How I Prepare for the Security Threats of Tomorrow

by ⋅ Leave a Comment

There is little doubt that cybercrime is becoming more complex, and ransomware and data breach events are becoming more frequent. As a result, many small business owners have become concerned that they will soon be victims. Some have looked to IT solutions providers, like Heliotropic Systems, to help deal with these evolving threats. That is why it is vital for me to understand the current state and emerging trends of that threat landscape and what tools I can use to combat them.

Let’s look at the cybersecurity landscape and analyze the threats, trends, and opportunities.

Protecting Small Businesses from Ransomware Attacks

Cybercriminals are increasingly targeting small- to medium-sized businesses (SMBs). In 2021, more than 40% of all cyberattacks were against small businesses. Digging deeper into that statistic, researchers have found that of those attacked, approximately 60% will go out of business six months following an attack. The primary reason is that so many SMBs don’t have the resources to support an internal IT and data security operation.

In almost all of my security vendor recent annual reports, the most common threat was ransomware. The second tier threat was data breach. To combat these insidious hazards, I must be proficient in three areas.

Prevention

The primary goal is to eliminate the threat of an attack in the first place. While I fully acknowledge there is no “right” way to do this, there are measures I take to help keep my clients from becoming ransomware victims. I recently added Huntress (a threat detection tool) to my portfolio. You subscribe to SPF+ (for consumers) and SHADE (for small businesses), which enables automated patch management to fix potential vulnerabilities as soon as they are discovered.

Another significant measure is to constantly remind clients that rather than click on a link or respond to a suspicious email, you should call me for confirmation. The other day, someone said they received an invoice for three years of Norton Lifelock. No, they didn’t — they received a scam email. It was de-
signed to obtain sufficient information to make fraudulent charges on their credit card.

Detection

I’d be remiss if I didn’t acknowledge that ransomware can still get through the protection layer despite my best efforts. That’s why I have measures in place to identify when ransomware is present, rather than assuming an attack will never be successful. The earlier I can detect it, the sooner I can take action to eliminate it.

Response

When ransomware is detected, responding to the attack, and eliminating it must be done with the utmost efficiency. Some of the steps I must take include:

  • Scan the network for confirmation of an attack unfolding.
  • Identify the infected computers and isolate them from the rest of the network.
  • Secure all backup data or backup systems immediately.

I feel good knowing I have a significantly positive affect on my clients’ businesses by optimizing ransomware prevention and detecting and quickly responding to attacks. Ransomware attacks were estimated to cost roughly $20 billion in 2021. My aim is to save my clients from suffering any financial damages that would hurt their business.

Finding the Right Tools to Combat Ransomware

All my small business clients trust me with access to critical systems and data. They feel protected because they know I will act swiftly and effectively when a threat arises. To accomplish this, I have – over the years – sought to obtain the necessary tools that will facilitate quick and decisive action.

For example, remote monitoring and management (RMM) provides me with access to your computers so I can keep them secure, patched, and operational. I can proactively fix any vulnerabilities before you are attacked with automated patching, whether it is from Microsoft or third-party vendors, which helps optimize ransomware prevention efforts.

But, again, the idea is always to be prepared if ransomware attacks are successful. SentinelOne takes the next step of ransomware defense by including native ransomware detection. It constantly monitors for crypto-ransomware and attempts to kill the malicious software, thus reducing the impact of an attack. You (and I) get alerts at the first detection of crypto-ransomware, and I can automatically isolate any infected computer.

The ability to detect ransomware immediately enables me to execute an action plan sooner rather than later. And I know ransomware infections can cause extensive damage, which may prove too costly for many small businesses to overcome.

Of course, no ransomware response plan is complete without a system to protect the most vital company resource – its data. Regularly backing up data can reduce the risk of downtime when a ransomware attack is successful, but the backup system must be secure and reliable. The Datto Vaults I deploy at client sites are designed to protect physical, virtual, and cloud infrastructures and data. The data is well protected and easily accessible, so I can recover it rapidly when needed. The Vaults also have software that detects ransomware within backups, saving me (and my clients) time locating the last clean system restore point.

Leveraging Security Services to Help You Grow Your Business

Most of my colleagues will tell you that they are all focused on security on many levels, whether securing computers and networks, protecting data, or understanding how to be better against the threat of ransomware. Security threats will never go away – we can only keep them at bay. I believe I can effectively protect my clients and ensure their businesses thrive with the multi-layered security tools I have deployed.

Thanks, and safe computing!

Anatomy of a Ransomware Attack

by ⋅ Leave a Comment

I don’t know how technologically inclined you are, so I will ask this simple, rhetorical question: What is ransomware?

The answer is: Ransomware is a form of cyber-attack in which criminals take control of your computer’s files and block access to them until you pay a fee to release them.

Cybercriminals gain control of your files by placing malicious software on your computer. They can accomplish this goal in several ways; however, these are the two most common methods:

  • You open an attachment in an email, either a Microsoft Word document or an Adobe PDF file that contains a worm or a Trojan.
  • You click on a link in an email.

Here’s a summary of what happens next.

Once the malicious software is downloaded to your computer, one element will contact a “command and control” server on the internet to obtain a unique key. Another element then executes and uses that key to encrypt your files. To accomplish that task, it takes the contents of your files and turns each one into a mass of numbers and letters that your computer’s programs cannot read. After all that mayhem is complete, one of the rogue software elements sends a confirmation to the cybercriminal.

In some cases, before your files are encrypted, the cybercriminals will copy them to the internet. Part of the extortion message you receive may include a statement that they will release your confidential information to the public. This message is designed to be an added incentive to make you pay “full freight” to get the decryption key. In some reported instances, victims have been known to bargain for a lower fee and have successfully reduced the amount of the ransom.

How Does All This Happen?

Two of the main components that allow ransomware to run wild are Emotet and Trickbot.

Emotet is malicious software that is categorized as a Trojan, which means it appears as something innocuous; however, it carries an undesirable harmful payload. Initially, it was designed to steal banking credentials. Later iterations added features including money transfer and evasive functions.

Emotet arrives primarily in phishing attacks via emails that contain malicious links or Microsoft Word files that contain macros.

Once Emotet is on a computer, it attempts to establish persistence on the computer and then propagates through the local network via spreader modules. When it is activated, it will connect to the command and control server to report a new infection. It receives configuration data, downloads and runs files, receives instructions, and then uploads the requested data to the command and control server. The instructions it receives can launch other forms of malware based on the criminals’ intent and goals.

The fact that Emotet is easily released on an unsuspecting victim makes it a very serious threat. Bad actors can send a phishing email to millions of email accounts. Probability theory dictates that someone, somewhere, will click on the link or download the file and thus become infected. For any business – large or small – all it takes is one email to reach its target, and all the computers in the company could become compromised.

The Cybersecurity & Infrastructure Security Agency (CISA) reports that Emotet “can evade typical signature-based detection.” It is virtual machine aware and “can generate false indicators if in a virtual environment.” This means that the typical “sandbox” features used by some advanced security software may not be able to identify it.

Trickbot is another Trojan that uses various modules to attack a computer. These attacks include obtaining banking credentials and exfiltrating data.
The primary way in which Trickbot establishes persistence is by creating a scheduled task that runs with System privileges. The task is set to run at startup and repeatedly after that. The malware extracts and executes its code before contacting the command and control server. Trickbot’s program contains an initial encrypted list of servers to contact. Once a connection is established, it receives an updated list, and those servers have various modules and configuration files.

After it has started, Trickbot will steal passwords, steal email information, deploy web injections, and spread to other devices on the network.

What Does This Mean To You?

By now, I’m sure your eyes are glazing over, and you are wondering why I am subjecting you to this discourse.

We live in a world of coronavirus now, and unfortunately, the threat and associated risk of COVID-19 is everywhere — and equally, unfortunately, it is not going away any time soon. Cybercriminals will soon be counting on the turmoil and rampant misinformation about vaccines to lure the unwary into dangerous territory.

Wearing a mask, keeping your distance, and washing your hands will help lower your risk of getting the virus. For similar reasons, if you receive an email with an attachment, especially from someone you don’t know, you must always exercise caution!

The steps these malicious programs take on your computer occur extraordinarily fast — usually in less than a minute. You may not know that something terrible has happened until you see the ransom demand on your desktop.

It is because of programs like Emotet and Trickbot, along with others, that you must make sure you use next-generation advanced endpoint solutions to protect your computers and networks.

An Analysis of SonicWall’s Mid-year 2020 Threat Update Report

by ⋅ Leave a Comment

SonicWall, a leading perimeter security vendor, issued a mid-year update to its annual threat report in July. Amid the global disruption caused by the coronavirus pandemic some threat trends are surprising:

  • The number of malware attacks is down by 33%.
  • The instances of ransomware are up globally by 20%, but over 100% in the US.
  • Office files (Word, Excel, and PDF) continue to be used primarily for malicious intent.

There was a huge spike of IoT malware — up as much as 50%.
Also noted, but not at all surprising: Cybercriminals are increasingly targeting the large number of employees who are working from home.

Cybercrime has increased since the start of the pandemic, and the latest targets now include medical facilities, hospitals, and research labs. These focused attacks have two purposes: First, to disrupt normal business and day-to-day activity; second, to obtain research data related to potential vaccines and coronavirus solutions. Nation states – most likely China, Russia, and North Korea – are very interested in obtaining intellectual property. Based on these attacks, it appears to be far easier for these cybercriminals to steal someone else’s work than to do their own.

New, never-before-seen malware variants found in the first half of 2020 increased by more than 60%. This occurred despite the overall decline in the number of malware attacks. From this, we surmise cybercriminals are experimenting to see what version can effectively get through normal defenses.

In the first half of 2020, Office files and PDFs comprised one third of all new malicious files. One of the key takeaways from the analysis of these files is that “threats are becoming more evasive and more nefarious.”

However, ransomware is on the rise. By way of contrast, global ransomware rose 15% in all of 2019. In the first half of this year, despite a global pandemic that constrained most business activity in the second quarter, it is up 20%.

The report notes a very strong correlation between where the coronavirus hit and when ransomware attacks occurred. Looking closely at the numbers, I believe this trend will continue, and the United States is going to experience more cybercrime during the next few months until the rest of the country (particularly the South and West) reduce the number of infections.

One of the scariest aspects of these recent attacks is summarized as follows:

“To make matters worse, many ransomware operators have taken to selling or otherwise releasing company data if the organization refuses to or cannot pay.

“Even for companies that cooperate with the criminals’ demands, the trouble often doesn’t stop when the ransom is paid. Many organizations pay the ransoms, only to find their files are irretrievably corrupted or have been wiped out altogether. Ransomware attacks are so devastating that they’ve forced a number of companies out of business.”

Here is an analogy to put that in perspective. A stranger breaks into your house, steals some of your belongings, and contacts you, offering to sell them back. You agree, and after the items are returned, you find they are damaged beyond repair. Worse, some of the personal documents you kept in your desk drawer have been published on the internet so that everyone can see your financial position. You, as an individual, would be mortified. When this happens to a small business, the consequences are enormous.

In terms of IoT – devices that connect to the internet to provide various services – the first six months of 2020 saw twice the number of attacks as 2019. The report forecasts that the end of the year may show numbers surpassing the combined values of 2018 and 2019.

In the consumer space, IoT devices include: Amazon Echo, Nest smoke alarm, Ring doorbell, various home security systems, smart TVs, and even smart refrigerators. http://iotlineup.com has an extensive list.

In the business environment, IoT devices include: smart locks, smart video cameras, and smart lights and energy management. These components comprise all the security elements of typical building management functions.

What’s the motivation of cybercriminals to attack these devices? They are looking for a “back door” into networks with lower chances of detection so they can deploy other forms of malicious software to compromise the computers on that network. It is essential for both the IoT device manufacturers and people who use them to insist that security considerations should be top of mind for all new devices (older ones are unlikely to be retrofitted).

I don’t think have made any mention of Coinhive in recent editions because I knew it had been shut down in early 2019. But just to recap: Coinhive was a cryptocurrency mining service that installed software in a computer’s web browser to exploit that computer’s resources to mine bits of the cybercurrency, Monero.

In 2020, as if there wasn’t enough anguish, there is a replacement called XMRig, another Monero cryptominer. In June, the US Cybersecurity and Infrastructure Security Agency (CISA) announced that XMRig was among the three signatures that make up 90% of potential threats.

So, there you have it. From SonicWall’s perspective, we were not even half-way through the year and things were already looking pretty dicey from a security standpoint. There is general consensus among security companies that attacks will only increase, and as the coronavirus continues to beat down United States businesses, along with the disruption from the upcoming presidential election, the cybercriminals are not going to stand idly by. They are going to take full advantage of the turmoil, and they will exploit it to the best of their ability.

Thanks, and safe computing!

Cyber Security and Ransomware

by ⋅ Leave a Comment

The Washington Post reports “Massive cyberattack hits Europe with widespread ransom demands.” Updates from The New York Times indicate that this new attack has even spread to businesses in the United States.

Barely six weeks have elapsed since May’s WannaCry ransomware attack, which crippled more than 300,000 computers around the world. It is clear cyber-criminals are increasing their efforts to obtain cash. What we are witnessing now is merely a prelude to even more, possibly terrifying, attacks.

As you know, ransomware is malicious software that takes over the files on your computer by encrypting them and then posting a message telling you that if you want your files back, you’ll have to pay money (ransom) to the cyber-criminals who performed the deed.

The major form of currency for payment is Bitcoin, a block-chain mechanism for payment that provides complete invisibility for the cyber-criminal. It is both currency and a monetary system. Back in January 2017, one bitcoin averaged round $900. Throughout May, when the last ransomware attack took place, prices doubled to roughly $1,800. In mid-June, for reasons that are still unknown, the price skyrocketed to $3,000. And, as of this writing (June 27, 2017), the price is down to $2,374.

What accounts for the price changes? Bitcoin is considered a commodity, and the fact that there are a fixed number of coins available, causes speculators to “bid” and “ask” on the amounts just like stocks.

As for the causes for the recent spate of attacks? A group called the “Shadow Brokers” exposed hundreds of NSA hacking tools earlier this year. Software, with names like “Double Pulsar” and “Eternal Blue,” ended up in the public domain. Once out in the open it became quite clear to cyber-criminals that anyone who could download that code, build out a distribution method, and set up a bitcoin account would be in business rather quickly.

What the perpetuators of WannaCry found out — all too quickly — was that they needed a better back-end support system of “help desk” operators to explain to people how to obtain bitcoins and how to provide payment. In the end, one researcher found a controlling website name, purchased it, and effectively turned off the ability of the malware to “phone home.” As a result, files were not encrypted and the bit-coins did not reach the cyber-crooks. The lack of adequate planning “cost” them hundreds of thousands of dollars.

The majority of computers that were affected in May were running Windows XP, an older operating system that Microsoft stopped supporting in 2014. Yet there were also thousands of Windows 7 computers that didn’t have the April 2017 Microsoft monthly update installed.

There’s the 1999 film quote: “The first rule of Fight Club is: You do not talk about Fight Club.” Well, the first rule of running Windows is: You really have to install your Microsoft updates.

So why, if businesses know these horrifying threats exist, don’t they update their computers? I don’t have an answer for that, because not patching computers doesn’t make any business sense. You can say you don’t have the time or the manpower, but those are not valid excuses. Because the reality is this: if you want to continue to use your computers while these scourges exist, you should invest in an automated means of patching them!

What else should you be doing?

You should be verifying your backups and check that they have all of your data. If one of your computers gets hit, you must have the ability to restore those encrypted files. If you don’t take backups now, then add that to your list of things to do.

Finally, you need to upgrade your security tools. If you only use an anti-virus product that scans for known virus signatures, you are not adequately protected from these zero-day threats. You must have a modern, enterprise-grade, Internet Security product along with malware protection.

What is a small business or individual supposed to do if they get hit with ransomware? For one thing, they should contact the FBI and the local authorities. In 2000, the FBI established the Internet Crime Complaint Center (IC3) at htttp://www.ic3.gov where you can fill out an online form to file your complaint.

In the recently released 2016 Internet Crime Report, the FBI reports the IC3 received:

  • 2,673 complaints identified as ransomware with losses of over $2.4 million.
  • 10,850 tech support fraud complaints with losses in excess of $7.8 million.

Wait; what’s that? Last year, the FBI received four times as many reports of fake “tech support” complaints as they did for ransomware. And those cases cost small businesses and home users three times as much money!

This leads me to conclude that more people fall for the phony phone calls from “Microsoft” saying there are problems with their computers — but are willing to report and admit it — than they are about reporting being a victim of ransomware. Undoubtedly this is because the files that were encrypted were client-related and could cause substantial problems for their business and have ramifications in terms of bad press, privacy breach notifications, and possible law suits.

Where is all of this going to end up? I’m only certain of one thing. Cyber-criminals are going to continue to up the ante because they are going to go where the money is. Consider the bad actor parked across the street from a high-end automobile lot wirelessly loading malware into the electronic control units (ECU) of the cars waiting to be delivered. As security research firm FireEye reports, “a group of vehicles disabled on a busy highway could cause serious disruption. Municipal authorities may have little choice but to pay the ransom to reopen a busy commuting route.”

Every hardware component and computer that relies on software must be patched automatically, your Internet Security software must be enterprise-strength, and back-ups taken and inspected regularly. The threats already exist out there, and they are not going to go away any time soon.

Ransomware Thoughts

by ⋅ Leave a Comment

In a recent article about ransomware and the affect it has on small businesses, the author states that “security experts say the first thing to do after a ransomware event is to upgrade security and backup processes.”

I had to read that twice before I realized how true it was and how erroneous the statement is.  If an IT consultant is taking these steps after the fact, then they have failed to adequately protect their client.  I cannot see working that way – it is backwards, last generation thinking.

You want to engage with an IT consultant who prepares an entire range of security measures for blocking the possibility of ransomware from affecting your small business in the first place.  Implementing heightened security and backup after the fact won’t cut it; security measures have to be implemented before a calamity occurs.

A new proverb in our industry states that “there’s at least one employee in the office that will click on anything.”  And because that is more often true than not, you need more than the standard list of preventative measures in place, which consist of:

  • Making sure you are running a robust security solution (Internet security, anti-virus, and anti-malware)
  • Keeping the operating system up-to-date
  • Avoiding the use of plug-ins (such as Java, Adobe Flash, and Silverlight) in your web browsers
  • Being careful with email attachments and links in emails from people you don’t know

While those steps are usually issued to help safeguard home users, a small business owner also needs to include the following elevated measures:

  • Employing an advanced Unified Threat Management device (firewall)
  • Enabling server and desktop back-up to a local device and the cloud

These additional factors should help obviate the statement made by the sources for the article’s author.

However, the most important step any security-conscious IT consultant must take is to ensure that appropriate employee education takes place on a regular basis.  This is because the ransomware threat landscape is constantly evolving. Cybercriminals have found a highly effective and lucrative approach to illegally making money.  As new forms of socially engineered threats appear, employees must be reminded and their awareness must be sharpened to distinguish between a valid email and a new phishing threat.

If you want this kind of training for your staff, contact me for further information.  Don’t be a victim to ransomware!