Tag Archives: PandaLabs

Panda Security

How to avoid hacking to Critical Infrastructure

Leave a comment

panda-security-infrastructure

The cyber-attacks on the backbone of today’s economies are materialized in those assaults that affect society as a whole. The strategic priorities of national security include infrastructure exposed to the threats that can affect the operation of essential services.

PandaLabs, Panda Security’s anti-malware laboratory, has released a whitepaper called “Critical Infrastructure: Cyber- attacks on the backbone of today’s economy” with a timeline of the most notorious cyber-security attacks around the world on critical infrastructure, and recommendations on how to protect them.

Malware and targeted attacks aimed at sabotaging these networks are the main threats to critical infrastructure. Oil refineries, gas pipelines, transport systems, electricity companies or water supply control systems all form part of a technologically advanced industry where security failures can affect the whole of society.

Malware and targeted attacks

Today’s increasing trend towards interconnecting all types of infrastructure also increases potential points of entry for attacks on the services that have become essential for today’s societies.

This is apparent with the cyber-attacks that have been carried out in the past against these networks, the first of which took place in 1982, even before the Internet existed. In this case, attackers infected the systems of a Siberian oil pipeline with a Trojan.

critical-infrastructure-pandaIn addition to paralyzing and reducing services, which was what happened to the Venezuelan oil company PDVSA when it was hit by an attack that reduced production from 3 million barrels a day to 370,000, such attacks can also have a significant financial impact. One of the largest car manufacturers in the USA was left with losses of around US$150 million thanks to an attack using SQLSlammer, which spread rapidly and affected 17 production plants.

The threat is real

panda-security-crtical-infrastructureOne of the most infamous cases of cyber-attacks on critical infrastructures in history was Stuxnet. It is now known that this was a coordinated attack between the Israeli and US intelligence services, aimed at sabotaging Iran’s nuclear program. The case became the catalyst that made the general public aware of these types of threats.

Over the years there have been key events that have marked turning points in global security, such as the 09/11 attacks. In Europe, there was a similar key date, March 11, 2004, the date of the Madrid train bombings. As a result, the European commission drew up a global strategy for the protection of critical infrastructure, the ‘European Programme for Critical Infrastructure Protection’, which includes proposals to improve Europe’s prevention, preparation and response to terrorist attacks.

How could these attacks have been avoided?

The technical characteristics and the high level of exposure of data that can be stolen means that special care needs to be taken in protecting these infrastructures, including a series of good practices, such as:

  • Checking systems for vulnerabilities.
  • The networks used to control these infrastructures should be adequately monitored and, where necessary, isolated from external connections.
  • Control of removable drives is essential on any infrastructure and not just because it has been the attack vector for attacks as notorious as Stuxnet. When protecting such critical infrastructure, it is essential to ensure that malware doesn’t enter the internal network through pen drives or that they are not used to steal confidential information.
  • Monitoring PCs to which programmable logic controllers (or PLCs) are connected. These Internet-connected devices are the most sensitive, as they can give an attacker access to sensitive control systems. Moreover, even if they don’t manage to take control of a system, they can obtain valuable information for other attack vectors.

In light of this panorama, protection against advanced threats and targeted attacks is essential. Adaptive Defense 360 offers comprehensive security against these attacks and provides companies with all they need to defend themselves and close the door on the cyber-security vulnerabilities that can, in the end, affect us all.

Download the infographic “Cyber-attacks on the backbone of today’s economy” here.

Download the Whitepaper:

international

International Edition

 

Russia

Russian Edition

 

PortuguesePortuguese Edition

 

swissSwiss Edition

 

The post How to avoid hacking to Critical Infrastructure appeared first on Panda Security Mediacenter.

Panda Security

TrickBot, new spam campaign against companies

Leave a comment

attack panda security

On November the 2nd we witnessed a new spam campaign delivering emails each with a Word document attachment targeting UK companies. Each email message had the subject “Companies House – new company complaint” and the Word document attachment was titled “Complaint.doc”. When users open the document, this is what they see:

windows trickbot

How TrickBot works?

If the user follows the instructions given, the macro in the document will be executed. It will download a file called dododocdoc.exe which will be saved in %temp% as sweezy.exe and then executed. This file is a variant of the TrickBot malware family. Once executed it will install itself in the computer and will inject a dll into the system process svchost.exe. From there it will connect to the command and control server.

This has not been a massive campaign, but it has been targeted to UK companies – we’ve just seen a few hundred e-mails to our clients, and all of them were protected proactively without needing any signature or update. However taking a look at the potential victims, all of the emails were to companies, no home users were targeted, and it turns out that most of them were to businesses in the UK. There were 7 cases in Spain, and one in Belgium, Ireland and Thailand. The campaign was short, the first case happened at 10:55am and the last one at 12:11pm (GMT).

The macro uses PowerShell to execute the malware, which is a common technique that is becoming more and more popular recently, being used in ransomware attacks or even to infect Point of Sale terminals.

From Panda Security we recommend that businesses ensure all software is updated, have a reputable security solution in place  and hold regular staff security awareness training.

The post TrickBot, new spam campaign against companies appeared first on Panda Security Mediacenter.

Panda Security

The Internet collapses, brings the world to a halt for a few hours

Leave a comment

 

young man with glasses sitting in front of his computer, programming. the code he is working on (CSS) can be seen through the screen.

A massive cyber-attack against US DNS service provider Dyn knocked out major websites across the Internet last Friday. The attack shut down several websites, including Netflix, Twitter, Amazon and The New York Times. The Internet service was disrupted for almost 11 hours, affecting more than one billion customers around the world.

Cyber crooks are always looking for ways to exploit the latest, most innovative technologies to carry out attacks like those we saw just a few hours ago. Are we in the Age of Internet Attacks? The latest PandaLabs Quarterly Report already warned of the huge number of large-scale distributed denial-of-service (DDoS) attacks that have been occurring over the last few months, and the way many of them are exploiting botnets made up of not only computers but also smart devices like IP cameras.

The recent DDoS attacks reflect the new approach taken by Black Hat hackers when it comes to launching new, more devastating campaigns that combine everyday devices and malware to form highly dangerous armies ready to launch DDoS attacks.

Probing Internet defenses

Just one month ago, security guru Bruce Schneier, published an article with the most revealing title: ‘Someone Is Learning How to Take Down the Internet.’

The recent examples of denial-of-service attacks flood servers with useless traffic that overburdens Internet bandwidth and prevents legitimate users from accessing targeted sites. Attacked servers become saturated with the huge number of requests.

The article explained that the best way to take down the Internet is through a DDoS attack like the one suffered by Dyn, and how some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks, in what seems to be an strategy to gather information and see how well these companies can defend themselves.

A few weeks ago, the website of Brian Krebs, a US journalist specialized in computer security issues, was taken offline as he fell victim to the largest DDoS attack to date. He was only able to go back online after Google came to the rescue.

This attack adds to the list of those suffered by a number of tech giants over the last few months, such as the hack of 500 million Yahoo accounts back in September, or the theft of 60 million  Dropbox user IDs and 100 million LinkedIn passwords.

It is precisely the success of the Internet, with billions of connected devices worldwide, that makes it so appealing to criminals willing to exploit its vulnerabilities. Many of these devices lack basic security measures, making them easy prey for hackers and, in this context, any organization, media company or social networking service can become the victim of the next attack.

 

The post The Internet collapses, brings the world to a halt for a few hours appeared first on Panda Security Mediacenter.

Panda Security

Point of Sale attacks through Terminal Server

Leave a comment

img-tpvs

Some months ago we published a technical analysis of Multigrain, a Point of Sale Trojan that uses DNS petitions in order to exfiltrate stolen information. We also wrote about one case where this PoS malware was used to infect hundreds of restaurants in the United States.

At the end of September we have seen again activity, with new attacks infecting PoS with new Multigrain variants. However, unlike this previous attack that was targeting the same kind of victims in a region (restaurants in the US) now it looks like cybercriminals are trying to find new fields where they can maximize their profit. We have seen 2 waves of attacks which victims were companies from a number of countries:

  • Argentina
  • Belgium
  • Brazil
  • Chile
  • France
  • Germany
  • India
  • Ireland
  • Norway
  • Spain
  • Sweden
  • Thailand
  • UK
  • USA

They were from different industries, including the typical restaurants and hotels, but also others not that common in these attacks: Telecommunications, Business IT Services, Engineering, Cargo Insurance, Medical Services, Logistics, Accountants, Medical Services, Unions, Engineering and Industrial Machinery Suppliers.

Why the disparity in victim profiles? It looks like the attackers were not looking for these specific industries. All attacks have been perpetrated through Terminal Server, similar to what we have seen in other cases, using brute-force attacks until they can break into the computers and infect them with Multigrain. These are automated attacks, where cybercriminals start scanning the Internet looking for potential victims, and once located they launch the attack until they gain access.

Tips to prevent attacks in companies

In order to minimize the risk, companies must remember that these services, when possible, are better out of the Internet. In case there is a need for them to be in the open, be sure to use strong credentials (with a strong enough password you can basically avoid brute-force attacks), to use 2FA when possible, use non-standard ports and of course monitor all incoming connections from the outside.

 

The post Point of Sale attacks through Terminal Server appeared first on Panda Security Mediacenter.

Panda Security

Cybercrime Reaches New Heights in the Third Quarter

Leave a comment

pandalabs-q3-header

Cybercrime isn’t slowing down anytime soon. This quarter, cybercriminals were increasingly more ingenious, using innovative technologies and new tools to spread their wares. According to the PandaLabs report, 18 million new malware samples were captured in this quarter alone, an average of 200,000 each day.

The wave of sophisticated attacks used this quarter confirm that Ransomware attacks and the theft of data (that is sold on the black market) are the most-used tactics this quarter. We also witnessed increasing DDoS attacks, interference with the Internet of Things (such as connect cars), along with a new kind of ransomware attacks that are focused on iOs-based mobile devices.

Ransomware and the Evolution of Cybercrime

According to the National Crime Agency of the United Kingdom, cybercrime currently makes up more than 50% of the crimes committed in the UK.

graphs_hacker

In addition to the traditional infection techniques via exploits and spam, there are some other extremely effective techniques, specifically directed at businesses. We saw this in September when a group of attackers successfully installed the Crysis ransomware on a French company’s server.

graphs_imgtexto-videojuegos

Cybercriminals struck gold when they started compromising game sites. Millions of people have been victims of these kinds of attacks including users of the pornographic website Brazzers, who suffered a security breach where 800,000 users’ data was stolen.

graphs_imgtexto-tpv

 

PunkeyPOS and PosCardStealer have become the biggest nightmare for Point of Sale terminals in establishments, mainly in the United States, and compromised client credit and debit card data.

graphs_imgtexto-banco

In August, SWIFT released a statement that revealed that many attacks similar to the Bangladesh one are taking place. They did not include exact amount stolen and number of attacked banks in their statement. What is mentioned, however, is that these financial entities did not have adequate security measures in place.

graphs_imgtexto-troyano

Lately, the ransomware attacks on iPhones and iPads are increasing. But in contrast to their Windows counterparts, the cybercriminals do not use malware for these attacks. Instead, they use the victim’s AppleID and password (usually obtained through phishing) to ask for a reward from the “Find my IPhone” application.

If you would like to learn more about the biggest data thefts in history (like the recent attacks on Yahoo and Dropbox), stay updated about the latest DDos attacks, learn more about the hackable IoT devices, or stay informed about the cyberwar evolution, please download our quarterly PandaLabs report.

 

Download PandaLabs Report Q3:

International Edition
flag_of_russia-svg Russian Edition

 

The post Cybercrime Reaches New Heights in the Third Quarter appeared first on Panda Security Mediacenter.

Panda Security

Worldwide “Crysis” Through Remote Desktop Protocol

Leave a comment

Tales from Ransomwhere Two weeks ago we saw a ransomware attack in a server belonging to a French company. It was a Crysis variant, a ransomware family that appeared earlier this year. We witness thousands of infection attempts by ransomware on a daily basis, but this one caught our attention as the file somehow showed up in the computer when no one was supposed to be using it and in fact, there were no email clients or Internet browsers running there.

How did it get into the computer?

Why did the security measures in place allow this file into the server? That’s what we wanted to find out, and so we began an investigation. It turns out that this server is running Remote Desktop Protocol (RDP) and these cybercriminals used a brute force attack until they could guess the credentials to obtain remote access.

Back to the story—as most users do not have 2FA enabled and the passwords are not that complex nor random, it is pretty easy to get into a server using this kind of brute-force attack, a good dictionary or with the most common combinations. This is not a new technique. More than a year ago, I remember one wave that hit Spanish companies with ransomware using the exact same technique. Cybercriminals usually perform these attacks at night or during weekends, when there are few people in the office, or none at all.

Cybercriminals get into a server using this kind of brute force attack, a good dictionary or with the most common combinations. 

In this case, the attack to the server started on May 16th, where they performed 700 login attempts. These were performed automatically, usually for a period of two hours approximately. Most of these attacks have been happening from 1am to 3am, or from 3am to 5am. Each and every day. The number of login attempts changes, for example on May 18th there were 1,976 while on July 1st there were 1,342.

After almost four months and more than 100,000 login attempts, the attackers were finally able to get into the server and drop the Crysis ransomware.

This is a Worldwide Crysis

This week our colleagues from Trend Micro published an article that warned us about similar attacks happening in Australia and New Zealand that deploy Crysis variants. Unfortunately, we can say that those are not the only countries—this is happening at a worldwide level (at least since May).

Assuming you need to have RDP running and connected to the Internet, apart from monitoring connection attempts so you can learn that you are under attack, you should also enforce complex passwords. The best approach would be to implement 2FA, such as SMS passcode, so guessing passwords becomes useless.

We’ll continue to keep you informed with our Tales from Ransomwhere series!

 

The post Worldwide “Crysis” Through Remote Desktop Protocol appeared first on Panda Security Mediacenter.

Panda Security

Panda Security Protects Privacy in Public Administration

Leave a comment

Header-EN

There have been thousands of top secret documents leaked, confidential information pertaining to individuals has been stolen, cyber espionage between powerful governments has occurred, and attacks have been performed by personnel with privileged access. These are all examples that confirm that propagandistic pursuit and economic gain drive cybercriminals, and they target those who are willing to pay for the retrieval of their valuable information, such as institutions in the public sector.

PandaLabs, Panda Security’s anti-malware laboratory, presents the “Privacy in Public Administration” whitepaper; detailing numerous cyber-attacks on countries that could almost have come from a science fiction story.

Legislative Developments in Cybersecurity

The technological revolution in the public sector, the digitalization and storage of information, and the boom in online services to simplify administration for the public have led to an exponential growth  in the generation, storage and processing of confidential data; data which must be treated with the utmost care. Consequently, the public sector now faces a new series of demands in risk prevention, security and legal compliance.

Politically-motivated attacks

During the past decade, crimes including cyber-terrorism, cyber-espionage and hacktivism have been on the rise, threatening the privacy of Public Administrations, businesses and nations:

Manning-EN 2010: Bradley Manning, a US soldier, copied 700,000 confidential documents and used WikiLeaks to publish the data. In total almost half a million records from the Iraq and Afghanistan conflicts, and more than 250,000 secret U.S. diplomatic cables.

2013: EdSnowden-ENward Snowden, a former employee of the CIA and NSA, published top secret documents through the Guardian and the Washington Post concerning various NSA programs, including the mass surveillance programs PRISM and xkeyscore.

2016: A total of 19,252 emails (including attachments) from 8,034 servers of the US Democratic National Committee sent between January 2015 and May 2016 were revealed on WikiLeaks this July. The security company contracted by the Democratic National Committee has claimed that the hack was the work of at least two different groups of hackers linked to a Russian government agency in an action designed to favor Republican candidate Donald Trump.

Now, three months before the US elections, the FBI has confirmed the hacking of at least two electoral databases by foreign hackers who have extracted voter information from at least one of them. There is an ongoing investigation and IPs have been traced back once again to Russian hacking forums. Coincidence?

Elections-EN

The solution for adapting to the change.

The emergence of new players from different backgrounds and with varying motivations combined with their ability to act in any security dimension, hinders the identification of aggressors and decreases the ability of countries to adequately respond. Current legislation is not adapted to the new cyber-crime dynamic or to new technological or data management demands.

To prevent new attacks on public agencies, a common regulatory and legislative framework is needed, with responsibilities shared between states. One such example is the new regulatory framework passed in the EU in 2016.

For public institutions, success in ensuring cyber-security lies with meeting certain requirements:

  • Having real-time information about incidents and security holes related to data security, such as the accidental or illegal destruction, loss, alteration, unauthorized disclosure or remote transference of data.
  • Compliance with Article 35 of the “General Data Protection Regulation” on data protection with regular and systematic monitoring of data on a large scale.
  • Reporting all possible transfers of data files to foreign countries.
  • Improving individual rights, including the right to be forgotten, and data portability across all shared data files.
  • Safeguarding delegation to other processors of data deletion, reporting and notification requirements, and the maintenance of file transfer activities.

To this effect, the implementation of advanced technologies such as Adaptive Defense 360, as a complement to traditional antivirus solutions or perimeter security, enables compliance with guidelines and the technical requirements outlined above, since Adaptive Defense offers guaranteed security against threats and advanced targeted attacks on companies.

Download the Infographic here.

Download the Whitepaper:

International Edition
Edición América Latina Edición México
Edição Portugal Ausgabe Schweiz
UK Edition US Edition

The post Panda Security Protects Privacy in Public Administration appeared first on Panda Security Mediacenter.

Panda Security

Know the tricks of the new Locky

Leave a comment

tales-ransomware_tales

In this new Tales from Ransomwhere we discovered the tricks of one of the most infamous families in the landscape of the ransomware: Locky .

Recently (our colleagues from Avira reported it in July) they added a new feature, it includes an offline mode so it is able to encrypt files when the connection to the server is not available. The weak point is that this key is the same for every computer which files are encrypted, that’s why this is just something that is performed when for some reason the C&C server is unavailable.

On top of this now they have changed the way they infect computers. Usually these attacks rely on a small downloader Trojan who downloads and executes the ransomware. For example, when the attack comes from a javascript file, this usually downloads a small executable which only function is to get the ransomware and execute it. As I have explained in previous articles, cybercriminals are all the time making small changes trying to avoid detection from security solutions.

Distribution of new attack

In this case the attack is being distributed through email, we have seen a number of them with a zip file that has a javascript file inside named “utility_bills_copies <random characters>.js”. However there are different versions using different subjects and file types, for example this one:

ransomware panda security

 

Which inside has the following file:

ransomware zip

 

They have skipped the downloader Trojan part and the script gets the Locky variant in DLL format (with the downloader in most cases the downloaded file was an EXE), which is executed using Windows rundll32.exe. The first sighting of this was on August 22nd, and so far they keep using the same strategy. As you can see they are launching one wave per week:

Ransomware analytics

The most severely affected territories

We have seen just a few hundred infection attempts mainly in North and South America and Europe, although there are some in Africa and Asia too. In case they get a good return of investment we’ll probably see an increase in the next weeks. Here you can find a few hashes of this Locky variant:

ransomware_list3 (3)

 

The post Know the tricks of the new Locky appeared first on Panda Security Mediacenter.

Panda Security

PandaLabs identifies 227,000 malware samples per day in the first quarter of 2016

Leave a comment

pandalabs-2016-04PandaLabs, Panda Security’s laboratory, outlined in this report the main cyber-security developments over the first months in 2016, showing statistics of malware and cyber-attacks in the first quarter of 2016. The amount of malware created continues to break records, with more than 20 million new samples identified, an average of 227,000 per day.

Cyber-crime does not stop

Cyber-criminals continue attacking without giving sensitive infrastructures the chance to take a break, as seen in the attack suffered by 21st Century Holdings, a clinic specialized in cancer treatments with headquarters in Florida. The clinic had to alert their 2.2 million patients and workers that their personal data might have been compromised.

The Rosen Hotels & Resort chain has been the victim of an attack that occurred between September 2014 and February 2016. The company alerted their clients who may have used a credit or debit card in their establishments over this time period that their data could have been stolen by the attackers.

Even the world’s most powerful governments haven’t been spared, such as the United States, where the Department of Defense has presented a rewards program called “Hack the Pentagon” in which rewards are offered to hackers who find security holes in the Pentagon’s web pages, applications and networks.

Smartphones are another easy target for cyber-criminals. SNAP is the name of a vulnerability that affects the LG G3 phones. The problem is due to an error in the implementation of LG notifications called Smart Notice, which allows JavaScript to be executed.

The growing sector, the Internet of Things, is also affected by this year’s criminal activity. In this area, we can see how something as innocent as a doorbell can be attacked. Manufacturers are becoming more aware of their product’s safety, in fact, General Motors just launched a new rewards program for hackers who are able to find vulnerabilities in their vehicles.

Q1 in numbers

The PandaLabs study shows that Trojans continue to be in the lead of all malware samples. Out all malware samples created in 2016, Trojans are number one with 66.81% of the total (an increase compared to last year), followed by viruses (15.98%), worms (11.01%), PUPs (4.22%) and aware/Spyware (1.98%):

pandalabs1

 

When we analyze the infections caused by malware worldwide, we find Trojans in the lead again. This is normal if we take into account the rise in ransomware infections, including the rise of Trojans, which is also one of the most popular attacks cyber-criminals use because it allows them to obtain money easily and securely. There are more and more companies whose networks are falling victim to these cyber-criminals and who are paying millions of euros to rescue their stolen information:

pandalabs2

According to PandaLabs, Asia and Latin America are the most affected regions

In this study we can find a table showing the countries with the highest and lowest infection rates in Q1 of 2016: Asia and Latin America (China leads the ranking with 51.35% of infections) are the most affected countries; while the Scandinavian countries have the lowest infection rates with (Sweden at the lowest at 19.80%).

 

pandalabs3pandalabs4If you want to know more about the specific attacks, be up to date with the latest research carried out by the FBI, and the latest news of the cyberwar, you can download the entire document here. We hope this is of interest to you!

The post PandaLabs identifies 227,000 malware samples per day in the first quarter of 2016 appeared first on Panda Security Mediacenter.