Tag Archive for Malware

| January 10, 2009
Comments Off on Ransomware Gets Tougher

Ransomware Gets Tougher

Ransomware Gets TougherAnti-malware vendor Trend Micro has noted an increase in ransomware. According to Wikipedia ransomware is a type of malware that encrypts the data belonging to an individual on a computer, demanding a ransom for its restoration.

This type of ransom attack can be accomplished by (for example) attaching a specially crafted file/program to an e-mail message and sending this to the victim. If the victim opens/executes the attachment, the program encrypts a number of files on the victim’s computer. A ransom note is then left for the victim. The victim will be unable to open the encrypted files without the correct decryption key.

Once the ransom demanded in the ransom note is paid, the attacker may (or may not) send the decryption key, enabling decryption of the “kidnapped” files.

Recently, Trend Micro Advanced Threats Researcher Ivan Macalintal reported that a new version of the GPcode ransomware has surfaced, It is said that Gpcode[dot]ag utilizes a 660-bit RSA public modulus. Attackers appear to be upping the ante, in early June 2008, another Gpcode variant, Gpcode [dor]ak, has been detected and researchers believe it utilizes an RSA encryption algorithm with a 1024-bit public key. “We estimate it would take around 15 million modern computers, running for about a year, to crack such a key,” writes Aleks Gostev, senior virus analyst at Kaspersky, on the company’s blog.

The rise of ransomware makes regular successful data backups even more important. With current backups, you can delete the files in question, restore them from your backup and let someone else pay the attacker.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , ,
| September 26, 2008
Comments Off on 25% of Workers’ Time On Internet Is Personal

25% of Workers’ Time On Internet Is Personal

25% of Workers' Time On Internet Is PersonalSlashdot has a post about employee use and abuse of corporate Internet access, from Voco, an IT consultancy. While network abuse is not a new issue, (I worked on Acceptable Use Policies in 2000), some of the firm’s findings show the change in the size of Acceptable Use Policies (AUP) violations.

According to Voco’s data, for example, many of the pre-release downloads of the movie Hellboy: The Golden Army were over corporate networks. Voco points out that not only does this consume bandwidth meant for business; it also opens up corporate networks to spyware, adware, and other challenges for network security. And, of course, it could pose a legal issue for the company in question as well. “If investigators were tracking who was downloading, then the company address would turn up and the company would be the one facing legal implications,” Voco consultant Paul Hortop said in a statement.

The age-old challenge for firms is to balance staff “personal” and “corporate” use of the resources. Mr. Hortop asks, “Is it more time-efficient to let staff do their banking online than having them leave the office for half an hour?”

This is not a new issue, a CNN poll in 2005 found that 93% of all US employees admitted to using their employer’s Internet access for personal reasons as well as business ones, and 52% said they would rather give up coffee than their Internet connections at work.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , ,
| April 10, 2008
Comments Off on Malware to exceed 1 Million in ’08

Malware to exceed 1 Million in ’08

Malware to exceed 1 Million in '08The total number of viruses will reach one million by year’s end, according to Sophos chief technology officer Paul Ducklin in an article in PC World. Most striking to me is that Ducklin claims 25 percent of unique malware have been created in the last six months of its 20-year history. That translates into 250,000 attack vectors in 6 months or nearly 60 unique malware vectors (as defined by Sophos) an hour.

Ducklin offers some hope, “About 85 to 90 percent of malware families have a fix created for them almost immediately,” which leaves over 50 new attack vectors an hour that have to be identified, code written and updates distributed.

In the same PC World article F-Secure Asia-Pacific vice president Jari Heinonen said it logs about 25,000 malware samples each day, the highest on record.

“The total number of viruses and Trojans will pass the one million mark by the end of 2008 if this trend continues,” Heinonen said.

Both Sopho’s Ducklin and F-Secure’s Heinonen say that drive-by-downloads of malware, due to iframes vulnerabilities are growing. F-Secure’s Heinonen “Drive-by downloads are the preferred way of spreading malware [because] they happen automatically by visiting a Website unless users have a fully patched operating system, browser, and plug-ins.“

Heinonen also predicts that malware will increasingly target the kernel sector through rootkits such as Mebroot, which attacks the bootstrap sector. A resurgent Mebroot was detected last month, some 15 years after the DOS-based malware was created.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , ,
| June 7, 2005
Comments Off on Anti-Spyware Best Practices

Anti-Spyware Best Practices

·Anti Spy-ware Best PracticesAnti Spy-ware Best PracticesMake a spyware protection company policy. To protect your business’s best interests, anti-spyware protection should be required software on every computer.

Use more than one anti-spyware application

Regardless of what anti-spyware vendors claim, you almost always need more than one program to protect against a lot of adware and spyware. Experts say the best protection you can get is only probably around 70% using a combination of the two leading anti-spyware programs.

Use a centrally managed anti-spyware solution

Centrally managed software usually works best for companies with more than just a handful of computers. Spyware protection is no different. There are several vendors, such as Webroot and CA, which offer such software. If you have roughly 10 or more Microsoft (MSFT) Windows-based computers and want to save time, effort, and money in the long term, you should definitely consider this route.

Use a layered defense

The best defense against any information threat is a layered defense. You have a greater chance of defending against spyware if you use anti-spyware software combined with anti-virus software, personal firewalls, and host anomaly detection/intrusion prevention software. You can even help prevent infections at the network perimeter by utilizing spam and content filtering for inbound emails.

Lockdown your systems

A spyware defense that deserves separate mention is to configure Windows and Internet Explorer to be more secure. There are simple things you can do that will make a world of difference. For starters, make sure your systems are configured to be “hardened” from the elements. Roberta Bragg has written extensively on this topic at SearchWindowsSecurity.com. These hardening tricks are very easy to implement, and you can even push a lot of them out via Active Directory Group Policies.

Also, configure Internet Explorer (or whichever browser you use) to have pop-up blocker protection. This feature is built into most new browsers, and there are several well-known third-party applications for this. A good one for Internet Explorer is the free Google toolbar. It not only blocks most pop-up ads that harbor spyware, it also serves as a quick and convenient way to perform Google queries while browsing the Internet.

Use a more secure browser

Internet Explorer is a huge target for pop-ups, phishing, executable code, and other hacker vectors. If possible, use a more secure Web browser such as Firefox or Opera. These browsers likely have 99% or more of the functionality your users need with less hassle.

Install anti-spyware protection before new computers are deployed

Rather than installing spyware protection and cleaning utilities after you suspect infections, put it on systems before they’re deployed into the wild. For existing systems, simply install your favorite anti-spyware application such as Spybot Search and Destroy, Ad-Aware, or PestPatrol (or a combination of two or more). Let the software clean your systems and simply keep it running full-time in the background to act as a preventative layer to keep your systems protected.

Protect every Windows-based system on your network

Anti-spyware software is no longer just for workstations – it needs to be on servers, laptops, and any system running Windows – regardless of whether or not they are networked. Windows is the OS of choice for most spyware infections (at least for now) so make sure every single Windows-based system has protection.

Remote users might not be receiving updates

If you have remote users, remember that their systems may not be receiving the proper anti-spyware and other software updates.

Educate your users

User gullibility, ignorance, and carelessness are the main causes for infection. People clicking “yes” or “OK” in pop-up windows allowing software to be installed opens up the floodgates. Downloading and running seemingly innocuous programs doesn’t help the cause either. Educate your users on what to do and what not to do. Give them examples of what can happen when spyware infects a computer and how that relates to their everyday job functions. It’s amazing how much buy-in you can get using this technique.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , ,
  Recent Entries »