A recent study has revealed that in addition to cybercriminals using a range of new techniques to attack corporate computers, well over half of them were hit with one attempted malware infection during 2015.
Cyberattack tools used against businesses in 2015 were different to those used against consumers, according to Kaspersky Lab’s review of corporate threats last year. They included greater exploitation of legitimate software programmes and malware being signed with valid digital signatures to keep malicious files hidden for longer. Kaspersky Lab’s experts also observed a steady rise in the number of corporate users attacked by ransomware.
Kaspersky Lab’s experts found that in 2015 well over half (58%) of corporate PCs were hit with at least one attempted malware infection, up three percentage points on 2014. One in three (29%) business computers were exposed at least once to an Internet-based attack; with the exploitation of standard office applications seen three times as often as in consumer attacks.
Further, 41% of business computers faced local threats, such as from infected USB sticks or other compromised removable media. The experts also noted a 7% increase in the share of exploits targeting the Android platform, confirming hackers’ growing interest in data stored on employees’ mobile devices.
These attacks were found to be carefully planned, with cyber-attackers taking time to investigate a target company’s contacts and suppliers and even the personal interests and browsing habits of individual employees. This insight was then used to identify legitimate websites for compromise and malware distribution, with the attacks often repeated over time.
“The future cyber-landscape for business includes a new attack vector: infrastructure, because almost all of an organisation’s valuable data is stored on servers in data centers. We also expect tougher safety standards from regulators, which could lead to more cybercriminals being arrested in 2016,” says Yury Namestnikov, Senior Security Researcher at Global Research and Analysis Team, Kaspersky Lab.
In 2015, cyber-criminals and advanced persistent threats (APT) groups focused a great deal of attention on financial services organisations, such as banks, investment funds, and both stock and currency exchanges, including those handling cryptocurrencies.
These attacks included Carbanak, which penetrated the networks of banks, seeking out critical systems that would allow it to withdraw money. One successful attack alone would bring in as much as $2.5 – $10 million dollars. The cyber-espionage group, Wild Neutron also spent much of 2015 hunting down investment companies as well as organisations working with the cryptocurrency Bitcoin and companies involved in mergers and acquisitions.
Kaspersky Lab’s experts observed a growing diversification in attack targets. For example, in 2015, the Chinese APT, Winnti APT switched targets from companies involved in computer games to those in pharmaceuticals and telecommunications.
Stealing at point of sale
Point-Of-Sale terminals, used by retailers and other consumer-facing organisations were another target for attack in 2015, with Kaspersky Lab products blocking more than 11,500 attempts to hack into PoS devices. The company knows of ten families of programmes designed to steal data from PoS terminals, and seven of them appeared for the first time this year.
The rise and rise of ransomware
2015 also saw a doubling of the number of cryptolocker attacks, with Kaspersky Lab detecting cryptolockers on more than 50 thousand corporate machines. This could reflect the fact that ransoms received from organisations can be far larger than those received from individuals. There is also a greater likelihood of the ransom being paid. Many companies simply cannot function if the information on several critical computers or servers is encrypted and inaccessible.
Kaspersky Lab recommends that companies take steps to reduce risk and to increase their knowledge of the latest threats. The basic principles of security in corporate networks remain the same: train employees, establish robust security processes and make full use of new technologies and techniques as each additional layer of protection reduces the risk of network penetration. To eliminate the threat of ransomware infection, companies should use protection against exploits and ensure that their security solutions include behavioural detection methods, such as Kaspersky Lab’s System Watcher.
Huge appetite for foldable phones – when prices fall
Samsung, Huawei and Motorola have all shown their cards, but consumers are concerned about durability, size, and enhanced use cases, according to Strategy Analytics
Foldable devices are a long-awaited disrupter in the smartphone market, exciting leading-edge early adopters keen for a bold new type of device. But the acceptance of foldable devices by mainstream segments will depend on the extent to which the current barriers to adoption are addressed.
Major brands have been throwing their foldable bets into the hat to see what the market wants from a foldable, namely how big the screens should be and how the devices should fold. Samsung and Huawei have both designed devices that unfold from smartphones to tablets, each with their own method of how the devices go about folding. Motorola has recently designed a smartphone that folds in half, and it resembles a flip phone.
Assessing consumer desire for foldable smartphones, a new report from the User Experience Strategies group at Strategy Analytics has found that the perceived value of the foldable form does not outweigh the added cost.
Key report findings include:
- The idea of having a larger-displayed smartphone in a portable size is perceived as valuable to the vast majority of consumers in the UK and the US. But, willingness to pay extra for a foldable device does not align with the desire to purchase one. Manufacturers must understand that there will be low sell-through until costs come down.
- But as the acceptance for traditional smartphone display sizes continues to increase, so does the imposed friction of trying to use them one-handed. Unless a foldable phone has a wider folded state, entering text when closed is too cumbersome, forcing users to utilize two hands to enter text, when in the opened state.
- Use cases need to be adequately demonstrated for consumers to fully understand and appreciate the potential for a foldable phone, though their priorities seemed fixed on promoting ‘two devices in one’ equaling a better video viewing experience. Identification and promotion of meaningful new use cases will be vital to success.
Christopher Dodge, Associate Director, UXIP and report author said: “As multitasking will look to be a core selling point for foldable phones, it is imperative that the execution be simplified and intuitive. Our data suggests there are a lot of uncertainties that come with foldable phone ownership, stemming mainly from concerns with durability and size, in addition to concerns over enhanced use cases.
“But our data also shows that when the consumers are able to use a foldable phone in hand, there is a solid reduction of doubt and concern about the concept. This means that the in-store experience may more important than ever in driving awareness, capabilities, and potential use cases.”
Said Paul Brown, Director, UXIP: “The big question is whether the perceived value will outweigh the added cost; and the initial response from consumers is ‘no.’ The ability for foldable displays to resolve real consumer pain-points is, in our view critical to whether these devices will become a niche segment of the smartphone market or the dominant form-factor of the future. Until costs come down, these devices will not take off.”
New exploit exposes credit cards on mobile phones
Check Point Security has found that handsets using Qualcomm chipsets that hold credit and debit card credentials are at risk of a new exploit.
Now it’s more important than ever to update your phone.
Check Point security has found a vulnerability in mobile devices that run Android, which allows credit card details to be accessed by hackers.
Mobile operating systems like Android offer a Rich Execution Environment (REE), providing a hugely extensive and versatile runtime environment, which allows apps to run on the device. However, while bringing flexibility and capability, REE leaves devices vulnerable to a wide range of security threats. A Trusted Execution Environment (TEE) is designed to reside alongside the REE and provide a safe area on the device to protect assets and to execute trusted code. Qualcomm makes use of a secure virtual processor, which is often referred to as the “secure world”, in comparison to the “non-secure world”, where REE resides.
But Check Point “fuzzed” a “hole” into this secure world
In a 4-month research project, Check Point researchers attempted and succeeded to reverse Qualcomm’s “Secure World” operating system. Check Point researchers leveraged a “fuzzing” technique to expose the hole. Fuzz testing (fuzzing) is a quality assurance technique used to discover coding errors and security loopholes in software, operating systems or networks. It involves inputting massive amounts of random data, called fuzz, to the test subject in an attempt to make it crash.
Check Point implemented a custom-made fuzzing tool, which tested trusted code on Samsung, LG, and Motorola devices. Through fuzzing, Check Point found 4 vulnerabilities in trusted code implemented by Samsung (including S10), 1 in Motorola, 1 in LG, but all code sourced by Qualcomm itself. To address the vulnerability, the runtime of Android needs to be protected from both attackers and users. This is typically achieved by moving the secure storage software to a hardware-supported TEE.
Check Point Research disclosed its findings directly to the companies and gave them time to patch vulnerabilities. Samsung patched three vulnerabilities and LG patched one. Motorola and Qualcomm responded, but have yet to provide a patch, and there is no confirmation of a release date yet.
Check Point Research has urged mobile phone users to stay vigilant and check their credit and debit card providers for any unusual activity. In the meantime, they are working with the vendors mentioned to issue patches.