Microsoft began notifying Outlook.com users of a 2019 security breach that occurred between January 1st and March 28th. Hackers were unintentionally given unauthorized access to some accounts, where they were then able to view subject lines, email addresses, and folder names. While no login details—including passwords—were directly accessed as part of this breach, Microsoft did warn users to reset their passwords.
Although the hackers could not view the actual content in the bodies of emails nor download attachments, this incident still represents a major—and disturbing—security incident. This breach serves as a reminder to every business to tighten up its security measures and protect its assets.
Use multi-factor authentication.
Do not leave this as an optional measure for your employees; require it. Multi-factor authentication uses more than one form of identity confirmation—this is the “multi-factor”—to prove the identity of the person attempting to access a particular platform—this is the “authentication.”
Depending on where in the product the Microsoft breach happened, multi-factor authentication could even have possibly prevented or limited the breach. In general, this authentication process adds a strong layer of security. Hackers don’t usually have both the password and the PIN, secret questions, or other ability to verify their identity.
When vetting which type of authentication to implement—if you have this option—consider using the one that is easiest for employees to have on hand, but hardest for others to get a hold of. Trying to make this relatively convenient for your employees will make it easier for them to comply, which will keep your business more secure. Multi-factor authentication is a measure that should go hand-in-hand with training your employees to use strong passwords.
Account for all devices—including mobile—in your security processes.
Very few companies still limit employee access to business assets strictly to desktops at work. There is a growing trend of employees being able to work remotely, even if it is not full-time. A recent study showed that as many as 70% of employees work remotely at least once a week. Whether working from home, a rented office space, or on-the-road, they are using their devices to log in from a distance, well beyond the secured confines of your office. This figure was accounting for full-time employees; contractors only increase the number of remote workers further.
The security processes implemented at your company needs to account for how all of your employees are accessing company resources. Email access on mobile devices is one of the most common ways in which employees take their work on-the-go, and so it’s a strong starting point for building out these protocols. Because confidential company information is being accessed on these devices via networks over which companies have no control, it is critical that both the email servers as well as the devices being used have robust security systems in place.
While new improvements continue to roll out to tackle these issues, solutions that work across all devices are the norm. Security software, as well as encryption tools, can help protect data regardless of the device, particularly when combined with encouraging employees to log-in via secure VPN networks. Cloud options for data storage are offered by providers with a menu of security options; it’s worth walking through your needs and investing in top-quality solutions.
Document your security processes.
With all of the work that goes into developing security processes, even more needs to be carried out to maintain their implementation and ensure that they remain up-to-date with new tech trends and emerging risks.
This is a vast and complex undertaking. All existing assets must be brought onto any updated infrastructure. Employees must be set-up for and onboarded to the security procedures, and checkpoints must be established so that their compliance may be monitored. Systems must be monitored for any breaches, as well as smoothly updated across all users and data to accommodate any new vulnerabilities that arose since the previous update. Different components, whether hardware (including different devices, such as mobile) or software, may experience issues with any updates. New members of the internal information technology must be introduced to the systems while existing members must stay abreast of any new developments; even team members working simultaneously on the same project must address potential communications issues.
Thorough documentation of processes helps achieve this by providing an objective record of the systems in place. This can be used for onboarding; for internal audits; for evaluating alternatives or potential improvements; and even for reviewing the source of vulnerabilities and providing accountability should an issue arise. This sort of record-keeping is an essential component of transparency in company policy and helps enforce quality control on internal processes. Of course, it must also be protected with the highest measure of security since it arguably contains “the keys to the castle.” Decentralizing its storage and scattering protected, encrypted components of it across multiple storage solutions can help protect company assets from the sort of large-scale breach that could otherwise bring your data assets to their knees.
And so, the large-scale Microsoft breach serves as a reminder that active vigilance must always be maintained over internet security, without relying entirely on one single individual, provider, or service. No single entity can be trusted to be entirely safe when major players like Microsoft are clearly vulnerable, despite the teams of brilliant engineers hired to implement safeguards and the millions of dollars invested in diverse preventive measures. Every business needs to be proactive in protecting itself through rigorous internal standards, ranging from staff training through the implementation of mandatory security precautions, to minimize the risk of vulnerabilities being exposed and exploited. Factoring in every employees’ data paths and employing multiple layers of overlapping security efforts at every step of the way—and documenting these processes for easy internal accountability and refinement—are critical for business informational security in this highly connected digital age.
Firewalls were developed over thirty years ago and function as the first line of defense for many business networks. This piece of network equipment is a perimeter defense that determines whether packets can move into or out of the network. While the basic concept of a firewall is simple, the way that it performs this function and the features it offers continue to evolve based on current threats.
Types of Firewalls
Firewalls come in two major categories: hardware and software. The physical firewalls are network appliances that connect to the rest of the IT infrastructure so it’s able to monitor packets. There are several methods they can use to secure the network and assist with thwarting potential intruders.
Stateful firewalls retain information about the connections being made. It offers good performance because this technology allows it to skip inspecting every single packet. Once it has inspected a connection, it allows it for subsequent packets.
Application-level firewalls that are hardware based are designed to protect the application’s connections. They address common attack methods used on that type of application, such as stopping cross-site scripting for a web application.
When someone thinks about a standard firewall, a proxy firewall is most likely what’s on their mind. It stands between a host device and the data source and inspects the packets that are sent between them. This type of firewall may not stand up to complex attacks due to its simplicity, but it masks a lot of the network information.
This firewall is another basic one that focuses on checking the TCP handshake. It’s not resource intensive since it doesn’t look at the packet, but that does mean that it won’t protect against sophisticated attacks.
These firewalls have advanced features that give businesses more ways to stop malicious traffic from making it through the appliance. Some examples of these include deep packet inspection, checking attachments in sandboxes, and terminating encrypted traffic. Third-party data can be incorporated into the rules and filters of the firewall to improve protection against emerging threats. They can also incorporate technology that is found in other types of IT security hardware, such as intrusion detection. The drawback of this firewall type is that it can significantly slow down network traffic.
This firewall is a software package that’s installed on the business network and does not rely on a hardware appliance for protecting traffic.
Some applications have firewalls built into the software itself to act as a second layer of protection. Anything that gets through the physical firewall of the business network and reaches the application layer needs to go through another inspection. These firewalls focus on threats that are most common for that piece of software.
A cloud-based firewall leverages cloud computing technology for the virtual appliance. Some advantages of a cloud firewall include the ability to scale quickly, high availability, and cost-efficiency. For organizations with limited IT budgets, using a cloud-based service can give them access to powerful features that they wouldn’t have access to without paying a substantial upfront hardware fee.
The right firewall for your organization depends on the typical threats that you face, the sensitivity of the information you’re protecting, and your performance requirements.
TrickBot is up to its tricks again. Once cyber experts get a handle on it, TrickBot releases new modules that advance its capabilities. Here’s what you need to know to protect your organization from TrickBot.
Don’t Get Tricked By TrickBot
TrickBot is up to its tricks again. Once cyber experts get a handle on it, TrickBot releases new modules that advance its capabilities. Here’s what you need to know to protect your organization from TrickBot.
What Is TrickBot?
The Multi-State Information Sharing and Analysis Center (MS-ISAC) recently released a security primer on TrickBot. Originally developed in 2016 as a Windows-based banking Trojan, TrickBot has recently advanced its capabilities.
TrickBot is a modular banking trojan that targets user financial information and acts as a vehicle for other malware. It uses Man-in-the-Browser attacks to steal financial information such as login credentials for online banking sessions. (The majority of financial institutions consider Man In The Browser attacks as the greatest threat to online banking.)
Malware developers are continuously releasing new modules and versions of TrickBot— And they’ve done this once again.
How Is TrickBot Distributed?
TrickBot is disseminated via malspam campaigns. Malspam is a combination of malware and spam. It’s usually delivered through phishing or spear-phishing emails. Its goal is to exploit computers for financial gain.
These malspam campaigns send unsolicited emails that direct users to download malware from malicious websites or trick the user into opening malware through an attachment.
TrickBot is also dropped as a secondary payload by other malware such as Emotet. Some of TrickBot’s modules abuse the Server Message Block (SMB) Protocol to spread the malware laterally across a network. (SMB is an application-layer network protocol that facilitates network communication while providing shared access to client files, printers and serial ports.)
The developers behind TrickBot have continue to add more features via modules to this potent trojan virus. It can download new modules that allow it to evolve if left unchecked.
How Does The TrickBot Malspam Campaign Work?
The malspam campaigns that deliver TrickBot use third-party branding looks familiar to you and your staff such as invoices from accounting and financial firms. The emails typically include an attachment, such as a Microsoft Word or Excel document. If you open the attachment, it will execute and run a script to download the TrickBot malware.
And, TrickBot is really tricky. It runs checks to ensure that it isn’t put in a sandboxed (quarantined) environment. Then it attempts to disable your antivirus programs like Microsoft’s Windows Defender.
And even worse, TrickBot redeploys itself in the “%AppData%” folder and creates a scheduled task that provides persistence. Persistence is the continuance of the effect after its cause is removed. So, even after you remove TrickBot, it can still create problems.
What Happens If Your Network Gets Infected With TrickBot?
TrickBot’s modules steal banking information, perform system/network reconnaissance, harvest credentials and can propagate throughout your network.
- Will harvest your system information so that the attacker knows what’s running on your network.
- Compares all files on your disk against a list of file extensions.
- Collects more system information and maps out your network.
- Harvests browser data such as cookies and browser configurations.
- Steals credentials and configuration data from domain controllers.
- Auto fills data, history, and other information from browsers as well as software applications.
- Accesses saved Microsoft Outlook credentials by querying several registry keys.
- Force-enables authentication and scrapes credentials.
- Uses these credentials to spread TrickBot laterally across your networks.
What’s New With TrickBot?
In November 2018, a module was developed and added that gave TrickBot the ability to steal credentials from popular applications such as Filezilla, Microsoft Outlook, and WinSCP.
In January 2019, three new applications were targeted for credential grabbing: VNC, Putty, and RDP.
In addition, it can also steal credentials and artifacts from multiple web browsers (Google Chrome/Mozilla Firefox/Internet Explorer/Microsoft Edge) including your browsing history, cookies, autofills, and HTTP Posts.
How Can You Protect Your Organization From TrickBot?
We recommend that you contact us and arrange for the following to protect against the TrickBot malware:
- Implement filters at the email gateway to filter out emails with known malspam indicators such as known malicious subject lines, and block suspicious IP addresses at the firewall.
- Use managed antivirus programs on clients and servers, with automatic updates of signatures and software. Off-the-shelf antivirus isn’t enough.
- Arrange for vulnerability scans to detect TrickBot or other malware threats that are hiding in your IT systems.
- Apply appropriate patches and updates immediately after they are released.
- Provide Security Awareness Training for your users. Regular training will ensure that they can recognize social engineering/phishing attempts, and refrain from opening attachments from unverified senders.
- Help you employ a Password Management solution so your usernames and passwords aren’t disclosed to unsolicited requests.
- Deploy a managed Anti-Spam/Malware Solution with the latest signature and detection rules.
- Review security logs for indicators of TrickBot. If any are found, we can isolate the host and begin investigation and remediation procedures.
- Make sure you adhere to the principle of least privilege, ensuring that users have the minimum level of access required to accomplish their duties. We’ll also limit administrative credentials to designated administrators.
- Implement Domain-Based Message Authentication, Reporting & Conformance (DMARC). This is a validation system that minimizes spam emails by detecting email spoofing using Domain Name System (DNS) records and digital signatures.
- If you don’t have a policy regarding suspicious emails, we can help you create one and specify that all suspicious emails should be reported to security and/or IT departments.
- And more…
Don’t let TrickBot use its tricks to steal your confidential data. Contact us for comprehensive IT Security Analysis and Remediation to keep TrickBot out of your network.
Have you seen a new application — Chromium — suddenly appear on your computer? It’s likely that if you did not intentionally download it, the app is malware that should be removed immediately.
While Chromium is a legitimate product, hackers have been using it to deliver adware and potentially unwanted programs, redirect browsers to different websites and track Internet activity. The results of such unwanted software can range from minor irritation to serious privacy concerns, including identity theft.
What Is Chromium?
Chromium is an open-source browser application that was initially created by Google. Chromium is the source code for what became the Chrome browser. When Google released Chrome in 2008, it also released the Chromium code. The Chromium project is now managed by The Chromium Projects and is designed for developers to create a faster, more stable and safer form for web browsing.
Chrome itself still includes some of the Chromium source code along with proprietary features, such as automatic updates. Google owns and manages the product, which is by far the most popular browser worldwide, with 62.5 percent of the market share as of February 2019.
Why Is Chromium Popular with Hackers?
Because it’s an open-source product, Chromium is vulnerable to misuse. Browser hijackers are a type of malware that makes changes to a user’s browser settings without their knowledge or consent. Most users unintentionally download hijacking malware when clicking through online ads or when downloading or purchasing other software.
How Does Malware Chromium Work?
The malware Chromium app uses a virtual layer to push ads or redirect browsers to e-commerce websites. Other types can direct users to dangerous, malicious websites that can themselves contain infectious viruses and programs.
What’s worse is that the bad Chromium browsers track your browser activity and can grab browsing data, including personally identifying information, passwords and financial data such as credit card numbers and bank account numbers. The hackers then sell this information to third parties, who often use it illegally. This activity can mean privacy breaches, unwanted use of cards and accounts, and identity theft.
There are many different Chromium-based browser applications that are dubious, despite appearing to be legitimate. Usually, these apps claim to improve browsing speed and security and boast of having new features that other browsers lack. These claims lure users into a false sense of security and invite downloads that cause trouble. These questionable app names include BeagleBrowser, BrowserAir, Chedot, eFast, Fusion, MyBrowser, Olcinium, Qword, Torch and Tortuga, among others.
How Is Chromium Malware Installed?
Often, these rogue programs are part of the Custom or Advanced settings of an app. The most common victims of these unwanted applications are users who hastily download software and install it quickly without reviewing each step. To avoid these inadvertent downloads, it’s important to pay attention during download and installation steps. Be wary of any software that is bundled with other programs and never accept offers to install third-party programs.
How Do I Uninstall Rogue Chromium Browsers?
There are several step-by-step guides online to show how to remove the malware, do thorough scans of your computer for rogue files and registry keys, and clean and reset browsers. The steps are very specific to your operating system and browsers. Two good online guides are here and here.
Being aware of types of malware, how they infect your computer and what they do can help prevent you or your employees from the frustration, time and irritation of fake Chromium browsers.
Social engineering is when “persuasion” takes a darker turn. In a broad sense, it includes any action that attempts to influence a person to act against their best interests. This is the last of a 4-part series on social engineering and how it affects your business. We have covered Impersonation, Email Phishing, Vishing, and finally SMiSHing.
SMiSHing applies phishing tactics through text messages.
Although this channel is less effective at convincing victims of the sender’s authority, attackers find other uses.
Fake shipping service in Japan
In an on-going SMS phishing attack in Japan, victims receive text messages claiming to be from a parcel delivery service. The message guides victims to a website with more information.
Rather than collecting information online, the site prompts users to send personal information via SMS.
A variation of the attack encourages victims to install a smartphone app. The mobile malware intended to collect login credentials and credit card info and send SMS messages to more potential victims.
SMS phishing via Atlanta
Two Romanian hackers were extradited to the U.S. in April for an elaborate phishing scam that leveraged SMiShing and vishing.
From Romania, the pair used compromised computers around Atlanta to send thousands of automated phone calls and text messages throughout the U.S.
The messages claimed to be from a financial institution and directed victims to call a phone number to resolve a problem. After calling, victims were prompted to enter their bank account numbers, PINs, and/or social security numbers.
The hackers collected more than 36,000 bank account numbers, according to court records.
What You Can Do About It
First, always be aware that these scams exist and keep your guard up. More importantly, partner with a trusted IT service company, who takes on the job of protecting your business from cybercriminals.
For more information, a security assessment, or help training your employees on cyber safety, call mPowered IT 678-389-6200.