A recent report by the non-governmental organization HIMSS, focused on improvements made in the health sector due to the introduction of information technology, has revealed that the sector is extremely vulnerable to cyber-attacks.

According to the report, two-thirds of those questioned (made up of industry professionals from around the world) confirmed that their organization had suffered a recent data attack. This is an alarming example of how valuable private patient information is to cybercriminals.

Information security continues to be a priority in IT strategies

The concern about the protection of confidential information is of increasing importance to those who work in the industry, and they are working harder to ensure that this information is kept secure and private. This is reflected in the survey as nearly 9 out of 10 stated that cyber-security has taken on a greater importance in their business in the last year.

Lisa Gallagher, vice-president of Technology Solutions at HIMSS, claims that “health organizations need to adapt quicker in order to defend themselves against cyber-attacks”. So, what does this involve? According to Gallagher, this means incorporating new tools and carrying out frequent analysis of its security processes. Fortunately, half of those questioned agreed that their company had undertaken steps to improve its online security, the protection of its endpoints, the loss of personal data, and disaster recovery. Despite the wealth of protection technology available, however, the majority of those questioned have doubts that their company can protect against attacks on its IT infrastructure and private data.

The use of antivirus and antimalware software is the most widespread

In general, according to the report, companies within the health sector use, on average, 11 different types of technology to guarantee their security. Furthermore, over half of these companies have employees dedicated to the management of private information and data.

This is a logical move considering that 42% of those questioned believe that there are new and growing threats that need to be detected and stopped. These threats have, in half of the cases, been detected by internal security systems. Just 17% of those surveyed admitted that security breaches had been detected by an external source, such as a patient whose information had been compromised.

Another important and positive detail that comes from the survey is the increased use of antivirus and antimalware software by companies (87% of those polled confirmed that their business had implemented the software). Not only this, but 80% also stated that their company was increasing its monitoring of online security to detect and investigate security breaches.

Consequences of attacks

With regards to security incidents, the majority (62%) have stemmed from a disturbance in the IT systems that has not only affected the IT operations, but also health care – albeit in a more limited way.

To have personnel available that are ready to detect and stop the attacks is vital. According to the report, 64% agree that not having skilled professionals on hand is a barrier against combating cyber-attacks.

The majority of those questioned (70%) also agree that phishing attacks, which are more and more frequent, and the spread of malware, are incentives to improve the protection of private information. In order to achieve this, 59% of those surveyed feel that it is important to share information about cyber-attacks with other sectors.

It is important to point out that these attacks aren’t just confined to the health sector. Many other companies have suffered breaches of security including Sony Pictures, which saw information stolen relating to employee salaries, unreleased films, and private mails between directors. Other businesses in the maritime oil industry  have also suffered information theft, which we recently discovered at Panda Security.

Finally, an example of a company from the health sector that has suffered an attack is CareFirst BlueCross BlueShield, which offers medical services in the US states of Virginia, Maryland and Washington D.C. Last year the company found out that private information relating to over a million of its online users could have been compromised in a cyber-attack.

The post Cyber-security is a worry for the health industry, but is it sufficiently protected? appeared first on MediaCenter Panda Security.

PC Magazine has named Panda Free as the best free antivirus of 2015. Ranking ahead of the likes of Bitdefender, Malwarebytes and Avast, Panda’s antivirus has been awarded the Editor’s Choice by this prestigious media outlet.

The features highlighted include its speed and ease of installation along with its cloud based technology. What’s more, its ability to block malicious URLs was highly rated.

Are you ready to try out the best free antivirus of the year?

DOWNLOAD PANDA FREE

The post Panda Free, the best free antivirus of 2015 appeared first on MediaCenter Panda Security.

3D printing has a great future, but also begins to be part of our present. For years, there were who anticipated the arrival of a third industrial revolution starring this technology. A new era in which companies from different sectors will need to reinvent their processes and look for new ways to add value, since customers will have in their hands the tools to manufacture (at home) tons of products that now have to buy from companies.

Uncomplicated access to manufacturing tools opens endless possibilities, but the popularization of 3D printers has made them desirable among cyber crooks. The attackers are looking for a way of taking advantage of this technology to achieve their malicious purposes.

The most alarming episode so far was the one starred by Cody Wilson, who shared the instructions to manufacture the first printed gun in 3D on the Internet. Just a few days after hanging his designs on the net, the US Department of State ordered him to remove those files and threatened him they would begin a judicial process that would include prison terms and multimillion-dollar penalties. Nevertheless, Wilson filed a lawsuit against this American authority alleging that such restriction violates his freedom of speech.

Beyond plans and weapons designs that even today we can find on the Internet, there are, unfortunately, many other alternatives for criminals. Without going any further, at the end of 2014, in a joint operation by Spanish police, the Bulgarian and the European Center of Europol cybercrime authorities, more than 30 people in Malaga (Spain) and in different city of Bulgaria were arrested accused of stealing data to make fake credit cards and mobile phone cards.

In the searches they found more than 1,000 devices. From camcorders for bars, credit card readers and magnetic strips as well as plastic cards ready to be encoded. Members of the criminal organization used a 3D printer to manufacture cloned cards from the stolen data.

One of the main advantages that comes with 3D printing is that it allows the user to make his own designs. However, this is one of the major drawbacks when talking about the wide range of possibilities opened for criminals. Now they have the ability to produce their own tools, without having to resort to the black market and without fearing the police detecting a suspicious package.

According to the experts, with these tools an attacker could cause chaos on an assembly line. They could, for example, design defective replicas of a piece, leaving the product assembled useless, and causing huge losses to the manufacturer. That, or infect such a part of the device with some malware in order to get information from the future user who will buy it and use it. The consequences would be disastrous.

3D printing offers so many possibilities that even to access the factory in which the thieves want to deposit these false or intoxicated parts, they could manufacture their own keys. Knowing the lock model and its weaknesses, they would just have to design a tool, which is able to activate the mechanism and open the door. Without forcing it and without attracting attention or leaving any trace.

3D printing, in a not-too-distant future, will play a decisive role in our lives and will eventually transform many industrial processes. And at the same time, will give criminals a new repertoire of tools to achieve their evil goals.

The post 3D printers: recognize the most popular frauds and their risks appeared first on MediaCenter Panda Security.

We have detected a phishing campaign targeting Android developers who are publishing their creations in Google Play, Android’s official app store. The from field in the email comes from “Play Developer Support”, with the subject “Update your Account Informations”, as you can see in the following screenshot:

If you click in the link provided, you are redirected to a web site that looks like Google, although obviously it isn’t:

Phishing attacks are designed to steal credentials and users’ identity, that’s why they are extremely popular targeting financial entities and all kind of payment platforms’ customers. This case, however, it is different in the sense that they are not looking to syphon the victims account, the want those credentials because they can use them to spread malware through Google Play.

The most worrisome thing is how easy it would be to automate all the process for criminals. You just need to:

Phishing attacks are designed to steal credentials and users’ identity, that’s why they are extremely popular targeting financial entities and all kind of payment platforms’ customers. This case, however, it is different in the sense that they are not looking to syphon the victims account, the want those credentials because they can use them to spread malware through Google Play.

The most worrisome thing is how easy it would be to automate all the process for criminals. You just need to:

• Build a crawler (there are a number of open source projects to help out in this task) to download information of all apps published in Google Play.
• Parse that information to obtain developers’ email addresses.
• Sent out a personalized phishing campaign, even the phishing page could be personalized for the specific developer so the “conversion rate” is better.
• As the attacker has the information from the apps published by each developer, it could be built an alert system to warn him each time a developer with a popular (millions of downloads) app has fallen in the trap.

From here, one of the easier (and unsophisticated) attacks would be to publish malicious apps using that account. Imagine that someone gets to steal the developer credentials of Candy Crush and publish Candy Crush 2 on the developer behalf…

If the attackers were skilled enough, and find a way to modify the current app of the developer without using the private key (this one cannot be obtained with the stolen credentials), they could publish an updated version of any app. In the example above, imagine that the attackers create an update of Candy Crush with a hidden Trojan in it: hundreds of millions of users would download and install it without ever suspecting they are being compromised.

The post Careful! Phishing Targeting Google Play Android Developers! appeared first on MediaCenter Panda Security.