Tag Archives: General

The top three questions the Avast Mobile Security team got asked at CARTES

It was great to see so many people who recognize the Avast brand and use our products at CARTES. We would like to say once more: Thank you so much! Every couple of minutes, we had a friendly visit from some of our fans and we always tried to talk to them for a while. Sometimes we got some interesting questions. We would like to share those that occurred the most.

1. Are you guys from the Netherlands?

No. :) Despite the orange color all over the place, Avast is a Prague- (that beautiful city in the Czech Republic that you read about in the travel magazines) based company with offices all over the world including Silicon Valley, Austin, Munich, and Hong Kong.

prague castle

A view of the beautiful Prague castle.

2. How do you make money if your products are free?

In general, we monetize our products both directly (via premium subscriptions or paid product versions) and indirectly (via ads in our applications, or partnerships / referrals, i.e.). On mobile, we are not making much money these days, compared to our desktop products. However, mobile apps are a great part of our product ecosystem. They help us build the brand and engage with people who use them. Our mobile products solve real problems and make the world a better, more secure place. In the future, we see a good potential to monetize mobile applications indirectly, due to our multi-million user base.

3. Why are you a better desktop Antivirus than XYZ?

“Better” is never a good word when talking about competition with modesty and respect. We have some compelling features in our Antivirus products. Check out the Home Network Security, SafeZone or process virtualization in our Avast 2015 version. Or you can try the Free version for yourself and compare our product with the Antivirus you have at the moment.

Did you like the article? Follow the author at @joshis_tweets.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

How to change your router DNS settings and avoid hijacking

If your home router is hacked, you have a serious situation on your hands.

When an Avast Home Network Security scan finds that your router is already compromised, this notification will appear.

Your WiFi network is not secured

Your WiFi network is not secured

This means that the router has been hacked and the DNS settings have been modified to serve hacked contents to a cyberthief. This is a pretty serious situation. When hackers exploit router vulnerabilities, gain access to it, and modify the DNS servers settings, all your Internet traffic can be forwarded to rogue servers. This is called a man-in-the-middle attack.

The DNS or Domain Name System, is the “phone book” of the Internet, and an IP address is what’s listed in the book. DNS names computers, services, or any resource connected to the Internet or a private network. It translates easily memorized domain names, for instance, www.example.com, to the unique numerical IP addresses needed to locate the service worldwide.

What happens when your router is hacked?

Instead of connecting to a clean site or service, when your router is hacked, you’ll visit a rogue and hacked one. It’s obvious that your privacy will be violated, and your banking information could be captured – by the man-in-the-middle mentioned above. Even the usually secure SSL, the HTTPS protocol we have all been instructed to look for to indicate a secure site, won’t assure you’re protected. Instead, you’ll be proxied through malicious servers and the encrypted connection is cut in the middle. This illustration shows what happens.

 

Your WiFi network is not secured

Source: http://www.cert.pl//news/8019/langswitch_lang/en

This could also happen if your router is set to default/weak/factory password. So, the worst scenario of hacking is not that uncommon. See the latest news about webcams being hacked because of the owner’s using default passwords. Vincent Steckler, CEO of Avast, told VentureBeat that consumers are notorious for not updating default passwords, just as I’m talking about here. Some 63 percent of wireless routers run with default passwords, says Steckler.

The problem goes further than just one user or one device. The malicious effects can spread to all users in the local network, regardless of the operating system used.

How to protect ourselves against this plague?

First, scan your home network with Avast Home Network Security to verify if your device is compromised. If Avast alerts you, it’s already too late. You’ve already been compromised. You need to manually check the DNS servers in the router configuration.

By default, your router uses DNS servers automatically acquired from your Internet provider. All the devices on your network — PCs, smartphones, tablets, game consoles, and anything else connected to the network — get their DNS server from the router. You can change the DNS server on your router, therefore changing every other device on your network.

There are several good articles on the Internet about changing your DNS. Here’s one from howtogeek.com.

You also need to pay attention to your browser address bar. The HTTPS indicator should be there all the time. If it comes and goes, you may have already been compromised. In these cases, or for any other strange symptom you could be experiencing: Disable your Internet connection immediately and change the router username and password to unique ones (consult the router manual for instructions).

But, be warned, neither of these will be enough because if the router is vulnerable, it will take the attacker no time to change the settings back. Updating the router firmware or even changing it completely – as described in previous article – will be necessary.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

 

 

Avast apps make mobile payments safer

The Avast Mobile Security team showcased secure solutions for payment, identification and mobility at the CARTES conference.

The Avast Mobile team had a couple of busy days in November – we participated at CARTES Secure Connexions 2014 and showcased some of our best mobile apps in the “Mobile payments” pavilion. In our traditional and authentic guerrilla style, we drove a truck to Paris, we built the stand ourselves (and almost got killed dismantling it the last day), and we greeted our friends and product users in person, with no external hostesses; only Avast Mobile crew members equipped with mint candies, product fliers, and an unlimited dose of enthusiasm. :-)

CARTES 1

You may ask yourself, what was my mobile antivirus provider doing at CARTES, a global event for the digital security industry?

Because of the experience the Inmite acquisition brought to Avast Mobile, the Avast team knows a thing or two about mobile payments security, and we believe we can bring additional value to this topic with our products.

Mobile payment security starts and ends with the customer

While there are many techniques app makers or payment institutions such as a banks use to secure their mobile applications, recent attacks show that the weakest part of the chain are end clients – in other words – you and me. Face it, most people tend to underestimate potential threats, they fall for phishing attacks or attacks by social engineering, they connect to insecure public Wi-Fi hotspots, and they know in most cases, that banks will handle possible issues they have gracefully. In many cases, banks will even refund complete financial loss in order to keep their reputation high. The value Avast can bring to the table is the fact that most of our solutions are oriented towards the end users and their devices – we help where the additional help is needed.

airbondSecuring your mobile device better is simple

At CARTES, we presented three products for mobile:

This selection of products was not random. Each of the products protect people and their payments at different “stages”.

AIR BOND is our patent pending HW authentication token based on Bluetooth Low Energy. It wirelessly communicates with your smartphone or tablet and co-signs your transactions before they are sent to the server. It requires no special effort, like rewriting a numeric code or putting an NFC tag close to your iPhone (that does not support NFC this way anyway ;-). )You can use your mobile banking or payment app as long as your AIR BOND is nearby. If you lose your phone or somebody steals it, your banking is instantly safe – proximity to the AIR BOND device is required in order to execute transactions (all of them or only some of them depend on AIR BOND deployment type at each individual bank).

SecureLine VPN is an easy-to-use VPN solution for mobile and desktop. You can download the app from the iTunes App Store or from Google Play, turn the switch on and use your phone normally. No special setup is needed on your end; we take care of the server infrastructure and all the nasty configuration that is usually required for VPN solutions to work.

SecureLine encrypts and anonymizes your communication while your payments are being sent to the server. Since most of the mobile communication happens in the public space, often at an unknown and improperly secured Wi-Fi hotspots, this mechanism brings a great deal of “practical security” to normal people. Most of the current network security issues are with the nearest router or with ISP infrastructure – basically in the first 10 miles of communication.

VPNAvast Mobile Security & Antivirus is the hottest mobile product today and it recently got a major facelift in order to become even more sleek and sexy. It is an Android app that includes antivirus, anti-theft (must be installed separately to the app, since anti-theft goes deep in the system), and several very handy security / privacy features, like App locking (adds a PIN code login screen to any app you have), or Call & SMS filter (blocks annoying calls and unwanted SMS messages). This application can protect your payments when your Android phone is under fire and everything is about to go wrong. For example, when you install a potentially malicious application, or when you lose your phone or somebody steals it from you, this app is here to protect you.

Every bank should suggest security products to their clients

In my personal experience, banks and payment institutions usually make mobile apps that are reasonably well secured in their implementation. However, security is a complex issue where an interplay of many components is needed to achieve good results. Protection at the end user level is one of these components, being a valuable addition to the built-in application security or security implemented within the bank’s back-end systems.

Banks and other payment institutions should educate their clients and recommend  products that protect their accounts and payments on their devices. Does your bank do that for you? If not, this is an opportunity – help us spread the word about Avast products! :-)

Did you like the article? Follow the author at @joshis_tweets.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

Keep track of your family’s devices using your Avast Account

The average US family owns four mobile devices, plus Internet-connected computers and other devices. Your Avast Account helps you manage their security.

Avast Account screenshot

Manage all your devices with a free Avast Account.

Keeping your security software up-to-date on all of these devices can quickly get confusing, and with today’s risks you want to make sure everything has adequate protection. Your Avast Account can simplify that task greatly.

Here’s what you get with an Avast account

Management made easy

  • Register any Avast free product which you have installed and which requires registration.
  • Manage multiple Avast-protected devices (PC, smartphone, tablet) from one place.
  • Remotely control Android mobile devices with Avast Mobile Security and Avast Anti-Theft installed. This is especially useful in case of loss or theft of the device .

Information at your fingertips

You can find information about your connected devices.

  • License status
  • Expiration date
  • Basic statistics
  • Version of virus signature database
  • Logs of activities, and more

Earn Avast Reward points for free stuff

You can generate your own special Avast Free Antivirus link to give to your family members and friends. When they download their own protection using your link, you collect “Karma” points to earn a free copy of Avast Internet Security. In your Avast Account, you can see how many points you have, earn badges and even see how you’re doing compared to other users.

Give Avast feedback

We provide links to the Avast Community Forum where you can ask questions of our experienced “evangelists,” and the Feedback page, where you can give suggestions, report a problem, or just say thanks.

Secure your Facebook profile

You can secure your Facebook profile using Avast Social Media Security. We help you navigate thorough the frequently changing security and privacy settings in Facebook. In the future we plan to add security profiles on other social networks.

How do I get an Avast Account?

New registrations of Avast Free Antivirus will automatically create an Avast Account and connect your device automatically. Visit https://my.avast.com or click Account in the Avast user interface. Use of the Avast Account for accessing other Avast services is completely optional.

NOTE: It’s especially useful to connect any mobile devices that have Avast Mobile Security installed because it gives you remote control over your device if the device is stolen. These remote control features have not yet been implemented for PC or Mac devices, therefore if you are not interested in the activity log or other information, you don’t have to connect your device to your Avast Account at all.

When you do connect your device, please be patient because of the large amount of data we have to process; the device status isn’t updated in real-time. It could take up to a half hour before the actual security status and other device information appears on the devices page, so check again later.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

How to upgrade your router with the latest firmware or replace it completely

It’s difficult to accept that we made an unwise purchase or even that a piece of technology has gone obsolete. But when it comes to the security of your home network, it’s time to face up to it.

Last February, Craig Young, a researcher at security firm Tripwire, published research showing that 80% of the 25 best-selling small office/home office (SOHO) wireless router models on Amazon had vulnerabilities. Because some routers, in fact, a lot of them, have so many non-patched vulnerabilities, the easiest way to secure your home network is to replace the router completely with a secure model.

Your WiFi network is not secured

Your WiFi network is not secured

 

How to update your router

But let’s not spend your money yet. Only four of the reported vulnerabilities were completely new, and many have been patched in later models, so you should first look for firmware updates. Some conscious manufactures release updates for their hardware controls and, if applied, could solve all (or at least some) known vulnerabilities.

Routers do not perform automatic updates, so the process requires appropriate patches to be manually downloaded and installed. Avast 2015 includes a Home Network Security scanner that can help you determine what needs to be done, explain why, and can direct you to the router manufacturer’s website.

Open the Avast user interface, click Scan from the menu on the left, then choose Scan for network threats. Avast will take a look at your router and report back any issues. In most cases, if there is an issue to be addressed, then it will direct you to your router manufacturer’s website.

Yes, Virginia, there is a Santa Claus Router Attack

If you’re not convinced that router attacks are something to be concerned about, then think back on the attack from earlier this year. Attackers remotely altered DNS configurations for more than 300,000 small office/home office (SOHO) routers, subsequently opening up victims to a host of compromises

Among several vulnerabilities around, there is one that is quite common. It’s called ROM-0 and allows the attacker to easily gain control of the whole router and, subsequently, your Internet connection. In short, the attacker could request ROM-0 through HTTP (i.e. http://192.168.1.1/ROM-0) and then he can download all the important and secret data stored in your router: Your ADSL login/password combination, WIFI password and basically all your configuration data.

How to avoid attackers from downloading your Rom-0 configuration file and manipulating your router?

It’s simple (if you are comfortable around computers. Ask a techie to help you, if you’re not):

  • Forward port 80 on the router to a non-used IP address on your network.
  • Enter your router configuration and go to “Port forwarding” configuration.
  • Send all http traffic, of all protocols, to star and end port 80 in a non-used local IP address (something like 192.168.0.xxx, where xxx would be a non-used IP).

There are free guides of “port forwarding” for quite a lot of routers. Check your model here.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

 

 

Home Depot discloses that 53 million customer email addresses were stolen

Home-Depot-ApronThe Home Depot security breach last spring has gotten worse. In addition to the 56 million credit-card accounts that were compromised, around 53 million customer email addresses were also taken, according to a statement from Home Depot about the breach investigation. Home Depot assures its customers that no passwords, payment card information like debit card PIN numbers, or other “sensitive” information was stolen.

The breach occurred when cybercrooks stole a third-party vendor’s user name and password to enter their network in April 2014. The hackers then deployed unique, custom-built malware on Home Depot’s self-checkout registers in the United States and Canada.

The company said that as of September 18, the malware had been eliminated from the network.

Request your free identity protection

The Home Depot is notifying affected customers and still offering free identity protection services, including credit monitoring, to any customer who used a credit or debit card at one of its 2,266 retail stores beginning in April. Customers who wish to take advantage of these services should visit homedepot.allclearid.com or call 1-800-HOMEDEPOT (466-3337).

The Fallout

Home Depot said that customers should be on guard against phishing scams, which are designed to trick customers into providing personal information in response to phony emails.

  • Review your credit card statements carefully and call your bank if you see any suspicious transactions.
  • Be aware of phone calls or emails that appear to offer you identity theft protection but are truly phishing schemes designed to steal your information. Always go directly to The Home Depot’s website or to the AllClear ID website, or call Equifax for information rather than clicking on links in emails.

Get more information from Home Depot’s Facebook page.

// <![CDATA[
(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = “//connect.facebook.net/en_US/all.js#xfbml=1”; fjs.parentNode.insertBefore(js, fjs); }(document, ‘script’, ‘facebook-jssdk’));
// ]]>

 

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

 

Your home network is at risk of cybersecurity attacks

Router vulnerabilities and weak passwords allow cybercrooks easy access to your home network

That little router box provided by your ISP or that you bought at Radio Shack and forgot about, is a weak link in your Internet-connected household. Many homes in the United States use a wireless router to connect multiple devices, but unsecured routers can create an easy access point for hackers.

Think for a second – do you know what your wifi router password is? Did you know that your wireless router even has a password? If you are not sure, you are not alone.

What do you have to lose?

Only everything on your computer! That includes banking or financial information, personal information, browsing history, and photos.

Why is this an issue now?

”Today’s router security situation is very reminiscent of PCs in the 1990s, with lax attitudes towards security combined with new vulnerabilities being discovered every day creating an easily exploitable environment, ” said Vince Steckler, chief executive officer of Avast. “The main difference is people have much more personal information stored on their devices today than they did back then.”

We did a study of this issue and found that 4 out of 5 Internet-connected households in the U.S. are at risk of getting attacked through their wireless router. And 16 out of 100 surveyed said they have already been victimized by hackers. T

The problem – PASSWORDS.

Avast found that more than half of all routers are poorly protected by default or easily-hacked password combinations. When you check yours, this could be what you find:

  • admin/admin
  • admin/password
  • admin/<no-password>

The 25% of consumers we surveyed that are using a “unique” password use their address, name, phone number, street name, or other easily-guessed terms as their passwords. Not too much better…

What is the risk?

Avast Home Network Security

Avast Home Network Security scans your network for vulnerabilities.

One of the biggest risks on any wifi network is DNS hijacking. This happens when malware gets in your unprotected router and sneakily redirects you from a known site, such as your bank’s website, to a fake site that looks just like the real thing. When you log in, cyberthieves capture your login credentials and then use them to access the real site. Scary stuff.

Avast 2015 reacts to home network vulnerabilities

To address these issues, Avast recently introduced Avast 2015, which includes the world’s first Home Network Security Solution that protects users from home network threats including DNS hijacking and weak passwords.

The Home Network Security Solution is available in free and paid versions of Avast. Get it at www.avast.com.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

Top Cyber Security Awareness Month themes, topics, and resources

National Cyber Security Awareness Month happens every October and NCSAM 2014 has seen more events and resources than ever. This recorded webinar discusses the top topics of NCSAM 2014, from the shortage of skilled cybersecurity workers to the Internet of Things (IoT).

The post Top Cyber Security Awareness Month themes, topics, and resources appeared first on We Live Security.

Look-alike Avast Online Security extension deceives users

We have been recently notified about a suspicious browser extension for Google Chrome. Suspicious because it was called “Avast Free Antivirus 2014″, while our browser extension is actually called Avast Online Security. You can see the fake extension along with our official ones in the printscreens from the Chrome Web Store.

chrome_web_store_hl

The extension looks professional featuring printscreens of the PC version of Avast 2014 and a good rating of 4 stars. It is so well-done that it may trick users to install it – and indeed almost 2,000 users fell for this.

fake_extension

After installing, the only thing that is added is the little icon between the search bar and options button, as can be seen on the printscreen above, where the extension is already installed.

Viewing the extension code reveals that it is surprisingly lightweight. It merely opens a new tab with a predefined URL when the Avast icon is clicked.

code

The website, fortunately, is not malicious at all, so there is nothing harmful to the user, other than deceiving them with a false sense of security. The author of the extension created many more extensions, each leading to a different landing page on the same domain. The only comfort we received from this malicious extension, was that our extension was the most downloaded one! That confirms to us that our service is valued (and needed!).

developers_apps

To get the authentic Avast Online Security app for your browser, please visit us on the Chrome Web Store.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.

Pony stealer spread vicious malware using email campaign

Most people want to stay on top of their bills, and not pay them late. But recently, unexpected emails claiming an overdue invoice have been showing up in people’s inboxes, causing anxiety and ultimately a malware attack. Read this report from the Avast Virus Lab, so as a consumer you’ll know what to look for, and as a systems administrator for an SMB or other website, you will know how cybercrooks can use your site for this type of social engineering scam.

Recently we saw an email campaign which attempted to convince people to pay an overdue invoice, as you can see on the following image. The user is asked to download an invoice from the attached link.

mail1

The downloaded file pretends to be a regular PDF file, however the filename “Total outstanding invoice pdf.com” is very suspicious.

When the user executes the malicious file, after a few unpacking procedures, it downloads the final vicious payload. The Avast Virus Lab has identified this payload as Pony Stealer, a well-known data-stealing Trojan which is responsible for stealing $220,000, as you can read here.

We followed the payload URL and discovered that it was downloaded from a hacked website. The interesting part is that we found a backdoor on that site allowing the attacker to take control of  the entire website. As you can see, the attacker could create a new file and write any data to that file on the hacked website, for example, a malicious php script.

backdoor

Because that website was unsecured, cybercrooks used it to place several Pony Stealer administration panels on it, including the original installation package, and some other malware samples as well.  You can see an example of Pony Stealer panel’s help page written in the Russian language on the following picture.

panel

Avast Virus Lab advises:

For Consumers: Use extreme caution if you see an email trying to convince you to pay money for non-ordered services. This use of “social engineering” is most likely fraudulent. Do not respond to these emails.

For SMBs: If you are a server administrator, please secure your server and follow the general security recommendations. As you learned from this article,  you can be hacked and a backdoor can be put in your website allowing anyone to upload whatever he wants to your website. Protect yourself and your visitors!

SHA’s and detections:

4C893CA9FB2A6CB8555176B6F2D6FCF984832964CCBDD6E0765EA6167803461D

5C6B3F65C174B388110C6A32AAE5A4CE87BF6C06966411B2DB88D1E8A1EF056B

Avast detections: Win32:Agent-AUKT, Win32:VB-AIUM

Acknowledgement:

I would like to thank Jan Zíka for discovering this campaign.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on Facebook, Twitter and Google+. Business owners – check out our business products.