use built-in apps, or purchase location-tracking software.
Late-model Android and iOS devices have location tracking and recovery capabilities built-in, but they must be enabled. You can add location tracking or a “phone-home” program to your laptop, but it requires the device to be connected to the internet in order for it to report its location. - Don’t store sensitive information on mobile devices.
With any portable device, the chance of it falling into the wrong hands is high. If you don’t have an IT department managing your device and controlling what can be stored on it, you should inventory what is stored on the device (sensitive client info, photos, personal financial data, passwords) and consider whether you need that information to be stored on that device. If you do, make sure you observe #4. - Encrypt any storage media.
All late-model Android and iOS devices have the capability to encrypt all data stored on the phone. It’s on be default on iPhones, but must be enabled manually on most Android devices. If you have to store sensitive data on your mobile device, make sure encryption is enabled and working. While it’s not completely necessary to encrypt your entire laptop hard drive, it is possible, and many financial service firms require it on their laptops. At minimum, store your sensitive data in an encrypted partition or folder, or on an encrypted thumb-drive. - Back up your data.
Do I even need to qualify this particular practice? Backups should be stored separately from the hardware being backed up. It should be transmitted and stored encrypted if it’s internet/cloud based. It should be as frequent as the minimum period of data loss you are willing to lose, e.g. if you can’t stand to lose an hours worth of work, your backups should run on an hourly basis. Be aware of the performance hits this may have on your hardware and network bandwidth. - Hide devices in parked cars or take them with you.
Mobile device thefts from parked cars is consistently at the top of all loss categories. Thieves know to target cars coming and going from office parks, universities, airports, and the retail/service businesses near these locations. Before you drive away from your work location to a Happy Hour or a quick bite or some grocery shopping, stow your laptop bag in the trunk or hide it in a hard to access part of the car. Don’t do this when you reach your destination, as the thief may already be there, watching for someone to do just that. If you can’t secure it or hide it properly, take it with you. - Add a leash.
If you are highly mobile and work from many locations, it’s easy to misplace your smaller electronics, and sometimes even laptops. Add a colorful leash to your thumb drives so you don’t forget them, and maybe even consider the same for your phone if you are prone to misplacing it. If you have to take your laptop bag with you to a place where you don’t plan to use it (because of #6), attach the strap to something you will be using at that location, whether it be to your jacket or purse, or even to your leg if you are sitting in a location with lots of noise or distraction. It’s easy to forget work-related tools when you are focused on non-work activities. - Be less conspicuous.
In open public places with crowds, conspicuous use of expensive mobile devices will flag you as a target for bold thieves. I’ve talked with victims whose laptops were pulled right out from under typing hands in a sidewalk cafe or picnic table, and have read numerous reports of smartphones and tablets being grabbed in broad daylight. If you want to work on your device in a busy environment, keep one eye on your surroundings, and place yourself and your device in a position where it will be less easy to snatch by a fleet-footed thief. - Educate your friends and family.
Even though you may be cautious and secure, the people around you can undo your careful preparations with carelessness or even well-meaning intent. Be mindful of everyone around you who might not be as savvy as you in technology, and choose carefully how you interact with them via email, social media, and even device sharing. Work laptops are notorious for being infected by family members who don’t have the same security concerns as you do. Quieting a young child with your smartphone may seem like a good idea at the time, but maybe there is some other way you can entertain them that doesn’t involve your work phone. - Report thefts/losses immediately.
Eventually, it will happen. Whether the device is stolen, damaged or infected and compromised, you should work immediately with the appropriate authorities and professionals to make sure you limit the damage, both to you and your organization, as well as any customers or clients who might be affected. Don’t wait.
As many of you know, one of my specialties is framing complex technology concepts in more simple, human-relatable terms. When people have a better understanding of the tools they use, they have a tendency to use them more efficiently, effectively and to take better care of them. A thoughtful article in the Atlantic written by security guru Bruce Schneier got me thinking about cyber security and the internet in a new way.
Cyber attacks are something most people only comprehend at a conceptual level, but even high-profile victims and their big-budget investigations struggle to really understand what actually happened. In the case of the Sony attack, even the experts are still debating who was behind the attack, and it’s a definite possibility that we may never find out. As Schneier deftly points out, with physical attacks (criminal and political) there is usually a trail of evidence and witnesses that allow us to identify the weapons and attackers as well as motives.
Unfortunately, modern technology and the internet have made it possible to perpetrate large scale, damaging attacks that are difficult to see (even when they are underway), vexingly hard to counteract and sometimes impossible to trace back to the aggressor. In the case of Sony, does it even matter who was behind the attack? Would they retaliate? How? For those of us suffering under a never ending tide of smaller malware attacks held back by only the thinnest veneer of defenses, there’s no one person to arrest, group to disband or government to disrupt that will stop the onslaught. It’s largely anonymous, amorphous and pretty much dangerous to everyone who comes in contact with it.
It’s better to think of malware and cyber attacks as the digital equivalent of pollution.
It’s certainly a lot easier to visualize, and the analogies might help everyone understand and better prepare themselves for the next time they head out on the digital highway. It may also help organizations and governments frame their actions in a more productive manner. Even if North Korea was actually behind the Sony attack, is leveling sanctions against them really going to stop future attacks? No. Neither will hacking their internet nor any other retaliation measure we could take. Why not invest efforts in combating internet “pollution” (you could lump hate speech in there as well!) – instead of putting fingers in a leaky dike, why not see if you can reduce the pressure causing the leaks?
It’s hard to imagine how the cyber equivalent of solar energy or the banning of CFC’s might be able to stem the growing miasma of malware choking our technology, but maybe that’s because we are thinking about it the wrong way.
As a consultant, I work on many, many different computers throughout the year. Though the machines are used in a wide variety of industries and organizations, I still see a large majority of them suffering from the same handful of issues. In the hopes of lowering those numbers in 2015, here are the six most common, self-inflicted issues I’ve seen on client computers this year:
- Fake Flash/Media Player Installs – By far, this was the most common mistake I see most computer users make, and it’s easy to understand why. Though you can sometimes encounter fake Flash Player pop-ups while surfing well-known sites (especially if they’ve been hacked as well), you’ll usually come across these fake notifications while surfing in the “darker” corners of the internet, especially if you clicked a link in an email or Facebook post.
If you see a pop-up like this, stop and immediately go to: http://www.adobe.com/software/flash/about/. (If you are paying attention, your hovering over that link to see if it’s legit!) That page will tell you whether or not your Flash player is working, and what version is installed. Right below is a handy list of the latest version number. If the two numbers match, then you already have the latest version of Flash Player. Congratulations, you avoided a possible malware incursion! If you see a similar pop-up for some media player you’ve never heard of, stop and investigate. First off, do you really need to see whatever it is that requires another piece of unknown software to be installed? When in doubt, check with an IT professional!
- McAfee Security Scan Plus – When you update Adobe Flash through the official website, the main installation page will also offer to install McAfee’s Security Scan Plus by default. According to McAfee, this software will supposedly protect computers from malware infections, but I’ve yet to see this software be effective, primarily because it’s usually installed unintentionally and in addition to already-installed, more competent anti-malware. You’ll want to uncheck the box in the middle pane to prevent Security Scan Plus from being installed alongside your Adobe Flash Player update.
But what if I don’t have any antimalware already installed? Will this protect me? The old adage “something is better than nothing” does not apply here. Security Scan Plus is almost universally reviled in the tech support industry. There are much better, free programs that are more effective. If you on Windows 7, try Microsoft’s Security Essentials. Windows 8 already comes with Microsoft’s Windows Defender pre-installed (the Win 8 version of Security Essentials). If you are still running Windows XP, Security Essentials will work until July 2015, and then you will have to find another program.
- Ask Search Toolbar – Given the number of times Java updates throughout the year, it’s not surprising how frequently I find Ask’s search toolbar installed on client computers. To be fair, it’s not malware in the strictest sense: the product does exactly what you’d expect it to do, if you actually intended to install and use it. Ninety-nine percent of my clients never intended to install it, and are puzzled why their search results are no longer provided by Google or (less commonly) Bing or Yahoo. It will get installed whenever you update Java and fail to uncheck the option (just like #1 above).
This toolbar is another PUA (potentially unwanted app) that is widely disliked by the IT support community, primarily because of it’s questionable distribution tactics, poor search engine performance, and the additional performance burden it puts on Internet Explorer as a toolbar.
- Automatic Software/Driver Updaters – there isn’t one particular application in this category that can be called out, primarily because there are dozens of these shyster websites. At best they are a nuisance, and at worst they could lead to a serious malware infection. They are typically installed from pop-ups clients see while surfing the web, and most trick the user into installing their program by misleading them to believe an important driver or application is missing or out of date.
Once installed, the program rarely does what it’s supposed to, and frequently will ask for money to actually do the updates which, after paying for a subscription, it still won’t do anything, or if it does anything at all, it will install even more outdated drivers and possibly other malware. Avoid this software like the plague – you don’t need it. Windows and OS X both automatically scan for updates (if they are set up properly) for all necessary drivers and will either install them silently, or ask you to update ASAP.
- Fake Antivirus Warnings – This one used to be in the top spot in 2013, but many folks are a bit more savvy this year and have since installed legitimate anti-malware after being duped previously. Unfortunately, the black hats are taking that into account and are now using even more convincing pop-ups that look like commonly installed anti-malware. Unless your computer is already compromised, you’ll typically only see fake virus pop-ups while surfing the web, which should be one of the clues that helps determine if they are fake.
The only way to avoid falling for this scam again is to know what your anti-malware looks like, especially the warnings. Nearly all of them will pop up a warning in your system tray – so if you only see the warning while web surfing and nothing in the system tray, it was likely just a fake pop-up. If you happened to panic when warning popped up and clicked the “clean/disinfect/scan” button, the next clue will be if the software asks to install something on your computer. Your anti-malware is already installed – it shouldn’t need to install itself again – so this is another clue that you are about to be duped into installing some malware.
- PC Performance Boosters/Optimizers – With very few exceptions, most of the software that appears in pop-ups that promises to improve your PC performance will in fact do the exact opposite. The most common snake oil I come across is the various registry “optimizers”. Though some of them may actually do some form of registry cleaning, most of them only excel at optimizing the flow of cash from your wallet to their pockets. If you get a pop-up while browsing the web warning your computer needs optimization, stop visiting that website immediately, and to be completely safe, immediately run an anti-malware scan.
The only cleaner that I trust to recommend to my clients is CCleaner from Piriform. I use this software regularly, and it is straightforward enough that even my most technically-challenged clients can use it with minimal assistance.
The above six gotchas, while common, are only a small subset of the wide variety of hijinks I come across while assisting my clients. It would take way more time and patience than anyone has to completely brief you on today’s malware threats. As always, you can avoid most self-inflicted issues by paying close attention to what is being shown on screen. Most of the time there are clues that will reveal the shadiness of unusual activity on your computer, and for the times when you are in a rush or don’t understand what you are seeing, stop what you are doing, close all programs, run an anti-malware scan, and, as always, call an IT professional for a second opinion!
Image courtesy of Stuart Miles / FreeDigitalPhotos.net
Lest you think Microsoft has finally plugged the many holes in the S.S. Internet Explorer, Patch Tuesday December includes four critical upates (Microsoft’s “critical” rating means they should be applied immediately) addressing newly discovered weaknesses, including an active zero-day exploit of the OLE (Object Linking & Embedding) platform. This particular chunk of code allows Microsoft apps like Office Word and Outlook to exchange documents between each other: when you insert an Excel spreadsheet into a Word document and it shows up as an editable spreadsheet, that’s OLE at work. In this case, the exploit allows hacked Office documents attached in Outlook emails to circumvent security, typically for the express purpose of installing other malware onto the victim’s machine.
What this means for you:
I can already see your eyes glazing over, and I don’t blame you. Microsoft’s bulletins are making me cross-eyed as well. Here’s what you need to do:
- Make sure your OS is patched. The updates should start arriving on computers as early as tonight. Unless your machine is being managed by an internal IT department and they’ve disabled this functionality, your Windows OS should be set to automatically download and patch all important updates from Microsoft. If you are not sure if your computer is set up this way, you can check by going to Control Panels -> Windows Update.
- If you must use Internet Explorer, avoid using it until you get fully updated with the latest round of patches (see #1). If it’s possible, consider using an alternative such as Firefox or Chrome. While neither is guaranteed free of security bugs, they are still faring better than IE in terms of exploits.
As always, avoid opening strange and/or unexpected attachments. If you regularly exchange documents with others via the internet, consider using a secure filesharing platform other than Dropbox or Drop or any of the numerous clones that offer free apps. Instead, look into options like Citrix Fileshare (we use it here at C2) for a much more secure and fully encrypted way to exchange documents.
A client recently asked me, “What’s the difference between ‘malware’ and a ‘virus’? Is ‘spyware’ still a thing? Are these pop-ups a virus, or something else? Was I hacked?!?” As a computer user who could easily remember the earliest days of computer viruses, his confusion was understandable, especially when the media and sometimes even industry pros have a tendency to use those terms interchangeably when they really aren’t. The complexity of today’s malware landscape is complex enough to fill multiple textbooks, but I’ll try to boil it down to the things most professionals should know.
Hacking
The term “hacking” is probably the most mis-appropriated term in use today. Originally, the true purpose of hacking something was to make alterations to how a device (or system) operated in order to achieve results different from the originally intended purpose of the hacked object. This could take just about any form: the brilliant, life-saving hacks used to return the Apollo 13 crew safely to earth in 1961, all the way to subverting computer security systems to paralyze a giant corporation in 2014. The important qualifier in determining if something was “hacked” is identifying actual, human-driven intent. In most cases, malware-compromised systems are the result of an “infection” versus a purposeful hacking.
Malware
The term “malware” is a portmanteau of the two words “malicious software” which, as you might imagine, is used to describe any sort of non-native programming or code loaded into a device that subverts the device’s original purpose, with the result that its activities cause some form of harm (hence the “mal” part). Malware covers a broad range of code including the annoying pop-ups and browser redirects that take control of your internet searches to show you advertising (aka “adware”), to the incredibly disruptive (and effective) malware that encrypts your data and holds it for ransom (aka “ransomware”). “Spyware” still exists – though it has taken a dark turn from it’s original advertising roots of harvesting your demographics to now harvesting your sensitive personal information for the purposes of identity theft.
Viruses
Though a computer “virus” is still considered malware, most malware found today are not considered actual viruses. In keeping with the spirit of its biological predecessor, a true computer virus distinguishes itself by insinuating itself into or altering the host’s code with the express purpose of multiplying and spreading, something that is relatively rare at the moment in most malware, even the ones that spread via email. Though they exhibit virus-like infection patterns, their methods of spreading are more akin to poisoning or parasitic infection.
How it all comes together
It’s important to note that malware is often a primary tool in any computer hacking effort. It can be used to weaken or subvert security systems, usually by installing other programs that facilitate other activities that can range from gathering passwords, data and opening security backdoors to erasing hard drives and crippling critical network infrastructure. Though they find little comfort in it, I tell my clients that most malware infections are akin to getting the flu: it’s highly unlikely someone set out to get you sick. Typically you got it from someone who didn’t even know they were contagious.
However, similar to their biological counterparts, other digital pathogens may take advantage of your computer’s compromised immune system to cause further damage. At best, these malware infections take the form of a symbiotic parasite that may surface relatively innocuous symptoms (pop-ups, Google doesn’t work, etc.), but those redirects can lead you to further infection by more harmful malware. At the extreme, they can lead to the digital equivalent of metastatic cancer, usually with fatal results. Suffice it to say, any form of malware infection should not be tolerated, regardless of the host machine’s primary purpose, and should be taken care of immediately.
In the early days of malware, the most well-known viruses were designed to be noticed: at minimum they made themselves a nuisance through a variety of prankish behavior, all the way to the other extreme of destroying data (usually right after taunting you, just to make sure you noticed you got infected). Today, cyber criminals make their best money and achieve their political goals by going undetected for as long as possible, until they are ready to strike. Security firm Cylance has released a report that alleges networks of multiple companies considered to be critical infrastructure and/or highly sensitive – think airlines, natural gas producers, defense contractors – have been completely compromised and “owned” by an outside group suspected to be backed by the Iranian government. Through this coordinated campaign (also called an “Advanced Persistent Threat” – APT) dubbed “Operation Cleaver” by researchers, the unidentified group of hackers obtained complete control over the entire network infrastructures – all servers, network equipment and everything connected to them, and remained in control over the course of at least 2 years. The companies remain unidentified in the report, primarily for security concerns.
What this means for you:
In a conversation with a client today, we discussed the recent hacking takedown of Sony (another APT that completely owned their network), and why they made a more attractive target than my client who is only a fraction of the size. As mentioned above, malware was originally designed to wreak havoc in a chaotic fashion, but now that there is money or power to be gained from it, hackers are much more organized and pursuing targets which usually fall into one of two buckets:
- The average home computer user – easy to hack, but usually not worth much, except when campaigns net thousands of victims. The dollars add up quick.
- High-value companies or organizations – more difficult to hack, but once compromised, can result in significant monetary and political impact.
As you may have guessed, most small and medium-sized business fall squarely in the middle, and if they are hacked, it’s usually by a malware aimed at the first group. HOWEVER, the client and I considered another possibility: what if the object was to destroy data in order to disrupt your business? Even with a culture steeped in Hollywood fantasies of corporate espionage and sabotage, it may still be hard to imagine a competitor stooping so low as to put out a “cyber hit” on your organization. Considering that we already know organized crime is elbow-deep in funding and profitting from malware attacks, maybe that threat isn’t as far-fetched as we might have hoped. Coordinated attacks like Operation Cleaver are typically backed by nation states, primarily because the resource requirements are steep, but a smaller, focused campaign to take out a small company could be handled by a single, freelance “cyber-hitman”. If I can imagine it, you can bet this is already happening. We just don’t know about it yet.
It’s become a tradition here for many folks to do some technology shopping on Black Friday and Cyber Monday. The savvy shopper can often find great deals on otherwise expensive items, and if they are willing to brave the insanity of brick-and-mortar shopping on Black Friday, can sometimes get an amazing deal on the year’s hottest technology. Tablets are up at the top of everyone’s gift list, and cheap Android-based tablets are popping up everywhere, including a batch of sub-$100 tablets made by lesser-known (or unknown!) manufacturers that are flying off the shelves of discount retailers like Walmart and Walgreen’s. Unfortunately, these cheap tablets are shipping with a variety of security flaws that could pose a serious threat to you or your business.
What this means for you:
A detailed analysis performed by Bluebox Security walks through the flaws of 12 sub-$100 tablets, but I’ll simplify: if you’ve bought one of the tablets on their list, you should absolutely not access any of your important email, banking or business-service accounts with this device. The age-old rule of thumb applies here: you get what you pay for, and paying less than $50 for a tablet gets you a very unsecure device that should only be used for the most casual entertainment purposes. It is also highly unlikely that these devices can be made secure, as many of the flaws come from older versions of the Android operating system. Due to the limitations of the low-cost hardware use to build these tablets, upgrading the OS is highly unlikely without some serious hacking, and should only be attempted by a trained professional. At that point, you should really question whether the overall cost was really worth the initial savings. Long story short: these sub-$50 tablets should only be used as toys and never for serious business or personal use.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
Unlike previous high-profile security breaches we’ve reported here, the attack on Sony Pictures appears to be more than a “smash-and-grab” attack to steal customer information. In this particular case, the attackers have apparently acquired many sensitive internal documents, including lists of passwords and financial records, and are threatening to release those documents unless their undisclosed demands are met. Known as “doxxing” in the security industry, the threat began to appear on computers throughout the company on November 24, and effectively shut down normal operations. According to internal reports, the hackers gained access to a single internal server within the company, and spread from there.
What this means for you:
The details of how the attackers penetrated Sony security haven’t been released, but I’m willing to bet it was because an employee opened an attachment or clicked a link they shouldn’t have. No matter how competently implemented your security perimeter is, all it takes is a single human error to bring the whole thing tumbling down. In this particular instance, the error was made immeasurably worse by the hackers gaining access to unencrypted documents containing passwords to other internal systems. This lapse in judgement has paralyzed the company and will undoubtedly cost them millions to remediate.
The lesson to be learned from this: sensitive information, especially passwords, should never be stored in the clear on an unsecured spreadsheet or word processing document. At minimum, store those documents in an encrypted partition, or utilize a password manager with two-factor authentication. The other important lesson: don’t assume that just because you have a well-documented security policy that your employees are trained well enough to implement or follow it, even the internal IT staff.