Network solutions, Cybersecurity, virtualization to lifecycle support and end point management.
Cyber Monday has become an epic time of the year not only for consumers but for the online retailers that help them celebrate. Whether you’re eagerly waiting for the latest game console or TV deal, be sure to think about improving your home and office cybersecurity in advance of your online shopping binge. Here are 4 Cyber Monday security tips to cover you.
[Read more…] about 4 Cyber Monday Security Tips to Shop Safely
Just as you (hopefully) always keep your doors locked at home, you likely also have your business locked down tightly with a number of security solutions. You have a network firewall with anti-virus and IPS (Intrusion Prevention System) running on it, your servers are secured, and all your endpoints are protected with anti-virus software. Yet John from accounting just opened up an attachment from an email titled “overdue invoice” and infected his desktop with ransomware, not only encrypting all his local data but potentially infecting your entire network.
Thankfully you disconnected him before it spread.
Still, you’ve invested tens of thousands of dollars in security solutions and yet these ransomware attacks are still managing to get in and hold your user data hostage. What are these new kinds of security threats doing differently that allow them to get past your locked doors and into your house? Moreover, how do you stop them?
Today’s normal security software detects “traditional” malware in a variety of ways, one being that known security threats are included in a signature database that is updated when new threats are discovered. Security threats are identified when compared to these signatures. Of course, this doesn’t protect against new unknown threats. To detect these zero-day exploits, standard security software uses heuristics analysis to evaluate if a file contains malware.
Even though this technique has been successful in catching many emerging threats, malware is becoming increasingly sophisticated and evasive, and ransomware attacks are the most sophisticated yet. Modern malware can evolve in almost real-time, using server-side “malware factories” to morph the ransomware payload to generate unique hashes that can defeat signature-based and even heuristic security solutions.
We’ve long had to deal with phishing emails, those masquerading as legitimate communications that entice you to click on a link that either leads to malware or to provide personal info that can be used for identity theft. However, over the years end users have been educated enough, and the content in those emails stands out enough that in most cases it’s easy to recognize this kind of security threat. Also, current anti-spam security solutions are able to catch and filter out these emails.
However, cybercriminals have moved on from phishing and identity theft. Ransomware is the new easy money for them and the emails they send out are good enough that they can easily fool the careless user. The content often looks legitimate, is well-written and very convincing. The ransomware payload is usually contained in an attachment like a Word doc or PDF (though sometimes it can be a web link) and the email gets users to open it with calls to action like “overdue invoice attached,” or “wedding invitation attached.”
Another important aspect is that cybercriminals are following email marketing strategies and almost sending out their ransomware messages as campaigns that come in waves. So even if a user deletes one threat, a similarly convincing email with perhaps a different subject, or from a different sender, will arrive the following day. Because the emails look legitimate, it is very hard to for traditional security solutions to detect them. Without investing in some kind of next-generation solution that can combat ransomware, you have to hold delivery of all attachments to your user’s inboxes and analyze them for threats in a sandbox environment before releasing them.
Although this point isn’t specifically about how ransomware attacks can get past your security systems, it does point to the fact that cybercriminals have become increasingly professional. Many of them operate in the same way as legitimate IT solutions once your data has been held hostage. An investigation by F-Secure, a cyber-security and privacy company, discovered that the “products” from the leading ransomware groups are very professional applications. For example, the pop-ups asking you to pay up are viewable in multiple languages, and there is an option of a trial decryption of your information to demonstrate that it is still there and accessible once you pay the ransom.
In addition, when you reach out to the attackers to pay up, many of them provide great customer service, such as offering discounts and a willingness to extend payment deadlines. Clearly, these are not fly-by-night organizations but criminal enterprises with large amounts of resources behind them to create threats that are constantly evolving to defeat security measures. The threat from their malware should be taken very seriously.
We will be following up with another blog that will go into more detail as to how to combat ransomware, but the first step is educating your users to have some common sense as to what email attachments they open. Still, user error will always be an issue, so investing in a security solution that can stop ransomware is crucial. Although some of the big players in the space will likely eventually update their offerings to combat this new threat, for now, your options are fairly limited and are focused on better securing the endpoint.
One of the solutions we offer is Bromium Endpoint Protection & Endpoint Security, which we wrote about a few months ago. Bromium complements your existing endpoint security solution and with it, you users can “Click on Anything Without Risk of Breach”. For more info on Bromium and how Lanworks can help you combat the threat of ransomware, reach out to our sales team.
Ransomware is emerging as one of the most widespread cybersecurity threats targeting an increasing number of corporate customers. Malware that locks a device or encrypts data can be found all over the world. At the same time, a growing number of ransomware is being designed for specific markets or is targeting specific types of users, and a new trend is to target countries or industries that are more likely to pay for unlocking.
Ransomware and similar malware is becoming more sophisticated. Avoiding infection with cryptolockers is possible if you follow a few simple rules to protect yourself with good habits, so here are some early ransomware identification tips to help you out.
Lockware and cryptoware usually employ simple methods to infect a device or an online account. Most malware is distributed via an email with attachment that either reaches a great number of email addresses or targets a specific market, person, or organization.
That said, any user should consult his/her address book upon receipt of any new email message to verify the sender of the email. In actuality, the sender’s account might also be compromised, so double check with the sender whether such an email was really sent. You should pay particular attention to emails coming from a financial institution, be it your bank or a bank that any of your contacts is working with. Carefully check the full email address to identify any suspicious information. This sender info is located in the header of the message.
If you routinely deal with large number of text documents and spreadsheets that are coming from third parties, make sure that macros and ActiveX are disabled in your office suite. This is a common method to infect a computer. Also, avoid opening attachments sent through social network accounts because they are easily compromised and mimicked. Document viewers are useful tools to preview a document without launching any embedded macros. There are viewers for all widespread office software suites that allow checking whether a document contains what is supposed to contain and verifying its legitimacy. In theory, a decent antivirus solution should easily find macro viruses but these precautions add an extra comfort level.
Although many services and merchants like to incorporate direct links in their emails, it is much safer to check the sent link outside of your email agent. Most antivirus vendors also recommend avoiding clicking on links in emails.
One aspect of ransomware’s sophistication is the increasing use of social engineering traps, trying to force the recipient to open an attachment or send information to a remote server. So take your time and verify whether you have asked for the submitted attachment and whether the information request is legitimate. Simply put, avoid sending sensitive information such as usernames, passwords, and access codes in response to emails. The same applies to credit card numbers (but this is a whole other story!).
Develop a routine to check the file extensions of attachments sent by email. For instance, extensions like .exe, .vbs, or .scr are suspicious if you expect to get a document as an attachment. These are executable files and they have nothing to do with a document or image. Another malware trick is to send an attachment where the file has two extensions e.g. document.xlsx.scr, which is not a legitimate format.
Do not trust browser popups telling you that your computer has been infected with a virus or is at risk. No legitimate antivirus works this way and this is a common method to trick users into clicking on a malicious link.
You don’t need to be a cybersecurity guru to perform regular backup of your important data. In fact, this is the ultimate protection against any malware, lockware, or cryptoware. Most hosting providers, for instance, offer daily backups allowing a hacked or compromised website to be restored to its clean version without losing much data or recently introduced functionality.
More advanced techniques for ransomware prevention are also available and likely used by your IT department. These include filtering certain file types at the server level, preventing particular services from being run by the operating system, introducing hierarchical user and system access rights, and implementing strict policies for shared content and shared disk drives. Nonetheless, by following the above tips on preventive identification of ransomware, you will minimize the risks of being infected with malware and failing victim of ransomware.
Want to know how your IT systems stack up? Talk to us for an easy assessment.
$325 million.
That is the estimated amount American users paid to unlock and restore devices hit by ransomware last year.
A report by Symantec states that ransomware increased 35% in 2015 and is now targeting not only Windows-based systems but also smart phones and systems that run on Mac OS and Linux. Recently, security and antivirus labs reported that attacks on smartwatches and smart TVs are starting to occur and this has implications for the business world.
Ransomware is malware that locks a device or encrypts its content before asking for a ransom to unlock or decrypt the content. The cost to restore access or decrypt content varies and is usually in the range of $30-300; nonetheless, payments of up to $10,000 have been reported to the Internet Crime Complaint Centre (IC3). You may even remember the University of Calgary recently paying a $20,000 ransom after its systems were attacked.
Locking and encrypting malware usually targets vital business systems such as a computer that is processing customer orders, a CRM that is installed on-premises, a database, or another business critical device or application. This is the classic ransomware attack scenario.
The rapid adoption of BYOD (Bring Your Own Device) practices within corporations has increased the risks of a critical mobile device containing essential business data being locked by attackers. A good number of senior executives and high-ranking employees use their own mobile devices to access corporate data and connect to corporate networks.
Recently, security researchers reported that some 85 million devices running Android worldwide are infected with a malware that can easily turn into ransomware. Only one of many existing malwares that can be exploited as ransomware is referenced; therefore, corporations should take measures to protect themselves against such types of known security threats. Even the yet to be released Android Nougat operating system does not provide 100% protection against ransomware that can lock users out of their smartphones or tablets. The iPhone is also vulnerable to ransomware attacks, which is one more reason to implement measures to protect business critical systems and devices.
Another report claims that at least one mobile device is infected within any organization using more than 200 iOS or Android mobile devices. The report also states that 4% of all mobile devices, including corporate ones, are infected with malware. So chances are good that a device owned by a corporation or used to access corporate systems is infected with ransomware like screen-lock malware or cryptoware.
The number of reported ransomware attacks on businesses should alarm corporations. Kaspersky Lab reports that between 2014 and 2016, the percentage of corporate users attacked by such malware nearly doubled to 13.2% of all ransomware attacks. So a threat that was aimed primarily at personal users has rapidly evolved into a full-fledged tool to blackmail corporate users.
With such a rapidly growing number of ransomware attacks on business critical systems and mobile devices, protection against this kind of malware is not only important but should be considered compulsory. Taking into account that such malware is targeting both corporations and public organizations, the estimated cost of damages from ransomware attacks is in the range of hundreds of millions dollars a year. Protection against ransomware has to be an essential component of any full-fledged antivirus and IT security system aimed at protecting the on-premise systems and mobile devices used by any organization.
Does your IT security system and your employee security training protect you sufficiently? Contact us for a security assessment.
In the last few weeks, stories about ransomware have been everywhere. Over the years we have become familiar with viruses and malware, and the industry constantly develops products and strategies to deal with these types of threats. Although the successes have varied, with software and common sense we have managed to maintain relatively safe and user friendly computing environments.
Enter the year 2016. Smarter systems, smarter hackers.
The new vector of attack is shifting from information gathering to directly extorting cash from organizations. Just Google ransomware and you’ll be surprised by the number of incidents and who has been hit and how.
If you are not familiar with the term ransomware, these are file attachments, documents, spreadsheets, etc. that are mostly distributed via email. The subject of these emails varies: invoice details, subpoenas, shipping information, party invitations and insurance benefits. What is common, is that they all contain some sort of document attachment that needs to be opened.
Here is the scary part, these emails look very legit and if they are sent to the right department in an organization, they would not appear at all suspicious. Compromised websites hosting downloadable content have also been identified as a culprit.
It is also worth mentioning that these types of attacks do not spread from PC to PC, but are focused on encrypting an unsuspected user’s system files or documents, both local and network based, hence the term ‘CryptoLocker’.
Once the infected file is executed, the user will be presented with simple instructions on how to deliver payment to get the keys to decrypt.
In addition, there is no easy way to get rid of these types of infections. You need to rebuild the PC and recover network documents from backup or you need to pay the malware operator a ransom to get an encryption key.
Furthermore, the price for the keys keeps going up the longer the infected user waits. Various antivirus companies try to crack these keys and provide them free of charge, but that takes time and users could be in for a long wait.
The traditional antivirus/antimalware tools have not been very successful in stopping these infections. It is important to be diligent when opening email attachments, particularly if they look even a bit suspicious, and aware of how easily it is to be tricked by a compromised website.
In the last two weeks, I have personally received at least 6 of these emails, each with a different type of Cryptolocker ransomware. How did I know they were ransomware? I was able to test each of them using Bromium End Point Protection, a product that uses microVM isolation to deal with any sort of infection.
Bromium uses an endpoint CPU micro-virtualization, a light-weight micro-VM that cannot modify Windows or gain access to high-value files, data, networks or sites, or access any OS services. It isolates each untrusted website, document or executable to defeat attacks from the Web, email, social media and USB. Endpoints are protected even on untrusted networks, and automatically self-remediate when attacked. When an endpoint is attacked, malware may execute in the context of a micro-VM, but no content of value is available to be stolen, and the attacker cannot pivot onto the enterprise network to further the attack. As the website, document or executable is closed the micro-VM is discarded and so is the malware.
Bromium is a premium priced product that may not be suitable for every enterprise. Call us to learn more about its viability for your company.
Remember to always be careful in dealing with suspicious looking emails or websites.
This is the message from Bromium, a company approaching endpoint security from a very different angle, using virtualization and hardware technologies included in Intel and AMD processors.
Bromium Advanced Endpoint Security is deployed, managed and orchestrated by the Bromium Endpoint Controller, a scalable management system built on standard enterprise infrastructure components that is engineered to reliably manage hundreds of thousands of enterprise endpoints Windows and Mac. It includes tools to Protect, Monitor, Analyze and Manage the entire enterprise.
Bromium Endpoint Protection is built on the Bromium Microvisor, a Xen-based, security-focused hypervisor designed to automatically isolate each vulnerable user task, such as visiting a website, reading an email, opening a document, or accessing a USB drive. Today’s enterprises are supporting a number of legacy applications which in turn may be dependent on legacy browsers, java or active X components. Also, do not forget the “road warriors”, living on public networks outside of the prying eyes of internal security team. In these scenarios there is very little that can be done on the technology side and a lot of focus is being put on user training, however, the attackers are getting more innovative in targeting their audience leaving the user exposed. Being infected in the office is one thing, being infected on the road presents a very different scenario, just imagine going into a meeting with a new client, turning on your laptop and finding out that your system has been hijacked or will not even start, not the best first impression.
How is Bromium addressing this? Endpoint Protection uses endpoint CPU micro-virtualization, a light-weight micro-VM that cannot modify Windows or gain access to high-value files, data, networks or sites, or access any OS services, to hardware-isolate each untrusted website, document or executable to defeat attacks from the Web, email, social media and USB. Endpoints are protected even on untrusted networks, and automatically self-remediate when attacked. When an endpoint is attacked, malware may execute in the context of a micro-VM, but no content of value is available to be stolen, and the attacker cannot pivot onto the enterprise network to further the attack and as the website, document or executable is closed the micro-VM is discarded and so is the malware.
This isolation enables Bromium to protect endpoints that have not been patched, or those that are tied to legacy third-party plugins and applications. The architecture automatically defeats and automatically discards malware, and eliminates costly remediation—keeping users productive.
As attacks are being executed, the monitor alerts the Bromium Endpoint Controller that an attack is in progress and provides detailed real-time forensic data that allows the attack to be visualized in increasing detail using Bromium Threat Analysis. Since all forensics data is stored on the local client the solution does not require a centralized server for storing the endpoint monitoring data. Bromium presents the entire application flow, providing a complete view of the attack tying together thousands of low-level monitoring events.
Bromium turns the security problem on its head: It eliminates the need to detect malware, because it protects the system by design. Users can safely click on anything— and even when they make a mistake the system will defend itself. The enterprise can stop mandating new controls on the endpoint that hamper users, and rely on hardware that it has already purchased and deployed.
Bromium does not replace your existing Anti-virus, Anti-malware, Intrusion Detection or Patching solutions, it is there to compliment and enhance the overall user protection against all external threats. It also gives the administrators confidence and time in that latest signatures, patches and vulnerability fixes can be deployed in a more controlled manner, rather than ‘now’.
This personal overview of Bromium was written by Lanworks Senior Solutions Architect, Arthur Zylka
