Home » Blog » ransomware

Tag: ransomware

What Hackers Target In Small Businesses

Hackers today have many ways to attack small businesses and business owners. Many attempt to use technology to send malware, viruses, or phishing attacks; or use information to con owners and employees into handing over more information than they should.

One or more of these techniques can be combined with gaining physical access to steal from vulnerable firms. Identifying precisely how criminals target businesses and what they deem most valuable can help to protect from the most devastating attacks out there.

Remaining vigilant and informed is one of the most vital things you can do as a business owner to protect your assets and reputation.

Extortion

Different types of attacks tend to rise and fall in popularity. Fifteen years ago, computer worms were the most common attack that businesses faced. Security software wasn’t as advanced or as widely used at it is today. Computer worms were, at the time, an exceptionally low-cost and efficient way to inflict the maximum amount of damage for minimum cost.

Today ransomware has seen an unfortunate boom in popularity. This technology aims to encrypt the target’s files on their personal computer. This technique denies the victim access and charges a large fee in exchange for the key to retrieve the victim’s own data.

The attack has worked so often because it requires minimal effort and can be used again and again. Many businesses have no option but to pay because the data is worth far more than the ransom demand the hackers have made.

The best defense against ransomware attacks, in addition to strong online security, is an up-to-date offsite backup — one that is tested to work reliably.

Targeting Customer Records

One of the most important things for your firm to take care of is your customer data records. Records which include names, dates of birth, and other personally identifying details. These details are extremely valuable to hackers or criminals who, either use them personally or sell them on to someone who will.

Many regions have strict laws and guidelines about how this information must be stored, accessed and protected. Failing to follow these can result in severe penalties that could devastate any company.

Targeting Financial Information

Like personal information, a small business must take extreme care when storing customer financial information. Sensitive details such as credit card or banking information are a key target for hackers looking to steal money fast.

The impact on your business reputation following a breach of financial data will be severe and devastating. Even a simple mistake can require years of advertising and great PR to repair. Many firms have failed to recover after losing the trust of their customers.

Social Engineering

Most firms today run good IT security packages to protect against online attacks and other forms of malware. Attackers often know to take their methods offline to achieve the best results.

Whether posing as a supplier, customer, or interested party; attackers can seek to gain information that you may be less than willing to hand over to a stranger. Small businesses can often be used to gather information on vendors and suppliers they do business with in order to attack them too.

Be particularly cautious of the information you provide when discussing business with individuals you haven’t spoken to before.

Keeping Small Business Safe

Each of these targets and attacks are just some of the most popular and hard-hitting attacks out there now. The list is forever changing, and the methods we use to protect against them always needs to change too.

Some can be defended against with great security, backups, and software. Others, such as social engineering, need you and your staff to stay up-to-date and remain vigilant about the major attacks affecting small business today.

If you need help tightening your businesses security, give us a call at 570-779-4018.

Fake Invoice

Fake Invoice Attacks Are on the Rise – Here’s How to Spot (and Beat) Them

Businesses around the world are being struck with a cyber-attack that sends victims a fake invoice that looks real enough to fool to most employees. It’s an old scam that used to see bills faxed or mailed in, but it’s made its way into the digital world and instances are on the rise.

Chances are you’ve already seen some of the less effective attempts, like an email advising your domain is expiring, except it’s not from your host and your domain is nowhere near expiration. These new attacks are more advanced, in that they look completely legitimate and are often from contractors/suppliers you actually use. Logos are correct, spelling and grammar are spot on, and they might even refer to actual work or invoice numbers. The sender name may also be the normal contact you’d associate with that business, or even a co-worker, as cybercriminals are able to effectively ‘spoof’ real accounts and real people. While it’s worrying that they know enough about your business to wear that disguise so well, a successful attack relies on you not knowing what to look for, or even that fakes are a possibility. With that in mind, here are two types of invoice attacks you might receive:

The Payment Redirect

This style of fake invoice either explicitly states payment should be made to a certain account, perhaps with a friendly note about the new details, or includes a payment link direct to the new account. Your accounts payable person believes they’re doing the right thing by resolving the invoice and unwittingly sends company money offshore. The problem usually isn’t discovered until the real invoice from the real supplier comes in or the transaction is flagged in an audit. Due to the nature of international cybercrime, it’s unlikely you’ll be able to recover the funds even if you catch it quickly.

The Malware Click – Rather than go for the immediate cash grab, this style of attack asks your employee to click a link to download the invoice. The email may even look like the ones normally generated by popular accounting tools like Quickbooks or Xero, making the click seem safe. Once your employee has clicked the link, malware is downloaded that can trigger ransomware or data breaches. While an up-to-date anti-virus should block the attack at that stage, it’s not always guaranteed, especially with new and undiscovered malware. If it does get through, the malware quickly embeds itself deep into your systems, often silently lurking until detected or activated.

How to Stay Safe

Awareness is key to ensuring these types of attacks have no impact on your business. As always, keep your anti-virus and spam filters up to date to minimize the risk of the emails getting through in the first place. Then, consider implementing a simple set of procedures regarding payments. These could include verifying account changes with a phone call (to the number you have on record, not the one in the email), double checking invoices against work orders, appointing a single administrator to restrict access to accounts, or even two-factor authorization for payments. Simple pre-emptive checks like hovering the mouse over any links before clicking and quickly making sure it looks right can also help. Like your own business, your contractors and suppliers are extra careful with their invoicing, so if anything looks off – even in the slightest – hold back on payment/clicking until it’s been reviewed. Fake invoices attacks may be increasing, but that doesn’t mean your business will become a statistic, especially now that you know what’s going on and how you can stop them.

We can help increase your security, talk to us today. Call us at 570-779-4018

mac malware

Apple devices and Macs get malware!!

I don’t like picking on Macs… Oh, wait. That is a lie. I do like picking on Macs because I am tired of hearing “Apple’s don’t get viruses or malware.” This absolutely not true!

There hasn’t been a serious ransomware outbreak on Mac but that doesn’t mean isn’t coming. There are a few ransomware programs in the wild and there has been increased activity in the mac security sector just like there has been in the PC world. Other malware and scam software are out there and on the rise.  “Our tracking of Mac malware has seen a more than 220 percent increase in malware so far in 2017 over 2016,” said Malwarebytes. The main reason that Mac desktops and laptops seem to not be affected is that they only are about 7% of computer users. They are a much small target so there are less malicious programs out there. That doesn’t mean they don’t exist. They will still steal your data if they can. WIth RaaS (Ransomware as a Service) and cross-platform malware, it is becoming easier for the bad guys to target whatever they want. They don’t even have to be proficient at programming anymore. And with an attitude like “we don’t get malware,” you might be easy pickings.

Beyond that, you are also just as likely to lose your online data as a PC user! Just because you are browsing the internet from your Mac doesn’t mean things like the Yahoo and Equifax data breaches will not affect you. You still need to be vigilant in the cloud and protect your personal information.

Protect you and your Mac

  • Backup your data – Onsite, Offsite and Cloud
  • Keep your software and OS up to date
  • Don’t use unapproved software
  • Use an extra anti-malware solution
  • Be wary of unknown websites and unsolicited email
  • Use strong password and 2fa (Two-factor authentication) wherever you can
  • Use a standard account over an admin account for everyday use
  • If you have a laptop, consider full disk encryption

We offer backup, monitoring, and antimalware solutions if you use Apple products in your business. Let us know how we can help!

Hackers, Ransomware, and Malware. Oh, My!

Is your company protected?

These attacks continue to rise. They are targeting more and more small businesses. 1 in 5 small businesses will suffer a cyber breach this year. 97% of breaches are preventable. There are affordable solutions to protect yourself.

These are some things that you and your IT company should talk about implementing:

  • Backup — Backup. Backup. Backup. You should have onsite and offsite backups. Consider full operating system disaster recovery and testing. These should be monitored and tested frequently.
  • Updates — Update everything! Software, firmware, and operating systems. If you are running on unsupported or outdated systems you are asking for trouble.
  • Spam email prevention — This is one of the main sources of attacks. You need to train your employees and have a spam filter in place. Even if you are using a service like Gsuite or Office 365, you should consider using additional protection.
  • Passwords — Everyone hates passwords but they are a necessary evil. At the very least you should make sure they are long and not easy to guess. We recommend changing your passwords every 90 days. And please don’t use the same passwords everywhere! All it would take is one breach to loose all your data. There are tools available to help keep track if you are like me and have 300 of them.
  • Multi-factor Authentication — Consider using this everywhere you can. If your password is stolen, this adds another layer of protection to your data. Avoid SMS/Text if possible as these can be intercepted.
  • Advanced endpoint security — Simple definition based anti-virus is not enough anymore.
  • Firewall — Make sure built protection systems are enabled and the log files are being monitored.
  • Encryption — This protects hackers from accessing your data via stolen hardware. Mobile devices (phone, laptop, tablet) should always be encrypted. Consider encrypting at rest data and devices as well.

Why Do People Create Viruses?

You’d be right in thinking it’s hard to program a computer virus that can spread across the world in a flash – we’re talking days of constant desk-jockey nerd-work. So why do they bother? Well, it generally comes down to 3 reasons: Money, showing off their skill, or to simply being a jerk. While showing off or being a jerk is pretty self-explanatory, the money side is fascinating.

Here’s how people are making money with computer viruses:

Bank account theft: Virus creators are more than happy to help themselves to your bank details, sneaking in to grab your login details or credit card info. They can either transfer your funds away or use your credit card details to go on a shopping spree. Sometimes they’ll leave the fun to another person though, and simply sell your details to the highest bidder.

Ransomware: Rather than a financial snatch and grab, sometimes a virus will encrypt your files and demand money for the unlock code. Without a true backup plan in place beforehand, you’re at their mercy. You’ll be given very helpful information on how to pay, plus a firm deadline before your files are destroyed permanently.

Ad swappers: A cheeky technique, this is when they create a virus that either puts annoying ads on websites you visit, or places affiliate codes on pages so that when you buy something legitimately – eg, from Amazon – they get a percentage as a ‘referral fee’. Their kickback doesn’t make your purchase cost more and you may not even know you’re supporting their activities.

Bitcoin mining: You might have heard of digital currencies being used for payment, but did you know you can also earn them with your computer processing power? Unfortunately, ‘renting’ out your computer’s processing power means paying more in running costs than you’d make – unless you were very clever and sneaky, and used a virus to rent out other people’s computers.

Botnets: Certain infected computers can be remotely controlled to do whatever the virus creator wants. In this case, they’ll usually set the infected bot computers to overwhelm a target web server, like an e-commerce store. Sometimes it’s done as revenge, but more often it’s blackmail. The ‘Botmaster’ says “pay me thousands of dollars or I’ll crash your site during the biggest shopping day of the year.”

Account stealing: Subscription accounts like Netflix and Hulu are often hijacked, leaving you to pay the bill for someone else’s entertainment. But sometimes, virus creators go one step further with online gaming accounts. All those digital items that you fought so hard for (special clothing, weapons etc.) can carry real world value and be stolen from your account and sold on a black market. Yes, that’s cheating!

Give us a call at 570-779-4018 to make sure your computer is secure and protected.

Ransomware

How Much Could A Ransomware Attack Cost You?

Have you ever thought about how much your data is worth? Information is possibly the most valuable part of your business – there’s your client database, accounting software and inventory management, and of course, any intellectual property you may own. When the ransomware, WannaCry, tore through the world recently, many businesses were suddenly forced to re-assess the value of their data: was it worth saving, and what would be the deeper cost of the attack?

Most ransomware attacks cost $150-$600 to get your files released, but that’s only IF the cyber-criminals honor the payment and actually give you the decryption key. Meanwhile, new client calls are still coming in and you may find yourself unable to operate with your systems down. Paying the ransom or restoring from an unaffected backup seems like a quick fix, but it doesn’t end there. There’s still the downtime involved to restore all your data – possibly days – and that’s a lot of lost productivity. Plus, if word gets out that your data has been compromised, you may find confidence in your business plummets and your existing clients head elsewhere. That $150 ransom may end up costing well over $150,000!

Prevent Ransomware Attacks on your Business

Keep your systems up to date: WannaCry took advantage of a flaw in older versions of Windows, one that was since patched by Microsoft. But to be protected, businesses had to be up to date with their patches AND be running a supported version of Windows. Delaying patches and updates puts your business at risk – we can help you update automatically.

Lock down employee computers: Very few staff will require full administrator access to your business network. The higher their level of permissions, the more damage a person can do – either accidentally with a whoopsie click, or by inadvertently installing malware. By locking down your employee computers, you have a better chance of containing a malware attack to non-vital systems. Our experts can design an access management plan that gives you best of both worlds: flexibility PLUS security.

Educate your workplace: Most employees believe they’re being cyber-safe but the reality is quite different. Many malicious links and embedded malware have become hard to spot in an instant – which is all it takes to click and regret. We can work with your staff to establish procedures around checking links for authenticity before clicking, awareness around verifying the source of attachments, and the importance of anti-virus scanning. We’ll help get the message through!

Have a solid backup plan: When ransomware hits, a connected backup = infected backup. Unfortunately, synced options such as Dropbox immediately clone the infected files, rendering them useless. The only safe backups will be the ones both physically and electronically disconnected, with systems designed to protect against attacks like this. Our experts can set you up with a backup system that makes recovery a breeze.

Be proactive: The best way to avoid the financial cost of a ransomware attack is to prevent it from happening in the first place. Remember, many businesses were able to watch WannaCry from the sidelines, completely unaffected and seizing opportunities while their competitors were down.

Our managed services can help protect your business against the next cyber-attack.

Call us today!

WannaCry Ransomware Explained: Is Your Business At Risk?

You’d be hard-pressed to miss last week’s biggest headline, the WannaCry cyber-attack sent shockwaves around the globe. Businesses of all sizes and even police departments found themselves crippled without warning.

Among the most prominent victims were many NHS hospitals in the UK, affecting up to 70,000 individual devices such as essential MRI scanners and blood-storage refrigerators. But by the time it hit the news, it was too late – either your system was protected, or it was infected. Here’s how it all went so wrong.

What is WannaCry?

The WannaCry cyber-attack was a type of malware (the collective name for computer viruses & bad juju) called ‘ransomware’. Just like the name suggests, it’s actually a demand for money. Like all ransomware attacks, WannaCry encrypts your files and holds them hostage until you pay. In this case, the price was set at $300, payable with internet currency Bitcoin, and you had 3 days to pay before it doubled. If you didn’t pay, the ransomware threatened to delete your files permanently. It’s yet unknown how much money the WannaCry hackers have earned with their latest attack, but you can be sure plenty of people have paid the ransom. Even the FBI recommends paying the ransom, especially if the ransomed files are of a sensitive nature or weren’t backed up.

How It Spread So Fast

It seems WannaCry may be a ‘computer worm’ that self-replicates and spreads, rather than a phishing attack that needs to be activated with a click. So far, no common trigger has been identified, as is normally the case with phishing links. WannaCry moved rapidly from system to system, spreading out through the entire network, including all connected backups and storage devices. At the same time, it spread out to infect other networks, who then spread it further, and so on. Given the nature of the internet, it was everywhere within hours.

Why Some Businesses Were Safe

WannaCry could ONLY infect systems that have fallen 2 months behind in their Windows updates. This is because it was created to take advantage of a specific vulnerability in Windows, one which Microsoft patched months ago. Without that patch, the ransomware could waltz right past the firewall, past the anti-virus and directly into the system (the NHS were reportedly running Windows XP – no longer supported). Those running Windows 10 or a fully patched, recent version of Windows were completely unaffected – the virus literally had no way in

It just goes to show the importance of staying up to date. We haven’t seen a second spike in WannaCry attacks yet, but that doesn’t mean there won’t be one. A quick update could protect your business from weeks of downtime and lost revenue, making attacks like this a non-issue.

With our managed services, we can make sure you stay up to date – and protected. Give us a call today at 570-779-4018.

You can afford security in your business!

I hear it all the time. We are only 5 users. I can’t afford security. Why would someone try to hack into our firm? What we have works just fine.

Hopefully, you have never had to rely on your home or car insurance but there is a reason for it. Think of taking steps protect yourself from cyber criminals as insurance. It is MUCH more expensive to recover from an attack. Beyond the time spent for a professional to help you or paying the ransom, you may be liable for your employees and customers data.

You need security

You need security to protect you, your clients and your business.

The trend of malware being directly targeted at small business continues to grow. 2016 was the year of ransomware and 2017 is shaping up to be worse. Small business has the most to loose. You are the most likely to pay. You are becoming their favorite target.

You can do something about it!

Here is a sample quote for a five user single location office with a local file server. This assumes that there is a basic network, PCs and a server in place.

Some of the items in the list could be optional depending on your current office configuration.

pfSense® Security Appliance $225.00
Wireless Access Port AC $130.00
8 port “smart” switch $70.00
Miscelanous patch cables and parts $50.00
Install and security configuration $500.00
Total $975.00

Opt in for our Gold level service for $50 a month per workstation and $150 a month per server and receive:

  • 24/7 Network Monitoring
  • Daily Backup Monitoring
  • Patch Managment (Your systems, router, and programs always up to date)
  • Year-End Technology Review
  • Monthly Audit and Tune Up
  • Endpoint Software Included (Anti-virus and Anti-malware)
  • Cloud File Backup up to 250 GB
  • 4 hour Guaranteed Response
  • Next Business Day Guaranteed On-site
  • Hourly rate reduced 20%

 

This configuration would last years and you gain the following:

  • High-speed secure wireless with expandable coverage and a secure guest wireless and captive portal option
  • High-speed VOIP (Voice over IP) friendly router and firewall that is much faster, flexible and expandable than a consumer class option
  • Snort IPS/IDS (Intrusion Protection/Intrusion Detection) that can be custom configured
  • Multi-level malicious website protection and website content control
  • Endpoint Security from Avast and AVG
  • Easy to configure site-to-site and remote VPN configuration so you can access your files from home

This is just an example. Depending on your demands and how secure you want to be, we may need to modify this to fit your requirements.

Give us a call at 570-779-4018 to discuss your options!

 

Ransomware: It is not just a scare tactic

It is not just a scare tactic, and it is not going away

Ransomware activity continues to rise, and it doesn’t appear to be slowing down for 2017. In 2016 it spiked by 6000%, and it is on track to be a 1 billion dollar a year “business.” IBM study.

Software teams are building ransomware kits to sell on the Dark Web. RaaS (Ransomware as a service!) is a thing. This means there are illegal companies making money from designing kits to build ransomware. So, not only are criminals making money from ransomware, the distributors don’t even have to be good at programming or hacking to do it. There is enough of a demand that a small team of programmers is making money from selling the software to commit the crime. It is also making it extremely hard for old fashion virus scanners to catch the activity because each criminal is adding their own twist.

How it happens

  • Phishing email
  • user clicks on link or attachment
  • ransomware makes contact
  • C&C server generates & retrieves an encryption key
  • ransomware scans infected a machine, looking for files
  • ransom demand
  • connects to other machines and infects them
  • ransomware builds an inventory of encrypted files
  • scan other machines over the network

Business Targeting

It used to be consumers or simplistic shotgunning techniques. Now there is more and more direct targeting. Business targets make sense to the bad guys. Consumers or individuals might just start from scratch, but businesses are more likely to pay a ransom. It is much more lucrative form them to target small business.

Spearphishing

Spearphishing is direct targeting your personal account using techniques to fool you into trusting the source. The criminal could use social media sites to gather information. The email may be crafted specifically for you and may even look like it comes from a person you know. One click is all it takes. And it isn’t just email anymore. Messaging, texting, and other apps can lead to infection.

 

 

What do you do about it?

Backup! Backup! Backup!

Step number one should be making sure your backup is up to date and ready to be restored. One “newer” option is DRaaS (disaster recovery as a service) but even a simple disk backup is better than nothing. Regardless, you need to spend time analyzing your current setup and determining if you need to take further steps to protect your data. If you have multiple, granular, safe and secure backups and can restore your data, you don’t have to pay the ransom.

Updates!

Keep your devices and systems on the latest version and patches. This should include firmware. Less exploitable software and devices mean that if you do get infected, it is less likely to spread.

Endpoint Protection!

Yes, you still need endpoint protection. While signature based isn’t what it used to be, companies are making strides and it is still worthwhile. You should look for something with anti-malware, anti-ransomware, and anti-exploit features. And you should protect all your devices: Mobile, desktops, laptops, physical and virtual servers.

Network/Gateway Security 

This should include some type of email protection even if you are using an outside source (Gmail, Office 365, Hosted solution) to host your email. You should also have a firewall with a strong IPS/IDS (intrusion protection system/intrusion detection system). Use VPNs whenever possible. This includes cloud and virtual. Do not make the mistake of assuming that these technologies make your network safer.

Also, please do not use a consumer class gateway/firewall. And if you insist on using one, change the default password!

Establish a Security Policy

This one may sound simple but it is possibly the most important and hardest to implement. You need to train your users. You need to train yourself. You need to have plans in place in case something does happen.

Ransomware: It's is not just a scare tactic
Ransomware: It is not just a scare tactic