Unfamiliar with the term, malvertising is a coined word that describes a growing online practice involving embedded malware, and malicious software attached to company and individual webpages, social media sites, photographs, illustrations, charts, download links, and online advertising. Click on any of this content with malware aboard and your phone, tablet or PC becomes infected.

Since online advertising is big business worth hundreds of billions of dollars annually, malicious online actors happily take advantage of user interest in what is being sold and make content that deceptively entraps you.

You may be familiar with the term phishing. Malvertising is similar and may be combined with phishing in a targeted attack. But I will leave Egline to tell you more and how you can protect yourself from malicious online threats. As always, your comments and questions are welcome.

Have you ever clicked on an online ad that led you somewhere you didn’t expect? That might have been malvertising, where hackers hide malicious code within seemingly harmless ads. It’s more common than you might think. A recent study found that 777 million users may have been exposed to unsafe ads. 

Now, attacks are everywhere, on news sites, gaming pages, and even places you usually trust. One wrong mouse click can infect your devices with viruses or spyware. So before you unknowingly contribute to the statistics, let’s explore malvertising and the simple steps you can take to protect yourself. 

How Malvertising Works

Malware is bad software that nobody wants. Bad actors on the Internet embed it into online content and in malvertising into ads specifically. The ads are designed to do more than just sell you something. They secretly install harmful software on your computer or phone. 

Let’s talk about a few ways hackers use malvertising to mess with you:

• Drive-by Downloads – This happens when you visit a website and, without clicking anything, a malicious program starts downloading to your device. 
• Redirects to Malicious Sites – Sometimes, clicking on an ad doesn’t take you to where you expect. Instead, you end up at a website that looks real but is controlled by hackers. These sites can trick you into giving away personal information or downloading more malware.
• Exploit Kits – These are tools that hackers use to take advantage of weaknesses in your browser. By targeting these vulnerabilities, hackers can inject malware without much effort.

The Damage Malvertising Can Do

Malvertising can cause a lot of trouble. Here’s how it impacts you and what to look for:

• Data Theft – Malicious ads often try to steal your personal information. This could be anything from passwords and email addresses to more sensitive data like bank account details. Once cybercriminals have this information, they can use it to steal your money or even your identity.

• Unauthorized Use of Resources – Some malware turns your device into a part of a botnet. Botnets are networks of private computers infected with malicious software controlled by malicious online actors. This means your computer or phone can be used to send spam or attack other systems without your knowledge.

Now, how do you tell if you’ve been hit by malvertising? Well, your device starts running slower than usual. And you may notice apps or programs that you didn’t install.

How to Protect Yourself from Malvertising

Here’s a closer look at each step you can take to guard against malvertising threats:

Ad Blockers

One of the most effective ways to shield yourself from malvertising is to use ad blockers. They help keep sneaky, harmful ads at bay, making your browsing safer. 

One well-known ad blocker is uBlock Origin. It’s a strong choice for many users because it’s efficient at blocking unwanted ads. However, if you’re using a Mac, uBlock Origin for Safari is unavailable. Don’t worry; there are other options available to Safari users.

A good alternative is AdLock. It’s designed to block ads and protect you from malicious websites, much like uBlock Origin. This powerful tool also shields you from other online snoops that can invade your privacy and security.

Software Updates

One of the simplest defences against malvertising is keeping your software up to date. This includes everything from your operating system and web browser to smaller plugins like Adobe Flash or Java. 

Developers regularly release updates that fix security vulnerabilities. Ignoring update notifications can leave you open to attacks that exploit old weaknesses. So, make it a habit to install updates as soon as they become available, or set your devices to update automatically.

Antivirus and Anti-Malware

Even with careful practices, some threats might slip through. That’s where antivirus and anti-malware software come in. These tools provide real-time protection by scanning and blocking malicious programs before they can do any harm. 

So, make sure that your antivirus software is set to update automatically to protect against the newest threats. And don’t forget to conduct regular full-system scans. This practice can catch anything that might have slipped past the real-time shield.

User Awareness

The most critical tool in your arsenal is your awareness. Malvertisers often rely on deception, ads that look legitimate but lead to harmful sites or offer incredible deals that simply are too good to be true. 

That’s why educating yourself on the common signs of suspicious ads, such as poor spelling, unprofessional visuals, or offers that require unnecessary personal information is essential. Always be cautious when clicking on ads, even on trusted sites, as cybercriminals can infiltrate even the most reputable ad networks.

That’s a Wrap

Malvertising is dangerous. Remember, you have the power to fight back against it! Stay alert, be suspicious of strange ads, and keep your software up-to-date. Always think twice before clicking on ads, and keep your devices secure. Stay safe out there!

The post The Growing Threat of Malvertising And What You Can Do About It appeared first on Techso Mogro.

In recent years, ransomware attacks have impacted organizations of all sizes and threatened the economy, commerce, and public institutions such as hospitals around the world. In a growing trend of attacks, ransomware gangs are encrypting backup files before encrypting live systems, greatly increasing the difficulty of system owners to recover control of their computers and files without paying.

With the year 2021 coming to an end organizations have already spent $20 billion to deal with ransomware attacks. According to recent reports, these cyberattacks have risen 400% since the COVID-19 pandemic started. Average recovery costs in 2021 have reached nearly $2 million per business and recent projections predict that 75% of organizations will face attacks over the next five years. During and after COVID-19, ransomware gangs are expected to continue attacking organizations and represent a continuous and growing threat. 

Malware (malicious software), such as ransomware, makes files and systems inaccessible for users, rendering them unusable. Historically, businesses were able to restore their networks and files by using backups, but attackers have begun encrypting backups before actual working files.

So in order to defend your company against ransomware, your first line of defence is understanding how attackers access your system infrastructure. Simply, they exploit human error to gain access to sensitive information. In order to mitigate human error, therefore, it’s paramount to educate employees and implement cyber hygiene practices, as well as hire highly trained cybersecurity analysts to provide 24/7 monitoring.

Here are the top three ways to protect an organization from ransomware attacks. 

1. Understand your organization’s risks. This requires identifying and managing vulnerabilities. Assess your current network, infrastructure, and digital landscape. This will identify security gaps that you need to fill. Invest in comprehensive security reporting, vulnerability assessment and penetration testing to help efforts to reduce ransomware attacks and other vulnerabilities that need patches.
2. Eliminate your blind spots by reviewing the monitoring of networks and devices, logs, and cloud infrastructure. To achieve cybersecurity maturity, use a holistic managed detection and response (MDR) service, and for real-time monitoring and mitigation, a 24/7 security operations center (SOC). Ensure that all endpoints are covered. That includes smartphones, laptops, tablets, and other devices that often are exposed when taken outside the organization’s safety perimeter.
3. Plan an incident response to ransomware as essential in minimizing losses, preventing future attacks, and responding to threats. To scope, investigate, and orchestrate activities after an incident, you need an incident response plan that includes responders, handlers, and forensic and malware specialists.

Ransomware attacks are getting more sophisticated by the day. To combat such cyber threats, you’ll need to strike the right balance of socially engineering employees, implementing expertise, and arming your organization with the technologies that can support the effort.

The post The Growing Threat of Ransomware appeared first on Techso Mogro.

In recent weeks cybercriminal attacks on businesses and government have made U.S. and global headlines.

In February 2021 a water treatment plant in Florida was hacked briefly compromising the water supply to Oldsmar and its surroundings.

In March, a large U.S. insurance company, CNA Financial Corp., was locked out of its computer network for two weeks.

In April, the NBA’s Houston Rockets were hacked with contracts and confidential documents stolen under threat of public release.

In May the Colonial Pipeline had to shut down its operations causing gasoline shortages in the Eastern U.S.

In June meat manufacturer, JBS S.A. was breached and ceased operations for two days.

And this month an IT company, Kaseya, providing systems services to 17 countries, was hacked with a ransomware pay demand for $70 million US.

These are the most noteworthy cybercriminal attacks of 2021 and follow 65,000 successful reported network and system breaches in 2020 with $350 million in ransom payouts to the hackers.

Coveware, a company that helps ransomware victims to pay off cybercriminals, has steadily reported an increase in payouts to hackers. In the third quarter of 2019, it had reached more than $41,000 per attack. In 2021 with the latest ransomware attacks, payouts are getting much steeper.

What is Malware?

Malware describes a wide range of cybercriminal tools designed to exploit weaknesses in home, business and government computer systems with botnets leading the way to deliver ransomware and crypto mining payloads.

For computer users two positive trends have emerged of late:

• the number of malware files per device on home computer systems has been on the decline.
• businesses, because they are becoming increasingly aware, have implemented more layers of cybersecurity defence.

Nevertheless, in its report Webroot notes that 12.6% of home computer systems encountered infections, while 7.8% of businesses had infected personal computers in 2019.

What was most often found after dissecting these attacks?

Botnets and ransomware including the following:

• Emotet has been the most prevalent botnet since it emerged in 2014. Its origins are Ukraine. It is also known as Heodo and is used to deliver a variety of malicious payloads to vulnerable computer systems. It is a great companion to ransomware malware.
• Trickbot is a botnet that partners with banking trojan malware such as IcedID and Ursif. Its modular infrastructure makes it a serious threat for any network it infects. When combined with Ryuk (see below) ransomware, it can be devastating to victims.
• Dridex was once one of the most prominent botnet banking trojans. Now it acts to implant Bitpaymer ransomware.
• Ryuk is ransomware that locks files or systems and holds them hostage for ransom. It is also known as Hermes and is attributed to CryptoTech, a cybercriminal group.
• Gandcrab provides cybercriminals with ransomware-as-a-service (RaaS) and demands cryptocurrency as payment. It has been decrypted and as a result, has evolved five different iterations to confound those attempting to defend against it.
• REvil is Gandcrab’s successor after decryption. It also goes by the name Sodinokibi and was responsible for the recent hack of the meat producer, JBS, and collecting an $11 million US ransom.
• CrySIS, also known as DARMA, is ransomware that most often is distributed to unsuspecting hosts via spam email attachments. It also disguises itself as installation files for well-recognized and legitimate software making the computer and systems users believe it can be downloaded and is safe.
• In a recent attack, CrySIS was delivered as a download link in a spam email. The link pointed to a password-protected, self-extracting bundle installer. The password was given to the potential victims in the email and, besides the CrySIS/Dharma executable, the installer contained an outdated removal tool issued by a well-known security vendor. The typical ransom demand is a payment of one Bitcoin (currently over $33,000 US).
• Hidden Bee is a trojan bot that delivers cryptomining payloads to unsuspecting computers inside JPEG and PNG images, as well as WAV Flashplayer media. Its origin is China. It takes over some of the infected system’s capacity to mine cryptocurrency, diminishing the computer’s performance.
• Retadup is called a malware worm that infects Windows-based computer systems. It like Hidden Bee hijacks the host to do cryptomining which seriously diminishes performance.

Cryptomining and cryptojacking when compared to ransomware are seen as less threatening because no money exchanges hands. But companies need to remove these malware infections immediately upon identifying them because they bleed system performance over time. They can even creep to company websites not using Hypertext Transfer Protocol Secure (HTTPS) explained further down in this posting. In 2019, 8.9 million sites on the web were found to host cryptojacking scripts.

Other crypto miners to come and go include Coinhive, Cryptoloot, and CoinImp.

Inbox Vulnerabilities

Email is the route for most malware to infect computer systems. Whether it comes from social engineering strategies like phishing, or from hidden bots, and ransomware in attachments, this is the preferred and easiest way for cybercriminals to gain access. The greatest vulnerability threats come from:

• Office Colleagues and not hackers. Poor password and authentication procedures leave users and companies open to cybercriminals.
• Spurious email comes in the form of deep fakes that target individuals. Spoof email accounts can impersonate colleagues. Unsolicited gift card offers can be a hidden trap. In 2019, these types of emails increased by more than 100%, and over the last three years, led to $26 billion US in thefts.

In 2019 phishing attacks grew sixfold. The most vulnerable companies included Google, Chase, Microsoft, Apple, Dropbox, PayPal, Adobe, Wells Fargo, Amazon, Netflix, Instagram and Yahoo. Sure reads like a “who’s who” of company heavyweights.

High-risk URLs and IP Addresses

Did you know that one in four malicious URLs are hosted on non-malicious sites? These infiltrations occur because of poor access control practices for adding web content. Why do cybercriminals try this strategy? Because they know that it is difficult to block content placed on an otherwise legitimate website.

The easiest way to ensure a website is less prone to being infected by hackers is to adopt HTTPS, Hypertext Transfer Protocol Secure, which is an extension of the Hypertext Transfer Protocol used for secure communication over the Internet. HTTPS encrypts the communication protocol using Transport Layer Security, formerly known as Secure Sockets Layer. Despite the known vulnerability to hackers, however, more than 22% of web addresses still do not use HTTPS addresses.

Then there are cybercriminal attempts to penetrate IP addresses, the unique representation of specific networks, computers, and other connected devices on the Internet. Cybercriminals take advantage of weaknesses in the existing IPv4 protocol. It was thought that with the widespread adoption of IPv6, such attacks would lessen. But in fact, they have increased with a proliferation of malicious IP addresses that if a user connects to exposes his or her computer or systems network to hackers who then find a way to get in.

Mobile Apps

Whether you are Apple or Android, apps malware is on the rise. It is not as prevalent as what is found in the Windows PC world but it is a growing phenomenon. The Google Play Store has been particularly vulnerable to Android malware occurrences. In 2018, Google estimated the probability of downloading a potentially harmful app was 0.64%. Since then Google has found 17,000 Android apps infected with malware. These have been pulled off the site.

Apple has fewer security lapses on its App Store than Google because it has greater control of its development environment. But even here malicious apps have snuck in. In 2019, 18 were discovered by Wandera, an Apple security software provider.

A Final Word

There will never be perfect security for computer systems and networks. The human element in the equation is too strong. States Hal Lonas, Senior Vice President and Chief Technology Officer at Trulioo, a global identity verification company, “Ultimately, there is no silver bullet, there never has been, and there never will be.” But we can achieve a degree of cyber resilience which will be the subject of a future posting here at Techso Mogro.

Postscript Update

The Russian-situated ransomware organization REvil, identified by U.S. intelligence as responsible for attacking a number of American companies, after a summit meeting between Presidents Biden and Putin, in which the former demanded the latter to shut down it among a number of others, went dark suddenly this week according to The New York Times.

Another Russian group, Darkside, which attacked the U.S. Colonial Pipeline has also gone dark for the moment.

The remaining questions are:

1. Did Putin order these two ransomware sites to cease operations?
2. Or did American countermeasures do the trick?

If the latter, this marks the beginning of a war with no bullets fired, just code and countermeasure code. And knowing how software runs almost everything in our 21st-century world, this new war front is broad and harder to defend. Let’s hope it doesn’t escalate.

The post Malware, Bots, Ransomware, Cybercrime and the Future of Interconnectedness appeared first on Techso Mogro.

Last Friday as I was writing a blog I suddenly realized just how dependent I had become on networked knowledge and the level of frustration and alarm that I felt when suddenly the sources of that information were being denied to me. At first I thought the reason I couldn’t connect was related to a browser error. So I saved my work, shut my browser down, tried a different one and started working again. But as I tried to connect with familiar sites the same messages came up telling me they were inaccessible.

That’s when I went to Google news sources and found out that I was witnessing a massive attack underway on a key piece of the Internet providing services to hundreds of websites. One of those sites was Twitter, another PayPal, another Amazon.

The type of attack is called a Distributed Denial of Service or DDoS. It consists of the simultaneous issue of millions of visit requests to targeted websites causing the hosting servers to become overwhelmed by the traffic and crash. Normally a DDoS attack originates from a user with malicious intent to break a company or service online. The user harnesses hundreds or even thousands of computers by infecting them with malicious code which is time triggered. But on Friday the attack didn’t come from computers. Instead it was non-computer devices connected to the Internet, what we collectively call the Internet of Things (IoT).

What are these Internet-connected things?

They are smartphones, smart TVs, security cameras, digital video recorders, smart thermostats, fridges and coffee makers. They are sensors in factories. They are controllers that turn the lights on and off in your home and increasingly assist you in your daily life by automating things domestic.

So how could such innocent and innocuous devices cause a DDoS?

Because these devices when built are designed to connect to the Internet. They come with default security, default passwords and user names. They come with instructions to users that tell them to personalize the information. Often users get notified of a software patch they need to upload to their device. But how many users update the software that resides in an Internet-connected fridge or coffee maker?

This Internet of Things is a Trojan Horse that can be exploited by hackers.

That’s what happened on Friday. Many millions of IoT devices targeted a specific Internet hub provider, Dyn, taking down its servers.

The malicious software code or malware that infected the devices used in the attack has been identifie as Mirai. The source code for Mirai can be found by anyone on the Internet. What Mirai does is seek IoT devices with factory-default user names and passwords and gets passed this base security. It then repurposes the devices to create Internet traffic aimed at targets.

A single product, a security surveillance camera, produced by a Chinese electronics company, XiongMai, found in many other security product offerings, is the suspect source of the Mirai infection. The webcam you use on your desktop computer, or the one in your laptop could just as easily have been penetrated by the malware used in this attack. So in effect you or I could be unwilling agents to the DDoS that felled Dyn’s services last Friday. And you will never know unless you registered the warranty for the device and receive regular notices of software patches or security updates.

Throughout Friday the DDoS attack spread across the United States and Canada and we were treated to maps (see image below) that showed the extent of its reach.

The attack was not the first and will not be the last. Companies and institutions that are the backbone of the Internet report increasing attacks. They are getting bigger and lasting longer. The attacks appear at times to be probing efforts to discover weaknesses in the security of sites they target. The longer an attack lasts the more a site reveals its defenses making it more vulnerable to future penetration.

So who wants to break the Internet? Are these state actors, individuals, or competitors to companies they target?

Are the attackers the same group stealing communications, emails and other forms of information from government, NGOs and company servers?

And what can be done about the rapid growth of IoT?

How do you stop consumers from loading up on devices like smartwatches, fitness trackers and a seemingly endless number of wi-fi gadgets that connect to the Internet?

What do you when the gadgets and control systems in cars, trucks and airplanes are all connected to the Internet?

The IoT is growing at a rapid rate with billions of devices already in place. In a recent BI Intelligence report it stated the following:

• The number of IoT devices in 2015 equaled 10 billion
• The number of IoT devices by 2020 will equal 34 billion with 10 billion incorporated into traditional computing technology
• Companies will be the biggest users of IoT incorporating devices into manufacturing production, warehousing and logistics
• The second largest adopter of IoT will be government

Knowing what happened last Friday and that IoT adoption is exploding across the planet should be a wake up call to governments, industry and consumers about the importance of implementing best security practices.

Defending the Internet is a global priority.

Related articles across the web

• East coast Internet service attack resolved
• How massive DDoS attacks are undermining the Internet
• How your smart device caused the internet to crash and burn
• Twitter, Spotify among sites disrupted by cyber attack

The post Last Friday I Couldn’t Tweet – Defending the Internet is Key to Our Future appeared first on Techso Mogro.