Category: Security

“Ransomware” makes it into the Oxford English Dictionary

The Oxford English Dictionary has taken note of some IT related words.

For 1, Ransomware is defined now as:

A type of malicious software designed to block access to a computer system until a sum of money is paid.

Another new word is “esc”, that is coined by Apple devices. Instead of “Esc” which would be for the PC’s (Dell, HP, etc)

Also “Selfie” and something sounding like someones grandad would use “e-shopping” got into the OED

CPU Kernel Bug: Security issue for millions

You may have heard of a bug in computers that could cause a problem with security. I have gathered some information below to help you understand the problem.

So what is the problem?

The processors kernel is providing a way for memory to be read, by a malicious entity. It could be a hacker or app that reads the memory.

Intel have reported: “these exploits do not have the potential to corrupt, modify or delete data,” However, the act of reading memory could give a route for hackers to read passwords, login details, ciphers and a lot more sensitive data (basically that goes through the processor).

What or who is affected?

At the moment, everyone with a X86 CPU, made by Intel, in the past decade is at risk.

Do you have AMD, ARM or another CPU? You might still be at risk as the instruction sets for x86 are shared between manufacturers, but for AMD, certainly the other big player in the market, they are only slightly affected (https://www.amd.com/en/corporate/speculative-execution)

For ARM, 64 bit processors, there is a Linux kernel patch being developed https://lwn.net/Articles/740393/

I’ll be OK, I have a Mac

You’re wrong this time I’m afraid. Macs also use x86 technology and they’ll need patching, although if you’re up to date with macOS (10.13.2) then you’ll be OK. That patch was released Dec 6th. Further updates will be made in 10.13.3.

Is there anything I can do?

Only make sure your PC is up to date with all OS updates, especially security updates.

Microsoft plan dropping an update on us around the 9th Jan, so look for updates then as well as now!

Don’t install dodgy apps, be careful on what websites you click on, don’t click on click bait. If someone sends you a link that you’re not expecting then ask them if it was them who actually sent the email!

What is a CPU?

Central Processing Unit – Made up of lots of transistors, LOTS, approximately 700million for modern CPUs they control logic and calculate the commands from the kernel.

What is a kernel?

A Kernel is inside a microchip that controls instructions going into your CPU as well as what comes out of it. It’s basically in control of your entire system.

 

Curse of the Bad Rabbit – Ransomware

BadRabbit Ransomware

A new Ransomware threat has infected PC’s in Russia and multiple other countries stretching to the other side of the globe. Corporate systems at Interfax as well as two other Russian media companies seem to be first affected. But has been seen in Poland and South Korea.

In Ukraine, Odessa airport, the Kiev metro, and the Ministry of Infrastructure were also infected. It is the usual sign of a ransom for encrypted files.

The team at ESET. Antivirus have said this is a strain of the Diskcoder.

Screen shot of the BadRabbit ransomware (Source: Group-IB)

The software will pose as a false adobe flash update to seduce victims to installing the malware, the software would be installed by people visiting these websites according to IB-Group. There may be other websites that are infected.

https://twitter.com/GroupIB_GIB/status/922972032098291718

Once installed on a Windows PC, the malware will actually use a legit open-source tool: Mimikatz to seek out file server login details from the memory on the computer. The software will then spread via SMB shares on the same network.

There is some news to show that it has used a leaked CIA hacking tool as WannaCry did a few months back.

The Master Boot Record will be changed and this will display a start-up screen and not allow progress via this screen. The BadRabbit ransomware will also have a countdown till the price actually goes up. This will force companies and individuals to make a quick decision and possibly more likely to pay. Remember if you pay you are more likely to get attacked more often as the attackers know who pays.

The payment required is 0.05BTC which is just a little over £200.

Signs of infiltration

If you’ve had network connections to caforssztxqzf2nm.onion, or downloads from the following sites:

hxxp://1dnscontrol.com/flash_install.php

hxxp://1dnscontrol.com/install_flash_player.exe

are obvious signs of infiltration.

But the software might pop-up with a sign asking you to disable or stop current AV or malware protection. Some AV packages have spotted it already.

According to Kaspersky Lab, if you prevent these files from executing you should be able to disable BadRabbit from starting to run.

C:\Windows\infpub.dat

C:\Windows\cscc.dat

But you should check the Flash update you’re installing is legit even if you have Flash enabled.

Backing up and having a system image backed up regularly is one way to have a small amount of post-malware protection. But anti-malware software is one of the best remedies to protect yourselves. But checking updates are legit is the best way and not clicking on dodgy links!

iPad, iPhone, Mac Book and Apple Watch devices are locked for ransom!

It has come to light from middle of September that there has been attacks on apple devices.

The attack manifests itself as a malicious person getting through the security of users’ icloud account using the “Find My Device” feature.

The malicious person will set a specific device to “lock”, this will enable the iPad, Apple Watch, Mac Book or iPhone to be locked, in theory so a thief can’t access the data and make the device unusable and once you have the device back in the correct persons hand you’ll then input the code to make it all work again.
Except in this circumstance people are seeing a message along the lines for “pay me X.XBTC to address XYZ and I’ll send you a code to unlock”.

The hacked accounts are often users who use the same passwords for different sites, where those sites might have been compromised. It is advisable to change your icloud login details to something else if you are a person who uses the same logins for different sites.

 

Some people and sites are advising to disable the “find my” device service, but that rather defeats the object of the service. However as some have also pointed out Mat Honan (Journalist) was hacked after a successful attack after someone called the Apple support to change his password with his billing address and his last 4 digits of his credit card. You can read about that below.

How Apple and Amazon Security Flaws Led to My Epic Hacking

Bad emails. Spotting and dealing with them

Bad emails / Malware emails / Scam email

Emails fly about between servers and computers all day, thousands every second around the world are sent. Most of the emails are legitimate. But the email system is open to abuse. There are holes in it.

I categorise bad emails in 2 sections, those with attachments and those who try and get you to download attachments. The 2 examples below are the latter.

Bad emails

How do you know a legitimate email?

Above is an image of what I call a bad email. It’s an email that looks perfectly good, from Dropbox, it even has a no reply email from dropbox. But clicking on the “view file” link will take you off to a website that is unknown. It might be a site that looks like Dropbox, but even by clicking that link the sender of the email will know they have a live email address. This could be the start of a series of targeted emails to gain personal information / money / trust etc.

 

So how do you tell this is a bad email?

First, think who is this person, Nathaniel Walsh? If you know him, great, but DO NOT assume the file is safe.
Are you expecting an email from him with a statement? If you’re not, give him a call and ask him, it takes 2 minutes! If he has not sent you an email then it could be a scam, his computer or email system could have been breached and you and other people from his address book might have been targets by scammers/hackers.

Also check the links in emails, don’t click on them! But hover your mouse over the link and see where it will take you. If it is a place that isn’t that of the email that has been sent, then it is likely a fraudulent email.

Another example

Bad emails efax

Take a look at this image of an email. You think someone has tried to use 20th century technology in a 21st Century way. You might wonder what it is. But first, do you recognise the caller ID? It is 0151, a quick google shows it is from Liverpool. Are you expecting anything from a company in Liverpool? Do you do business with a company in Liverpool? If you look at what is sent via fax, really only legal documents are faxed these days. There will be the odd occasion when faxes are used, but it is rare and it has been felled by email and pdf documents.

You will also notice the domain the link sends you to is about truck hire Australia, have you hired a truck in Australia from a company in Liverpool?! This is obvious that it is spam or a scam as those 2 situations for myself are untrue.

Again, if you have hired a truck in Australia from a company in Liverpool, give them a call and ask, “have you sent me an efax message?” If they say no, it’s a scam! Maybe it is a coincidence or maybe it’s a specific attack.
If you suspect it is a specific attack attempt then you engage with our security consultation service and we can advise. Contact sales@thecomputersaint.com to consult with us.

 

If you find yourself with an email and an attachment from either a known person or unknown person then follow the rule of call that person up. Ask them if they’ve sent you an email with an attachment. If they haven’t tell them you have received something from them, they should investigate this and you might need to send the email to their IT team. It’s unlikely to do any damage sitting in your inbox. If you click links or download the file then that is when the damage is done.

Even with files that attached and from a trusted source, that you are expecting you should download the file to a directory (or folder) on your computer and then with modern antivirus software you can run a scan on the file and tell if it is safe. Don’t run the file, even if it is a .docx (document) file or something you’ve trusted in the past.

 

Emails with attachments

Emails often come to us with an attachment; most modern antivirus software will allow us to scan as the attachment is downloaded. This method is good if you’re using a laptop to download an email. I’ve sometimes been emailed by family members, colleagues or customers who have had some malware infect their computer, only to find I get an email from them with a strange attachment that I was not expecting.

If you have an email like this, the advice is the same as above: call the person and ask them if they’ve actually sent you an email as they might not know they have a problem. If they have then it should be OK, but you should download the email and scan it first with Antivirus anyway!

 

To summarise:

Identify emails.

Call the person you’ve got the email from.

If you get a bad email:

Don’t click the links, see where the link goes.
Tell the company in question, some of the larger companies especially have teams of people (IT team normally) who deal with SPAM & Bad emails. The company might ask for the email to be forwarded to them.

Scan any downloads with a virus program. I like Avast or AVG (free versions are good)

 

Security warning over data.gov.uk – time to change your password!

Have a data.uk.gov account? You should probably change your password.

The site that people can search for data published by the government has discovered, after a data security review, that some usernames and passwords were placed on a publicly accessible resource.

Following quote is taken from the BBC site: (http://www.bbc.co.uk/news/technology-40443601)

A GDS spokeswoman told the BBC that the breach had affected only data.gov.uk accounts, and people with separate accounts for other government websites were not affected.

She said only email addresses, usernames and hashed passwords were implicated, rather than personal information such as names and addresses.

Hashed passwords are not massively secure, but certainly more secure than clear text passwords. It all depends on the algorithm that is used. But the BBC site also reports that users will need to change their passwords next time they login.

The Computer Saint would also advise changing your password, if the same, on any other services. So if you login with the same details to Yahoo, Google, Hotmail, etc then you should change your password.

You should also keep an eye for fraudulent emails, if you suspect an email is fraudulent then you should contact the website in question and not via the email you’ve just got. Go to the actual website via a browser.

Wonga Data Breach

Wonga Data Breach

Wonga have announced that 270,000 customer details may have been accessed in a data breach at Wonga, the Pay Day loan company. 245,000 UK customers could be affected.

What was taken?

Wonga says the data that parties unknown have accessed “may have included one or more of the following: name, e-mail address, home address, phone number, the last four digits of your card number (but not the whole number) and/or your bank account number and sort code.”

Advice?

To myself the advice on their incident page is a bit contradictory:

“We believe that your account is secure and you do not need to take any action.
However, if you are concerned then you may wish to change your Wonga.com password.”

I’d advise change your Wonga password at a minimum. They have not said the passwords were accessed, this is good. But I would check your bank statements a bit more closely, even for those small transactions. Question with your bank any that don’t add up. I’d change your passwords to other financial pages (certainly if you use the same password for multiple sites) if it has been 30 days since your last password change.

After Jermey Clarkson lost his money in this stunt: http://news.bbc.co.uk/1/hi/7174760.stm I’d keep a very close eye on your transactions.

They posed the question:

“Can someone take money from my card with the information that may have been obtained?

  • Full card details were not taken.”

Which is in my opinion is a very elusive and evasive answer to an important question.

Wonga official data breach page here: https://www.wonga.com/help/incident-faq

 

Letting people in (remote support)

The fake call

I want to start todays blog post off with what there are lots of videos and reports on the Internet of fake calls from someone claiming to be “Microsoft”. Microsoft technical support will not call you, unless you have specifically called them and requested a call back. A call from Mr or Mrs X telling you they’re from Microsoft or from your ISP are 99% fake. Be aware! And yes, they might be able to show you errors on your computer, every computer has them and they survive just fine with them. You probably won’t notice an error. I looked at my event viewer just now and I have 84 logged errors. I’m not worried at all about them.

But it’s so easy to let them take control, It’s only £45

It maybe, it may seem like you’re having errors fixed with a quick 20-minute call and remote session. Let’s just assume they have good intentions and get rid of some malware that’s been plaguing you. What guarantee have you got that it’s gone? What if they’ve attacked and gotten rid of only part of the malware? Are they going to charge you another £45 next time, so that’s £90 they’ve gotten from you, as well as your credit card details if they had bad intentions you could face some serious billing!

I have errors?

Every computer has errors; I have looked at my event viewer and selected the application log errors. I have an error back from October that says…

It doesn’t mean my PC is going to crash or die. It just means that an application I was running back in October had a problem. Computers can be attacked a lot

Be smart

If someone calls you and claims to be from Microsoft, ask yourself, have you requested their call? How did they get your number?

If you haven’t given your number to Microsoft, how are they calling you?

Have you reported any TICKET with Microsoft, this is when you call Microsoft support and get a ticket number? If no, then the call you’ve got ISN’T from Microsoft!

Yes, I’ve heard Microsoft do charge for support on their phone calls. But there is a big difference between using actual Microsoft compared with some people that just call you out of the blue.

 

Here is a youtuber who has encountered a scammer who claims to be from Microsoft.

https://www.youtube.com/watch?v=rbfLmFbXUyQ

How to stop them?

Be smart, don’t believe someone because they are on the phone to you!

Have you CALLED Microsoft for support recently? Remember, if you “send report” if your computer has an error this does NOT initiate a call from Microsoft!

Only let them in if you’ve called them and asked for support. Get the number from the vendors’ website, don’t just trust google. Type into the address bar www.microsoft.com and find their contact details.

Perhaps use a local and trusted computer company. Look for reviews of that company on yell.com. Speak to them and see if they will do a no fix, no fee service, the local touch is much better than that of a person who doesn’t get the whole picture as they are hundreds or thousands of miles away.

System builders must look at security

What is a system builder?

A person or a group of people who are building a computer program, website, server or a network for either their own company or a customer.

What type of security problems could there be?

Access is the major security problem that could be taken advantage of. Access to files, access to directories, access like this, must be locked down to specific users. Depending on the system, for example, a website can have folder security enabled to stop anyone going to thecomputersaint.com/blahfolderthatdoesntexist if there were secure documents in there then it’d be a first step to ensure they were not able to be stolen / downloaded.

The obvious security problem is when people access your data, files, pictures, memoirs or any file that could be sensitive.  The data they pull from that file could be used in a negative way. Especially if it matches up with some information they gleaned from social media accounts.

Who could take advantage?

Someone who is looking to attack you electronically, maybe they are looking for a password to an email account. Maybe they’re looking for information to gain a better understanding of what you do. Perhaps you work for a company where their data is commercially sensitive. If the competitor got their hands on the data, it could spell disaster for your company if the competitor got your information and could get to market before your company.

Maybe your company has an old server no-one looks after. You might have 30 old employees with active accounts after years. 29 might not use them but the 30th might want to log on and take data that they’re not allowed access to.

 

How to stop them?

Access must be controlled with a username and password. That is the first step in securing data. That password must not be written down and must not be shared. Change the password every so often, your own password policies should be every 30 days – 6 months. Use a secure password, check out our other blog posts for how to choose a secure password.

Keep track of old user accounts to files and change passwords to VPN’s or old user accounts when someone leaves the company. Make it policy, don’t let staff get complacent.

Do you need that old file in that location? Why not move it once it’s not needed or delete it. If you have a lot of files that only 1 person or a group of people need access to then maybe have it on small NAS box or its own LUN on the SAN, this is so Finance can’t see Design’s files and Design can’t see the Finance files.

Passwords: Strong and weak. How to choose a strong password?

What is a weak password?

It seems obvious, but a weak password can be 1 word, or even 2 words. It could be a password that is your mother’s maiden name or something equally personal to you. For example, in the film War Games the password for a massive government machine was “Joshua” who was the son of the inventor of said machine. In the film, it’s fair to the inventor that he didn’t know the machine had been plugged into the Internet or was even being used.

If you used your wife’s name as a password, this is information anyone could ask you and just try to login any account. Email account, online storage, bank account, they don’t need to be at your computer. They can simply be at their own computer.

Don’t choose a password that is obviously personal to you and don’t use 1 word from the dictionary!

What is a strong password? And Methods for choosing a strong password

For this you need to understand there are 2 main ways to get around password security that are easy: Guess the password if this is someone you specifically know or targeting to get into their email account or some other account.

The other method for getting into a system is a brute force attack, this is where a system will have a list of words (from a dictionary) and then it will try each word in turn, so if your password is “Zoo” then it’ll take a while but you will lose your account security.

There are more advanced tools that hackers and crackers can use to break account security, so even by using 2 words like “ZooApocolypse” is better, still bad practice.

A strong password is something that can’t be guessed as it might look like a word, but it might not be a word. For example: “pa55word” looks like password (don’t use this as it’s a common password) but maybe take your wife name: Sophie and replace the letters with numbers, so “5oph13”

But it’s still just numbers and letters. To be sure no-one will guess your password you want to make it longer and adding some symbols. Maybe add another word onto the password, maybe your favourite kitchen appliance so “5oph!3Bl3nd3r”

I’ve added in an exclamation mark; this is to throw off any of the more advanced password creation and guess tools hackers have access to. With the more complex password, the more time it would take for an attacker to gain access to your system and if it is a secure enough password they’ll probably give up.

It’s best to add in a few symbols if your password allows it as well as numbers. If your passwords require to be changed every 30 days, 6 months etc, you could suffix or prefix your password with a number and increment or decrement that number in the password each time you need to change it, although this can be bad security practice only to do this. Maybe add an additional 16 to the number each time. This way you know the increment and it isn’t just a 1. It’s still best to change your password entirely however.

You should always change your passwords to each system you log into on a periodic basis, whether it be social media, email or an important company server with sensitive details, at the least every 6 months is a good plan.

Security questions

A lot of websites require security questions, such as “what town were you born in?” or “what was the name of your first pet?” These are good second stage security, after the password login, as they give that little extra security. This 2nd stage of security is good; however, you need to be aware of people that do and don’t know the information who are trying to access your system. A while ago there was stories of people who had their Hotmail accounts broken into as they had met some random person on the internet chat room. They then gave out information that Hotmail asks as a “recover account” option and this way the attacker could break into the account, with this they could send spam to your entire contact list and it appears the attacker was being a new friend, asking questions that made him or her seem interested in you.

The lesson here is you need to be careful of new friends especially and don’t give them too much information.

 

Disclaimer: This document isn’t a solution to password security. This advice is about how to better understand the risks and how to mitigate them. There will always be people / organisations who want to steal your data and break into certain systems. You must think of the possible security risks and mitigate these. From this series of security blog notices you’ll learn that there are more.

If you require security services, please contact us at sales@thecomputersaint.com