Share This

Showing posts with label malware. Show all posts
Showing posts with label malware. Show all posts

Wednesday, August 30, 2023

When malware strikes


Knowing what to do can be the difference between a costly trip to the repair shop and a diy fix at home.

MANY of us have been there before – an accidental click or file download that leaves us worrying about whether our passwords have been stolen or our webcam has been compromised.

Or maybe it’s the system becoming slow, erratic, freezing, or crashing, which may hint that something strange is going on with your machine.

But hiring a professional can be an expensive affair, and lugging around an entire desktop computer for troubleshooting is anything but fun, so it’s best to check if you can fix the issue yourself.

Those on Windows 7 or 8 should take note that their operating system (OS) is in end-of-life status, making it especially vulnerable to malware as it no longer receives security updates.

Antivirus 101

One thing to keep in mind is that no antivirus or anti-malware tool is perfect, as one may detect a virus while another misses it completely.

Like seeing a doctor, it’s valuable to have a second opinion in the form of another software scanner. Good options include Malwarebytes, Avast Antivirus, and antivirus programs from Kaspersky.

However, the first thing you’ll want to do is download Rkill (bit.ly/rkill), a handy tool from Bleeping Computer that kills malware still resident in memory and running in the background, also known as “processes”. It will also list them in a text file.

This is vital, as active malware can attempt to trick and hide from antivirus programs.

Then do an antivirus scan – don’t use more than one at the same time, as simultaneous scans can result in the antivirus programs mistaking each other for malware.

If the scans turn up positive, potentially malicious items will be listed, and the antivirus will prompt you on what action to take, such as to quarantine or remove the affected file or folder.

It’s best practice to look up the name listed by the antivirus, as it could be a false positive.

Then switch over to the alternative antivirus tool and run another scan to cover blind spots.

If the antivirus discovered an issue and fixed it, then all is well; otherwise, you will have to get your hands dirty by engaging in a little “digital forensics”.

‘Suite up’, digital detective

Your digital forensics work will require a toolkit to analyse and understand your computer better, especially what’s causing the issue.

Our recommendation is the Sysinternals Suite (bit.ly/sysinternalssuite), a set of utilities from Microsoft that provides a detailed view of what each and every program and process is doing.

Like Rkill, Sysinternals is meant to do the same, except that you will be the one identifying, disabling, and removing the malware manually.

One of the most useful tools it contains is the Process Explorer (procexp64.exe in the Suite folder), which lists all the active processes in a system, one of which could be malware.

In Process Explorer, click on the options tab and enable the options for both “Verify Image Signatures” and “Check Virustotal.com”.

Things to look for here are processes without descriptions or verified image signatures from a third-party vendor to indicate it’s a legitimate program.

The description and signature columns may turn up blank for some Windows processes, so ignore those and focus on the ones labelled “unverified”.

Virustotal.com is a website that collates information from 75 different malware-scanning engines because, you know, who needs a second opinion when you can get 75?

If a process is legitimate, then it should have a proper description, a verified image signature from a third-party vendor (like Microsoft or Adobe), and not be flagged by any of the antivirus engines (0/75).

A side note: users looking to check if a specific file is malware can also upload it directly to Virustotal.com, though the size is limited to 650MB.

Make sure to look up each process to find out more about it before taking action, as there are many different types of malware out there, with some being more difficult to remove. There’s a shortcut to searching online included in the right-click menu to help with this. Process Explorer can also be used to uncover processes that are utilising the resources of your graphic card, RAM, and storage.

For a more granular view of what a process is doing, the Process Monitor (Procmon64.exe) tool includes details like where a process is writing a file and whether it’s making a network connection to upload something.

Do note that it is still not immune to false positives. Two of my legitimate processes are always flagged by Virustotal: Apagent.exe (for an Apple Airport Router that was repurposed as network attached storage) and Gaming services. exe (an official process from Microsoft for its video game platform and store).

When a malicious process is discovered, right-click and view its properties, which will reveal details like how it is being launched and where the file is being stored.

Like with Rkill, you will need to kill the malicious process, though some malware types run multiple processes at once so that they can restart each other as you kill them.

In this case, it’s best to “suspend” the target processes first before terminating them.

Then move on to the Autoruns (Autoruns64.exe) tool to disable it from starting up automatically when the machine turns on.

Avoid deleting the entry right away since it could be a misidentified process; instead, disable it first to confirm it is indeed malware.

Once sure, navigate to the folder hous usually ing the malware – these are “user folders” like Temp or Appdata, as administrative rights are not required for malware to access them – and delete the source file to end your woes.

Though, for more complex malware, manual removal may be difficult or downright impossisure ble, so make to check what is involved.

In the worst scenario, case there’s always the nuclear option of doing a clean install of Windows, but this will wipe out your entire system.

Source link

Related post:

DIGITAL WAVE of deception

DIGITAL WAVE of deception


Wednesday, August 20, 2014

What the hack were they up to, MH370?

Hackers target information on MH370 probe

The computers of high-ranking officials in agencies involved in the MH370 investigation were hacked and classified information was stolen.

The stolen information was allegedly being sent to a computer in China before CyberSecurity Malaysia - a Ministry of Science, Technology and Innovation agency - had the transmissions blocked and the infected machines shut down.

The national cyber security specialist agency revealed that sophisticated malicious software (malware), disguised as a news article reporting that the missing Boeing 777 had been found, was emailed to the officials on March 9, a day after the Malaysia Airlines (MAS) plane vanished during its flight from Kuala Lumpur to Beijing.

Attached to the email was an executable file that was made to look like a PDF document, which released the malware when a user clicked on it.

A source told The Star that officials in the Department of Civil Aviation, the National Security Council and MAS were among those targeted by the hackers.

"We received reports from the administration of the agencies telling us that their network was congested with email going out of their servers," said CyberSecurity Malaysia chief executive Dr Amirudin Abdul Wahab.

"Those email contained confidential data from the officials' computers including the minutes of meetings and classified documents. Some of these were related to the MH370 investigation."

About 30 computers were infected by the malware, CyberSecurity Malaysia said. It discovered that the malware was sending the information to an IP address in China and asked the Internet service provider in that region to block it.

An IP (Internet Protocol) address is a unique numerical label assigned to each device on a computer network.

"This was well-crafted malware that antivirus programs couldn't detect. It was a very sophisticated attack,'' Amirudin said.

The agency and police are working with Interpol on the incident.

CyberSecurity Malaysia suspects the motivation for the hacking was the MH370 investigations.

"At that time, there were some people accusing the Government of not releasing crucial information,'' Amirudin said. "But everything on the investigation had been disclosed."

Flight MH370 with 239 on board went missing on March 8 about 45 minutes after take-off.

Expert: Spearphishing needs a lot of planning and work


Spearphishing attacks such as the ones that targeted the Civil Aviation Department and the National Security Council require a lot of planning and work, said a cyber security expert.

These point to either a very skilled attacker or group of hackers who have the know-how to spoof an email address to make it appear as if the message is coming from a familiar sender, said Dhillon Kannabhiran.

He is chief executive of Hack In The Box which organises the annual HITBSecConf series of network security conferences.

He said that sensitive and confidential documents should always be encrypted as an added layer of security against hackers.

How sophisticated an attack was, Kannabhiran said, depended on which version of the Microsoft Windows operating system was on the victim's computer and how up to date the system security was.

By Nicholas Cheng, The Star/Asia News Network

Related posts:

Malaysia is poised to escape the middle-income trap, but also ready to fall back into it. Normally the middle-income trap refers to count...
 
Photo taken on July 17, 2014 shows the debris at the crash site of a passenger plane near the village of Grabovo, Ukraine. A Malaysian...
Malaysia is poised to escape the middle-income trap, but also ready to fall back into it. Normally the middle-income trap refers to count...
 
Boeing has patent for autopilot tech: When it was first speculated that Flight MH370 could have been hijac...

Sunday, June 9, 2013

Malware, ransomware attacks are a growing threat to computer and mobile phone!

FORGET pickpockets or thieves. The biggest threat to your smartphone now is kidnappers cyber “kidnappers” that is, with their Ransomware.

As the name suggests, ransomware is a malware (malicious software) that will keep your phone or computer a prisoner until you pay a ransom. Only when the specified amount of money is paid will you be able to “free” your device and access data or information.

Although it is not new ransomware is said to originate from Russia in 2005 and has been attacking many computers worldwide since the Symantec Corp Internet Security Threat Report (ISTR) Volume 18 revealed that ransomware is emerging as the malware of choice because of its high profitability for attackers.

Luckily, says Symantec Malaysia's senior technical consultant David Rajoo, to his knowledge, no cases have been reported here yet.

“However, as the worldwide web has no boundaries and with increasing broadband penetration and as more users are accessing the Internet, Malaysia is certainly exposed to the Ransomware threats,” he says.

Infected machines display messages which demand payment in order to restore functionality. - David Rajoo Infected machines display messages which demand payment in order to restore functionality. - David Rajoo
Rajoo points out that awareness is key to combat ransomware threat.

As the report highlights, attackers are using deceptive links and poisoned websites to infect unsuspecting users with malicious software and lock their machines.

“The attackers, many of them cybercriminal organisations, then hold users' machines for ransom. Infected machines display messages which demand payment in order to restore functionality,” he tells.

Recent attacks have also displayed images that impersonate law enforcement.

Consumers on the Android platform are most vulnerable to ransomware and mobile threats, says the report.

Last year, mobile malware increased by 58%, and 32% of all mobile threats attempted to steal information, such as e-mail addresses and phone numbers.

Although Android has fewer vulnerabilities, its threats are higher than any other mobile operating system. Its open platform and the multiple distribution methods available to distribute malicious apps make it the go-to platform for attackers, adds the report.

With malware growing sophisticated every day, Rajoo adds, a mix of intelligence-based technologies can provide optimal security to stop new and unknown malware.

To avoid getting infected, ensure the device's software and anti-virus definitions are up to date, and avoid suspicious sites, Rajoo advises.

“We also advise users to use more than antivirus for protection. We recommend using advanced reputation security which provides layered defence. Use more than just Antivirus use a full functionality solution which includes heuristics, reputation-based, behaviour-based and other technologies,” he says, stressing that a key strategy is to fend off threats before they infiltrate your computer system.

Symantec Malaysia's Systems Engineering director Nigel Tan agrees that stopping the threat at the gate is important as cyber criminals continue to devise new ways to steal information from organisations of all sizes.

Staying ahead of attacks

“The sophistication of attacks coupled with today's information technology complexities require organisations in Malaysia and globally to remain proactive and use “defence in depth” security measures to stay ahead of attacks,” he added.

According to the annual ISTR which analyses the year in global threat activity, Malaysia was ranked 35th on its global Internet security threat profile in 2012.

As it highlights, there was a 42% surge last year in targeted attacks globally compared with the prior year.

These targeted cyberespionage attacks, designed to steal intellectual property, are increasingly hitting the manufacturing sector as well as small businesses, which are the target of 31% of these attacks.

Small businesses are attractive targets themselves and a way in to ultimately reach larger companies via “watering hole” techniques.

In a watering hole attack scenario, attackers compromise a carefully selected website by inserting an exploit resulting in malware infection. Through the compromised website, the attackers will target victims who visit the compromised site and take advantage of their software vulnerabilities to drop malware that will allow them to access sensitive data and take control of the vulnerable system.

As Symantec alerts, 61% of malicious websites are actually legitimate websites that have been compromised and infected with malicious code.

Business, technology and shopping websites were among the top five types of websites hosting infections. The shift of focus from government websites indicates an increase in attacks targeting the supply chain cybercriminals find these contractors and subcontractors susceptible to attacks and they are often in possession of valuable intellectual property.

The attack uses the security weaknesses in the supply chain specifically the small businesses to gain access into larger and more secured companies, adds Symantec.

Case in point is that those in sales became the most commonly targeted victims last year.

Another growing source of infections on websites is malvertisements this is when criminals buy advertising space on legitimate websites and use it to hide their attack code.

Tan urges organisations to continue to take proactive initiatives to secure and manage critical information from a variety of security risks, especially targeted attacks in the manufacturing and small business sectors, mobile malware, and phishing threats.

By HARIATI AZIZAN sunday@thestar.com