Ransomeware is quite possibly the most damaging online threat. Although there are numerous defences against it, DREW VAN VUUREN, data protection officer at ESET South Africa, believes the best is user education.
Ransomware is a very real threat to businesses and individuals alike, and when it comes to online security, it is arguably the most damaging threat. Yet, many people still don’t know what ransomware is, even though this type of cyber threat has been aggressively spreading over the internet, with results that can impact both a company’s finance and reputation.
And the threat is only going to get more hostile.
The simple fact is that there is limited protection against ransomware, with no antivirus or end-point security solution technology able to protect you. Protection comes down to user-education and good business practice, and for any business, it is a must have that disaster recovery is in place if they hope to come out of a ransomware breach relatively unscathed.
Ransomware is a malware that infects a computer and encrypts all its files. Cybercriminals then offer an ultimatum to their victim: pay the demanded ransom or lose your data forever. If you are susceptible and become a target you have no choice, either you pay or rebuild your system – there is no third option. However, if you take option number one and you pay the ransom, the chances are you will again be targeted and you end up perpetuating the cycle of infection and victimization.
There are two different types of ransomware – opportunistic and targeted. The principle is that targeted ransomware will look for individuals who have access to critical and valuable information, for example, a CEO or CFO of an organization.
If you are a business that has mitigating controls in place, and you are targeted by a successful attack, then it will be a matter of invoking the disaster recovery process. This will be based on the the businesses information classification criteria and management principles.
Every organisation will have information that is deemed to be valuable – and without access to this information, a business could suffer inadvertent loss and eventually begin losing money. Therefore, the disaster recovery controls around the businesses critical information will need to allow for that data to be readily available within a certain timeframe, for business to continue.
So, what is best practice for Ransomware attacks?
- Back Up is key
The best defense against ransomware is to reduce your vulnerability in the first place. This means backing up the company’s critical and valuable information on a regular basis. Hence, if your businesses become a target of a ransomware attack, having to pay the ransom may not bear consideration as the business will have access to its valuable information that has been backed up. It is important that the companies maintain offline back-ups so that the back-ups are not readily accessible to an attacker.
- Trusted sources
Businesses should exercise good email and website safety practices – ensuring that individuals download attachments, click URLs or execute programs only from trusted sources.
- Trust warnings
When you get a security message from a web browser, take heed of it.
- Administrator Rights
Manage administrator rights accordingly. Many businesses still use the default administrator account on their network. Instead you should delete or rename the administrator account or create an account with administrator privileges.
- Educate! Educate! Educate
It should be an executive management imperative for businesses to educate their employees about the challenges around ransomware making staff aware of any security issue that arises, or is currently topical – this could be ransomware, PoPI, encryption – your people need to be aware of it.
In summary, organisations should prepare themselves for the likelihood that they may be targeted by a ransomware attacker by implementing the mitigating controls of back-up and more especially user awareness. If they maintain the vigilance outlined above they will be able to reduce the impact of the ransomware as recently evidenced by the WannaCry attack that was so effective.
Lenovo unveils world’s smallest desktop PC
ThinkCentre M90n-1 Nano is powered by 8th generation Intel processors and SSD storage, catering to flexible working
Lenovo has introduced the world’s smallest desktop PC, the ThinkCentre M90n-1 Nano, to the South African Market. It says it is designed to support diverse workplaces with the power of a full-size desktop and the space-saving convenience of a laptop.
“The ThinkCentre M90n-1 Nano is further proof of Lenovo’s commitment to helping small businesses drive efficiency in their operations,” says Thibault Dousson, General Manager at Lenovo South Africa. “In South Africa, SMEs make up a third of the country’s GDP and play an integral part in boosting the economy and creating jobs. Lack of capital, investment, resources or support are among the major challenges faced by our country’s entrepreneurs.
“Lenovo wants to help entrepreneurs grow their businesses through giving them better access to critical tools and services, such as our financial services offering and leasing option. The ThinkCentre M90n-1 Nano is ideal for small business owners as it is reliable and powerful yet compact and easily transportable.”
Delivering powerful performance in an ultra-portable size, the ThinkCentre M90n-1 Nano is the most compact commercial desktop series in the world. Compact models are one-third the size of the ground-breaking ThinkCentre Tiny, at just 0.35L in volume.
With fully functional USB Type-C Gen2 and USB 3.1 Gen2 ports located on the front and back of the device, multiple displays, docks and other hardware options can further boost productivity. The ability to be powered using just one cable to a USB Type-C monitor makes the M90n-1 Nano ideal for a clutter-free workspace, whether it be placed behind a screen or under a desk.
The ThinkCentre M90n-1 Nano is MIL-810G SPEC tested – built to withstand extreme conditions including shocks, drops, dust and humidity. The desktop’s HW TPM 2.0 chip encrypts data to keep sensitive data secure, while its Kensington lock slot enables users to physically secure the device to an immovable object, protecting it from theft.
With its Modern Standby feature, users can receive emails, VoIP calls and instant messages while remaining in standby mode. When ready to commence work, the M90n-1 Nano resumes full functionality in under one second.
These features make the ThinkCentre M90n-1 Nano an easy fit across all office environments, or wherever space is limited, and staff are mobile. The ThinkCentre M90n-1 Nano also reduces energy consumption by as much as 30 percent annually over the ThinkCentre Tiny.
Powered by the 8th generation Intel processors and backed by SSD (solid state drive) storage, the ThinkCentre M90n-1 Nano offers diverse connectivity and multi-user options to keep users connected.
Hackers target hotels
Kaspersky’s research of the RevengeHotels campaign aimed at the hospitality sector, has confirmed over 20 hotels in Latin America, Europe and Asia have fallen victim to targeted malware attacks. Even more hotels are potentially affected across the globe. Travelers’ credit card data, which is stored in a hotel administration system, including those received from online travel agencies (OTAs), is at risk of being stolen and sold to criminals worldwide.
RevengeHotels is a campaign that includes different groups using traditional Remote Access Trojans (RATs) to infect businesses in the hospitality sector. The campaign has been active since 2015 but has gone on to increase its presence in 2019. At least two groups, RevengeHotels and ProCC, were identified to be part of the campaign, however more cybercriminal groups are potentially involved.
The main attack vector in this campaign is emails with crafted malicious Word, Excel or PDF documents attached. Some of them exploit CVE-2017-0199, loading it using VBS and PowerShell scripts and then installing customised versions of various RATs and other custom malware, such as ProCC, on the victim’s machine that could later execute commands and set up remote access to the infected systems.
Each spear-phishing email was crafted with special attention to detail and usually impersonating real people from legitimate organisations making a fake booking request for a large group of people. It is worth noting that even careful users could be tricked to open and download attachments from such emails as they include an abundance of details (for instance, copies of legal documents and reasons for booking at the hotel) and looked convincing. The only detail that would reveal the attacker would be a typosquatting domain of the organisation.
A phishing email sent to a hotel impersonating a booking request from an attorney’s office
Once infected, the computer could be accessed remotely not just by the cybercriminal group itself — evidence collected by Kaspersky researchers shows that remote access to hospitality desks and the data they contain is sold on criminal forums on a subscription basis. Malware collected data from hospitality desk clipboards, printer spoolers and captured screenshots (this function was triggered using specific words in English or Portuguese). Because hotel personnel often copied clients’ credit card data from OTA’s in order to charge them, that data could also be compromised.
Kaspersky telemetry confirmed targets in Argentina, Bolivia, Brazil, Chile, Costa Rica, France, Italy, Mexico, Portugal, Spain, Thailand and Turkey. However, based on data extracted from Bit.ly, a popular link shortening service used by the attackers to spread malicious links, Kaspersky researchers assume that users from many other countries have at least accessed the malicious link – suggesting that the number of countries with potential victims could be higher.
“As users grow wary of how protected their data truly is, cybercriminals turn to small businesses, which are often not very well protected from cyberattacks and possess a concentration of personal data. Hoteliers and other small businesses dealing with customer data need to be more cautious and apply professional security solutions to avoid data leaks that could potentially not only affect customers, but also damage hotel reputations as well,” comments Dmitry Bestuzhev, Head of Global Research and Analysis Team, LatAm.
To stay safe, travelers are recommended to:
- Use a virtual payment card for reservations made via OTAs, as these cards normally expire after a single charge
- When paying for a reservation or checking out at hotel desks, use a virtual wallet, such as Apple Pay or Google Pay, or a secondary credit card with a limited amount of debit available
Hotel owners and management are also advised to follow these steps to secure customer data:
- Conduct risk assessments of the existing network and implement regulations regarding how customers data is handled
- Use a reliable security solution with web protection and application control functionality, such as Kaspersky Endpoint Security for Business. Web protection helps to block access to phishing and malicious websites while application control (in white list mode) allows to make sure that no application except the white listed ones can run on hospitality desk computers.
- Introduce staff security awareness training to teach employees how to spot spear-phishing attempts and show the importance of remaining vigilant when working with incoming emails.
Read the full report, RevengeHotels: cybercrime targeting hotel desks worldwide, on Securelist.