Cybersecurity blog posts
Computers cannot survive by anti-virus software alone
Published February 06, 2014
Over the past few weeks, several widely knows companies have been competing for top spots in many of the major news headlines but, for all the wrong reasons. Retail giant Target, to offer just one recent example, could be forced to pay millions of dollars to cover the direct damages incurred from the recent malware-related data breach that enabled cyber-criminals to steal credit card data from all Target point-of-sale systems located within the United States and Canada. While financial loss is certainly a major concern, the massive hit they will take to their reputation could be incalculable for years to come.
It’s no secret that one of the biggest challenges facing any business is protecting against malware attacks and other cyber-crimes. This recent string of cyber-attacks are some of the biggest (that we know of) in history. They were so massive that the FBI has recently issued a special warning aimed at businesses to tighten up their cyber security infrastructure.
It’s common for most people to say to themselves “As long as Antivirus software is installed and up to date, a computer will be protected.” That’s no longer the case. What worked before doesn’t work now. Standard Antivirus programs are no match for the new zero-day malware outbreaks that are now commonplace in the world of computing. With all of the complex attacks being developed and altered on a daily—sometimes hourly basis, just having Antivirus software installed isn't enough.
Nowadays IT security experts recommend adding a dedicated anti-malware layer to existing endpoint security software to block the barrage of constantly looming cyber threats. That’s why here at New River Computing, we’ve recently started offering Malwarebytes Anti-Malware Enterprise Edition as a part of our overall security portfolio. During our vigorous pre-deployment testing phase, we found that by adding the power Malwarebytes to our current deployments of VIPRE Anti-Virus, the combo proved to be unmatched in catching new vulnerabilities, PUP’s (potentially unwanted programs) and zero-hour malware on live client machines. There’s no better real-world test than that!
Below is a partial list of benefits our clients can gain by adding the power of Malwarebytes to their existing security strategy:
- New River Computing will be able to identify and respond to malware threats in real-time.
- Compatibility with VIPRE Anti-Virus and most other major endpoint security products.
- Detects zero-hour and known Trojans, worms, rootkits, adware, and spyware in real-time.
- File execution blocking prevents malicious threats from executing code and quarantines them.
- Real-time malicious website blocking prevents access to and from known malicious IP addresses.
- Ensures data security and network integrity. Reduces IT helpdesk tickets, ensures user productivity.
- Protects users from downloading malware, hacking attempts, redirects to malicious websites, and “malvertising.”
- Reduce endpoint and network downtime due to malware remediation.
- Prevent data theft.
In addition to all of these benefits, New River Computing can also leverage the power of Threat View to monitor security stats in real-time. It affords us the capability to aggregate the data necessary to evaluate potentially malicious threats on client networks and track user access to potentially malicious websites. Data is streamed to us in convenient chart formats for more efficient security assessment and analysis. We can also track malicious activity on networks by IP address and user login.
You can see why all of these benefits are a must-have in regards to strengthening existing security infrastructures. To find out more about implementing Malwarebytes Anti-Malware technology in your business, please contact Shana, our Business Development Manager and she will fill you in on how easy it is to get started.
Stay Safe!
The CryptoLocker virus is spreading!!!
Published November 11, 2013
There’s a new type of malware that has been spreading like wildfire over the past couple of months called CryptoLocker. Most security researchers are claiming that this is one of the nastiest and most successful computer viruses ever: CryptoLocker is currently infecting Windows operating systems all across the United States and in other parts of the world. The virus is part of a generically named family of malware called “ransomware,” and its main function is to encrypt your files and “hold them hostage” until you pay a fee to have them decrypted.
How does CryptoLocker infect computers?
The CryptoLocker virus is passed around in emails that include attachments. The criminals send emails claiming to be from well-known companies like UPS, USPS, PayPal or FedEx in order to trick users in to thinking that they are legitimate and safe to open, but of course they aren’t safe at all. Instead, when a user attempts to open up the attachment, the computer becomes infected and the virus locks files on the system until the ransom request is paid. Most often the attachments will be disguised as JPEG images, ZIP files, PDF files and various types Microsoft Office files (mostly Excel and Word documents).
After a computer becomes infected, users are given 100 hours to pay a fee between $100 and $700 to get the files decrypted. The version of the virus that we’ve been seeing on infected machines have been asking $300 dollars for the decryption key. So far, it appears that the virus only encrypts data files with certain extensions, including Microsoft Office, OpenOffice and other documents, pictures, and AutoCAD files.
How to prevent your computer from becoming infected by CryptoLocker
The file paths that have been used by this infection and its droppers are:
- C:\Users\
\AppData\Local\ .exe (Vista/7/8) - C:\Users\
\AppData\Local\ .exe (Vista/7/8) - C:\Documents and Settings\
\Application Data\ .exe (XP) - C:\Documents and Settings\
\Local Application Data\ .exe (XP)
In order to block the CryptoLocker and Zbot infections, certain Path Rules have to be implemented within the system so that they are not allowed to execute. There is a manual process to create these Software Restriction Policies easily, but thankfully a company called FoolishIT has created a utility called “CryptoPrevent” that automatically adds the appropriate series of Software Restriction Path Policies to a computer in order to prevent CryptoLocker and Zbot from being executed.
If you get an email that includes any type of attachment, use extreme caution and make sure you know who the sender is BEFORE opening it. If you don’t know who the sender is, or if it appears to be from one of the companies mentioned earlier DO NOT OPEN IT!!! Just delete the email. If you start seeing the CryptoLocker demand screen, please shutdown your machine immediately and call your IT administrator for further assistance. If you’re a current New River Computing client, please contact us ASAP if you see the CryptoLocker message on your screen.
Below is an example of what the CryptoLocker demand screen looks like.
How to use the CryptoPrevent Tool
One important feature to make use of in CryptoPrevent is the option to whitelist any existing programs in %AppData% or %LocalAppData%. This is a useful feature as it will make sure the restrictions that are put in place do not affect legitimate applications that are already installed on your computer. To use this feature make sure you check the option labeled Whitelist EXEs already located in %appdata% / %localappdata% before you press the Block button.
It is available from the CryptoPrevent download page.
Once you run the program, simply click on the Block button to add the Software Restriction Policies to your computer. If CryptoPrevent causes issues running legitimate applications, then remove the Software Restriction Policies that were added by clicking on the Undo button.
More Information:
For a detailed analysis of the CryptoLocker virus please check out this excellent Bleeping Computer CryptoLocker article .
Detailed information on the CryptoPrevent tool developed by FoolishIT's CryptoPrevent page.
Cyber Crime vs. Cyber Defense
Published June 03, 2013
After reading an article on the Huffington Post the other day, I started thinking about the fact that we really ARE now living in a world where BIG DATA = BIG BUSINESS = BIG MONEY. With more and more people paying bills, shopping, banking and socializing on the internet, there are going to be obvious financial losses to individuals and organizations. The article prompted some further sleuthing, which led to some eye-opening statistics.
Below is a brief summary of data showing the difference between what cyber criminals are estimated to steal in a given year and the money being spent to protect against their digital crimes.
Cyber Crime:
Fake Antivirus - $97M
Users get a message warning them that their computer has been infected with malware. When they click on a link to download antivirus software, their machine is infected. An analysis of financial records from three criminal gangs found that from 2008 to 2010 they collectively earned $97 million annually.
Stranded Traveler - $10M
Hijacked e-mail accounts are used to ask friends for money, claiming to be stranded traveling abroad. According to an analysis from several major e-mail service providers, criminals receive between 1-5 payments a day, on average.
Online Banking Fraud: Malware - $370M
Cyber criminals target businesses and individuals using malware to capture passwords, account numbers, and other data to get into online banking accounts. As of September 2011, the FBI was investigating 400 cases of “corporate account takeover” where criminals stole $85 million.
Online Banking Fraud: Phishing - $320M
Online banking fraud is sometimes carried out in a phishing attack, in which criminals impersonate websites to get unsuspecting users to provide their login credentials.
Cyber Defense:
Bank Countermeasures - $1,000M
Banks often hire companies to conduct penetration testing to ensure that their IT infrastructure is up to the standards of being secure. They also many times pay companies to search for and eliminate bogus websites used in phishing attacks. There are also additional internal security costs, such as authentication programs, UTM appliances, Firewalls, AV software and systems for generating one-time passwords.
Antivirus - $3,400M
It’s currently estimated that between 74-88% of all households with a broadband subscriptions use some form of antivirus protection.
Patching Vulnerabilities - $1,000M
Software companies constantly patch their products against vulnerabilities that can be exploited by malware. Some evidence suggests that the development cost of a single patch for key enterprise software can run up to $1 million. Deploying that patch is equally costly.
User Cleanup - $10,000M
When antivirus programs fail, aren’t updated regularly or are just used incorrectly (if at all), users often times have to call on the help of a professional computer technician to clean up their PC. This type of service usually costs between $99-$300 dollars depending on the severity of the infection.
Business Security - $10,000M
Companies use a variety of tools to fight cyber-crime including firewalls, intrusion detection systems, software maintenance/patching, deployment, and user training.
Law Enforcement - $400M
The U.S. spends nearly $200 million a year to fight cyber-crime. This accounts for half the law enforcement work worldwide.
These number are staggering to say the least. I think it’s extremely important for end users and organizations to work together with security experts and IT professionals to put all of the necessary security measures in place to combat against system vulnerabilities. Also, it’s important that folks “in the know” educate other users on how to stay safe online. Through collaborative efforts and commitment to deploying aggressive multi-layered security policies, there is hope that the cyber-crime epidemic can one day be contained.
‘Microsoft tech support’ scam captured on video
Published April 11, 2013
For those of us working in the IT industry, we get used to removing viruses and malware from plenty of machines on a regular basis. Malware is a huge problem that seems to only be getting worse. Part of the problem is a lack of education for the end users. It’s easy for the less tech savvy to get tricked into downloading a piece of software that disguises itself as legitimate piece of software (Java, Flash, Adobe etc.) While browsing the internet, users can also get tricked or scared into downloading and installing “Fake AV” programs that look legit, most times copying the GUI (graphical user interface) of popular Anti-Virus programs (AVG, Norton, Microsoft Security Essentials, ESET etc.) by thinking that their computers are infected.
I can understand how confusing all of this is for end users. Being bombarded with ads and scams online constantly can be overwhelming for the casual computer user. Luckily, places like New River Computing able to help folks clean their machines and equip them with software to thwart off these attacks by using good, reputable AV programs, such as VIPRE and Malwarebytes, and using managed service software to keep machines patches and up-to-date. We also recommend users operate under a “user account” instead of an “admin account”.
Having a good AV program installed is certainly important, as well as being mindful of pop-ups and shifty websites. But, one thing AV software can’t protect a computer from is a fake Microsoft technical support phone call scam. These types of scams have been going on for several years but, seem to be increasing in popularity. Criminals are finding that, while more and more people are becoming educated on how to avoid scams on the computer, they are succeeding in scamming people over the phone in to downloading malicious software. Having someone call your house and act like a Microsoft Representative, telling you that your machine is infected and at risk can be pretty alarming. The purpose of these calls is to get an easy $299 (or whatever amount they choose) by scaring you into thinking there’s something really wrong with your computer and that they can fix it for you.
Fortunately, the methods used by some of these criminals to dupe users were recently captured by Jerome Segura, a senior security researcher at anti-malware company Malwarebytes. The video demonstrates the kinds of tactics used by these scammers to trick users into allowing them to remote in to your machine and take it over. Segura played along with the caller and recorded the entire interaction in a YouTube video. These scams usually start off with the alleged Microsoft representative asking you to turn on your computer to perform some checks for errors. They essentially ask you to open different applications which aren’t typically known by regular users, then tell you that the files you are looking at are malicious viruses and spyware. Usually, these are just event log files and/or temp files—neither of which pose any threat to your computers’ security.
I highly recommend watching this video. Pay attention to what the scammers asks Jerome to do and notice how strange the callers are act when he asks questions. And also, just for the record, Microsoft will NEVER call a user to let them know that their machine is infected…NEVER! That’s not how they operate. To avoid being the next victim, don’t ever take a phone call from someone who claims to be from Microsoft tell you that your machine has a problem. And also, make sure that your computer is up-to-date, remove unwanted software and also use a good anti-virus solution.
Stay safe and be skeptical!
Ransomware attacks appear to be getting worse
Published January 22, 2013
For those of you not familiar with exactly what Ransomware is/does, here’s the current Wikipedia definition:
“Ransomware comprises a class of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator of the malware in order for the restriction to be removed. Some forms of Ransomware encrypt files on the system’s hard drive, while some may simply lock the system and display messages intended to coax the user into paying.”
Over the past 6 months, New River Computing has been getting more and more phone calls from businesses who’ve been attacked by some form of Ransomware Virus. While desperately trying to find a solution, most of these businesses (many in other states, North Carolina, Atlanta Georgia, and even one business from Kalamazoo Michigan who called in yesterday) searched the web for answers and stumbled across an old blog post that we released on the subject back in April 2012: http://newrivercomputing.com/blog/computer-virus-outbreak-alerts/latest-ransomware-anti-child-porn-spam-protection/.
How would you react if you were attacked by Ransomware? Do you have a backup plan? Do you have a backup machine or server in place? What would you do if someone gained access to your computer or server, encrypted all your photos, business files, financial documents and other hard (if not impossible) to replace files and then demand a ransom for their return?
In a perfect world, all you would have to do is restore your machine from a recent backup. But, since this isn’t a perfect world, and a lot of people don’t keep recent backups. Some people don’t even back up at all. If you fall in to the “not in a perfect world” category, don’t panic just yet if you’ve been a victim of Ransomware. If you have recent backups, you can stop reading here and just go restore your machine using your most recent image. If not, well then, roll up your sleeves, keep reading and get ready for some work! This might not be easy…
Here’s a detailed list of steps and tools that I’ve put together based on the most up-to-date research from industry leading security companies on the subject of remediating Ransomware:
***Be warned: there’s no guarantee that any/all these methods will work. Every Ransomware attack situation is different and there are many different variants. These steps are meant to be used as a last resort before giving up and reformatting a machine. ***
Remove Ransomware with HitmanPro Kickstart
You can use HitmanPro Kickstart to bypass the Ransomware infection and access your computer to scan it for malware.
- We will need to create a HitmanPro Kickstart USB flash drive,so while you are using a “clean” (non-infected) computer, download HitmanPro.
- Insert your USB flash drive into your computer and follow the instructions from the below video:
- After you create the HitmanPro Kickstart USB flash drive, insert this USB drive into the infected machine and start your computer.
- Once the computer starts, repeatedly tap the F11 key (on some machines its F10 or F2), which should bring up the Boot Menu, from there you can select to boot from your USB. If your machine doesn’t support booting from USB, you can download the HMP ISO files here and burn a CD that you can boot from.
Next, you’ll need to perform a system scan with HitmanPro as see in the below video:
Kaspersky WindowsUnlocker to fight ransom malware
Kaspersky WindowsUnlocker utility is designed to disinfect registries of all Operating systems on your Computer.
Start Computer from Kaspersky Rescue Disk with Kaspersky WindowsUnlocker
1. First download the Kaspersky Rescue Disk with WindowsUnlocker ISO image from Kaspersky Lab Server to your Computer and burn it to CD/DVD.
2. After successful creation of Kaspersky Rescue disk 10, insert the disk into CD/DVD Rom drive and boot your machine from it.
3. A message appears on press any key to enter the menu, press any key – start up wizard loads with graphical user interface select English or other language.
4. Select graphic mode and press Enter, End User license agreement appears on screen agree it to by pressing C key on your keyboard.
Linux OS now starts and detects the devices and OS installed on your system.
Launching Kaspersky WindowsUnlocker
Once you’ve booted Rescue disk in graphic mode, click on Start button located at the left bottom corner and select Kaspersky WindowsUnlocker item.
More steps and information can be found here if needed.
Use the Dr.WEB search tool for unlock codes found here.
Using the Sophos Ransomware Decrypter Tool
Before You Begin:
- You will need at least one original file and an encrypted counterpart, they must be identical in file size and known to have been originally the exact same file.
- The tool should be ran as a user with Administrative rights.
- The requested un-encrypted file must be larger than 4KB.
When the tool has checked the provided encrypted and unencrypted file, the scan that follows should then be able to restore the discovered encrypted files in the specified scan location and below.
What To Do:
- Download the Sophos Ransomware Decrypter Tool:
http://downloads.sophos.com/misc/RansomDecrypter.zip - Extract the contents of the Zip file into a folder of your choice.
A file calledRansomDecrypter.exewill be extracted. - Launch the application
RansomDecrypter.exe, read and accept the End-User License Agreement. - Click Start Scan, this will prompt you to locate a copy of an un-encrypted file that is larger than 4KB. Once the file has been located and selected click Open.
Note: The file you choose must also have an encrypted counterpart for the scan to be able to run. - The next prompt will ask for a copy of the same file selected previously but in an encrypted state, this file will normally follow the format of
locked-<original filename>.<random 4 character extension>. Once located, click Open once again. - If successful, another prompt will appear, click OK.
- Select a location where you would like the tool to scan for encrypted files, if you are unsure where the files are, you should start with the C: drive under My Computer.
Note: The tool will intentionally skip locations where the malware does not encrypt files. - On completion a summary will appear stating how many files were scanned and how many were unlocked. A log file with the results is also created in the same location as the tool as
RansomDecrypter-1.0.0.3-YYYY-MM-DD_HH_MM.txt.
How did I get this Ransomware?
The Ransomware virus gets into systems through various security holes and vulnerabilities found when users visit infected websites or download infected files and emails. If you ignore Windows updates and 3rd party software updates for software such as Adobe, Flash and Java then you will be much more vulnerable to attack.
Ransomware appears to be a strong moneymaker for online criminals. So don’t expect it to go away any time soon. Be careful, keep your software patched and your Anti-Virus definitions up to date.
Have fun, be safe, and stay informed. Happy surfing!