Category: Computer Virus Info
Anything relating to computer viruses
So much ransomware…
I recently had a rash of what appeared to be ransomware emails show up in my inbox. I ended up collecting 11 of them in one week. I decided a video was in order to show what ransomware does. For the video I created two virtual machines, one with Windows 10 Pro and one with Windows 7 Home. I thought I might be able to show how different anti-virus products fared, but I didn’t get to that. To show the effects, I placed a Word file, an Excel file, a simple text file, and several photos on the desktop so it would be easy to see when they were encrypted.
To summarize: Windows 10 was SAFE, Windows 7 got ENCRYPTED!!
I ran Windows 10 first, attempting to open all 11 of the files that had come via email. Windows 10’s built in Defender anti-virus caught each and every one of the attempts and nothing happened. The Windows 7 installation didn’t have any anti-virus protection because it doesn’t come with the package. (I did do another run with Windows Security Essentials installed, and it protected my machine.) I was only able to get one of the files to run and it encrypted the Windows 7 machine. Most ransomware requires various pieces of software for them to operate. It’s possible that the others didn’t work simply because I didn’t have the correct combination of software installed.
Does all ransomware show up in emails?
A lot of the current ransomware will show up as Word or Zip files attached to phishing emails; however, it can also show up when you are on the internet. It works by redirecting you to an infected web page. This type of ransomware is know as drive-by. It requires certain plugins (such as Flash) or vulnerable browsers (such as Internet Explorer) to launch, but they can happen simply by browsing the internet.
Keep your computer patched and up to date. Make sure you have anti-virus software and keep it up to date. Don’t open files sent by email unless you know for sure who they are from and what they are. If you have to, call the individual to be sure they sent you the file in question. Once your computer gets encrypted, there is a very slim chance you will recover your files without a good disconnected back-up or by paying the ransom. The ransomware that infected my machine in the video was in the Locky family. For more information about this type of ransomware, visit this site: http://www.tripwire.com/state-of-security/latest-security-news/the-newest-online-threat-zepto-ransomware/
Ready to see how ransomware encrypts a computer? Here’s my video:
Besides having a good anti-virus software installed, I highly recommend having a back-up system. If you need help setting one up or just an assessment of your current back-up strategy, contact me. 913-893-1123
“Why Would Small Businesses Be a Target for Malware?”
Malware threats are everywhere. Working with various small businesses a statement I hear too frequently is “We don’t have anything anyone would want” or “I don’t care if we get hacked.” Both of these make me cringe. What they mean is “I don’t think anyone would want our stuff.” You hear about big businesses being hacked and may think they are the only ones who have a lot of information that they don’t want out in the public. In reality, most small businesses have computer data that should be guarded – even if it’s just client lists, or company financials. Imagine what would happen if that information was spread around the internet or if your financial data was emailed to your client list. As a small business owner, you may be using your computer for more than just business. Do you have family photos on your computer? Would you want all of them spread around the internet? Would you mind losing them all? Do you store passwords on your computer in text files, word files, spreadsheets, or just in the browser? If someone could gain access to your Facebook or Twitter account, could they get any of your friends to click on a link that supposedly you sent out? What if your computer were being used for illegal activity and you didn’t even know it? Chances are you can relate to one or more of the questions I have asked, and chances are you would prefer not to be hacked and not to have your information spread around the internet. The intent of most malware is to steal information or gain access to computer resources.
The Scrap Value of a Hacked Computer
Below is a list of tasks a “Hacked Computer” can be used for. This information was pulled from this article: http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/ Brian Kreb’s site is a gold mine of security information.
- Your computer could be turned into a Web Server for the following activities.
- Phishing Site
- Malware download site
- Warez / Piracy server
- Child Porn server
- Spam Site
- Your computer could be turned into an Email Server for sending out the following mail.
- Stranded abroad scams
- Harvesting email contacts
- Harvesting email accounts
- Access to corporate email
- Your computer could be used to sell Virtual Goods.
- Online gaming characters
- Online gaming goods/currency
- PC game license keys
- OS license keys
- Access to your computer and your credentials for Reputation Hacking.
- Linked In
- Google +
- Your computer could be used for Bot Activity.
- Spam zombie
- DDos extortion
- Click fraud
- Anonymization proxy
- CAPTCHA solving
- Your Account Credentials could be stolen and used for:
- eBay / Paypal fake auctions
- Online Gaming
- Web Site and FTP access
- Client Side Encryption keys
- Your Financial Credentials could be stolen giving access to:
- Bank account data
- Credit card data
- Stock trading data
- Mutual funds / 401K accounts
- Your computer or data can be held Hostage with the following attacks:
- Fake antivirus
- Ransom ware
- Email account ransom
- Webcam image extortion
How to Protect Your Information
1. Strong Passwords. With so many ways a computer can be utilized for dark reasons it’s important to be vigilant with your security. The reason to use different credentials on every site you visit is if one account is compromised it’s easier to contain the breach. If you have used the same password or a slight variation thereof on many sites, then you could have multiple accounts compromised and you may never get the genie back in the bottle. If you only access a few sites, you might be able to remember a few good passwords but if you have hundreds like I do, then you should be using a password manager. I will do another article on password managers later. Password Managers come in different flavors but they usually will have a master password that gives access to your vault of other passwords so that you only need to remember the one strong password.
2. Be vigilant. Passwords alone will not prevent all malware. You must be vigilant any time you are online. If your computer is on a broadband connection, and most are these days, you need to take precautions. You should have a properly set up router with firewall and secure WiFi. Your computer should have a firewall in place. You should always keep your software patched and updated. You should not have any software you don’t need on your computer. For example, if you loaded java for a job or something and you no longer use it, you should uninstall it when done. You should think about your exposure when uploading files to cloud services. You should have strong passwords protecting any online account where you store data. Think about the pictures you upload from your phone to a cloud somewhere. How safe are they? Do you have passwords stored on your phone or tablet? If those were stolen, what could someone gain access to? Email is one of the simplest ways to get a user to give access to their computer. Phishing emails tempt people to open an attachment that may look benign when in fact it’s malicious code waiting for access to your computer. Resist the urge to see that picture someone has of you. Resist the urge to reply to that guy in Nigeria just needing an account to transfer 6 million dollars to. Resist the urge to look at tracking information for a package you didn’t order. Some of them are very clever but they all have the goal of gaining access to your computer and your information.
If you need help securing data, I can help. With an analysis of your network infrastructure and verifying that credentials are not factory defaults. I provide guidance setting up backup solutions and data protection. I can assist in selecting a password manager and helping you use it correctly. If you have security questions I can help. Call 913-893-1123 and ask for Kent.
What is Malware and How do I Avoid It?
Malware: (short for malicious software) is an all encompassing word for undesirable software used to disrupt computer operation, gather sensitive information, or gain illegal access to computer systems. Malware includes computer viruses, ransomware, trojan horses, adware, and other malicious programs.
Computer Virus: The key to a virus is that it attempts to replicate itself. It is a form of malware that “infects” a host computer with any number payloads. The activities vary from harmless political statements to destructive commands that can wipe out data.
Trojan: A Trojan is a non-self replicating program that may do similar things to a virus. The name Trojan is a reference to a wooden horse used to trick the army of Troy. A Trojan typically requires the user to start the program. This is done by appearing to be something it’s not and then when the program is run, its malicious functions begin.
Ransomware: A form of malware, usually a Trojan that in some form blocks access to files on a computer. Demands are given to send money for the key to unlock the computer or files.
Adware: A form of malware that seeks to display advertisements to the user and or gather search history on the user. The simplest adware may just change the default search page in browsers. Typically browser windows will pop up or program windows pop up after you search for something. Add-on browser tool bars often fall into this category.
Being vigilant regarding Malware is the only protection. The route taken to infect a system is often called an attack vector. There are many attack vectors and new ones are being found every day. We all are familiar with software updates. Most of them are not to bring new functionality but to patch vulnerabilities that have been found within the code. When vulnerabilities are found in software they are usually kept quiet until an update can be issued to fix the vulnerability. This is why it’s so important to keep up with software updates. If your computer or device is always connected to the internet, it should be updated ASAP. Computers that are not updated are vulnerable and someone with malicious intent can go phishing with emails or a hacked website to try to catch anyone with a vulnerability. Emails promising free money or pictures of celebrities or warning that you might get an IRS audit all garner a few clicks and if the person who clicks has not updated their software, then they can become infected. With so many pieces of software operating in relative harmony on any given computer there are many opportunities for security holes. This is where anti virus and malware protection programs come in. Having these programs running will act as a shield if the user does encounter a virus or malware. The problem with these is that a threat has to be documented and added to the definition list then sent to the computer running the protection program. Some threats are unknown or it can take a while to get the definition updated so there are always times when a system is vulnerable. For the best protection against malware:
- Do not open emails that promise free money or anything else that sounds too good to be true.
- Do not open zip attachments from anyone unless you verify that they sent you a file.
- Beware of screen saver files either in emails or from less than stellar web sites.
- Be very cautious of any program you download from the internet.
- Keep your browsers updated (Chrome, Firefox, Safari, Opera, IE).
- If you have Java on your computer, be sure to keep it updated.
- Adobe Reader, Flash, and Shockwave should always be kept up to date.
- Email clients should be updated if they are not part of the operating system updates.
- When installing updates or any software be sure to read through the installation screens. Even many good software titles will try to load additional software during an install. Java, and all the free Adobe products try to bring along some other title when you install or update them.
- Using an AdBlock program in your browser can also help block some of the phishing advertisements.
Coming soon more information on why you should be concerned with malware, and why would someone want your information.
I have been working on a series of articles about malware that I hope to publish soon. Today I get a perfect example in the form of an email that looked legitimate at first. I look a little further and see that the from address is not KCPL who is my electricity provider. I have pulled a few lines from the header shown below. The email contained an attachment Energy_bill_april.zip This was the final confirmation that this was in fact a scam. First of all my electric company usually doesn’t send me a file, they direct me to their site to view my bill. But the fact that this was a zip file means I won’t know what’s inside until I open it. That may be too late to stop any possible payload. This is a perfect example of an email you should simply delete.
Don’t be curious and open an attachment like this!
From: “Lottie Hollingsworth” <email@example.com>
Subject: Electric Usage Statement
A Dear customer!
Your latest energy account is now available to view.
Account #: LL/12354216
Bill date: 26/04/2014
To view your most recent account, please revise the attached archive.
Our monthly bill inserts you energy-saving tips, regulatory updates and more.
To unsubscribe this announcement – please change your account notifications settings.