Ransomware threat: Get patched, find a firewall or upgrade fast

May 15, 2017

New Delhi, May 15: It was coming. On March 14 this year, Microsoft released a security update which addressed the vulnerability in the 16-year-old Windows XP operating system that the hackers behind the massive ransomware attack exploited and created havoc in 150 countries.

wannacry

The vulnerability in the Microsoft Windows software — exploited by “WannaCrypt” — crippled computers from hospitals in Britain to police stations in India, with hackers demanding hundreds of dollars from the users for them to regain control over their data.

Once Microsoft released the patch for the vulnerability — exploited by hacker group “Shadow Brokers” after stealing a software from the US National Security Agency (NSA) — some Window XP users installed the update called “Microsoft Security Bulletin MS17-010” on their desktops and laptops.

But several didn"t.

There are nearly 150 million computers running Windows XP operation system globally. Those who didn"t pay heed to the Windows XP patch are the ones who have fallen prey to the world"s biggest ransomware attack.

Microsoft which had discontiued security updates to its out-of-date software, has also provided a security update for all customers using Windows 8 and Windows Server 2003, anticipating further attacks on these earlier platforms being used by millions.

According to the company, “customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March.

“If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible,” said Phillip Misner, Principal Security Group Manager, Microsoft Security Response Centre, in a statement.

Meanwhile, “WannaCrypt” locked up machines, encrypted files and demanded approximately $600 in Bitcoin for a recovery key.

According to global cyber security firms, paying heed to updates can only save your data from being put to ransom.

“Install the official patch from Microsoft that closes the vulnerability used in the attack. Ensure that security solutions are switched on all nodes of the network. If Kaspersky Lab"s solution is used, ensure that it includes the "System Watcher", a behavioural proactive detection component and that it is switched on,” Altaf Halde, Managing Director of Kaspersky Lab (South Asia), told.

“Run the "Critical Area Scan" task in Kaspersky Lab"s solution to detect possible infection as soon as possible (otherwise it will be detected automatically, if not switched off, within 24 hours),” he added.

According to Subhendu Sahu, Acting Country Manager for India, FireEye, the ransomware poses high risks to organisations using potentially vulnerable Windows machines.

“We can certainly expect follow-on attacks. Organisations seeking to take risk management steps related to this campaign should install the latest Windows patches. They should also use the indicators of compromise which are associated with this activity. FireEye has also taken steps to help secure its customers,” Sahu told.

As investigators were working to track down those responsible for the ransomware attack, Microsoft President and Chief Legal Officer Brad Smith said the governments should treat this attack as a “wake-up call”.

The news led software security providers to ramp up anti-malware software.

“Upon learning of these incidents, McAfee quickly began working to analyse samples of the ransomware and develop mitigation guidance and detection updates for its customers. McAfee has subsequently provided DAT (that contain data in text or binary format) updates to all its customers and provided them and the public further analysis on the attacks,” Ian Yip, Chief Technology Officer, Asia Pacific, McAfee, told.

If you are a home Windows XP user, patch immediately follow up with an upgrade. If you are running a vulnerable system and cannot install the patch for some reason, try doing the following:

“Disable SMBv1 (a server component) with the steps documented at "Microsoft Knowledge Base Article 2696547" and as recommended previously. Consider adding a rule on your router or firewall to block incoming Server Message Block (SMB) traffic on port 445,” said a report in the technology website Engadget.

“This is big and set to get bigger. We haven"t seen anything like this since Conficker in 2008,” Amit Nath, Head of Asia Pacific-Corporate Business at cyber security firm F-Secure Corporation, told IANS.

The Conficker worm infected millions of computers including government, business and home computers in over 190 countries.
Always make sure your files are backed up.

“That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup. Using Cloud storage with anti-virus scanning abilities to share files will help users to mitigate any possible threats,” suggested Anand Ramamoorthy, Managing Director, South Asia, McAfee.

Remember this: “WannaCrypt” probably won"t work across the internet for PCs behind a firewall or router.

“But if a server is connected directly to the internet or a PC is on the same network as an infected computer, it can spread quickly — which is exactly what has happened,” the Engadget report added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
June 16,2020

Paris, Jun 16: Increasing numbers of readers are paying for online news around the world even if the level of trust in the media, in general, remains very low, according to a report published Tuesday.

Around 20 percent of Americans questioned said they subscribed to an online news provider (up to four points over the previous year) and 42 percent of Norwegians (up eight points), along with 13 percent of the Dutch (up to three points), compared with 10 percent in France and Germany.

But between a third and a half of all news subscriptions go to just a few major media organisations, such as the New York Times, according to the annual Digital News Report by the Reuters Institute.

Some readers, however, are also beginning to take out more than one subscription, paying for a local or specialist title in addition to a national news source, the study's authors said.

But a large proportion of internet users say nothing could convince them to pay for online news, around 40 percent in the United States and 50 percent in Britain.

YouGov conducted the online surveys of 40 countries for the Reuters Institute in January, with 2,000 respondents in each.

Further surveys were carried out in six countries in April to analyse the initial effects of COVID-19.

The health crisis brought a revival of interest in television news -- with the audience rising five percent on average -- establishing itself as the main source of information along with online media.

Conversely, newspaper circulation was hard-hit by coronavirus lockdown measures.

The survey found trust in the news had fallen to its lowest level since the first report in 2012, with just 38 percent saying they trusted most news most of the time.

However, confidence in the news media varied considerably by country, ranging from 56 percent in Finland and Portugal to 23 percent in France and 21 percent in South Korea.

In Hong Kong, which has been hit by months of sometimes violent street protests against an extradition law, trust in the news fell 16 points to 30 percent over the year.

Chile, which has had regular demonstrations against inequality, saw trust in the media fall 15 percent while in Britain, where society has been polarised by issues such as Brexit, it was down 12 points.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 10,2020

Indian enterprises were flooded with a whopping 14.6 crore malware threats in 2019 - a growth of 48 per cent (year-on-year) compared to 2018, a new report said on Friday.

Manufacturing, BFSI (banking, financial services and insurance), education, healthcare, IT/ITES, and the government were the most at-risk industries in the country, said the report from Seqrite, the enterprise arm of Pune-based IT security firm Quick Heal Technologies.

Interestingly, almost a quarter (23 per cent) of the threats were identified through 'Signatureless behaviour-based' detection by Seqrite, indicating how a growing number of cybercriminals were deploying new or previously unknown threat vectors to compromise enterprise security.

"With the latest Seqrite annual threat report, we want to empower CIOs, CISOs, business leaders and all key public stakeholders with the insights they need to combat the growing complexity of the threat landscape," said Sanjay Katkar, Joint Managing Director and CTO, Quick Heal Technologies.

The most prominent trend was the drastic increase in the volume, intensity, and sophistication of cyber-attack campaigns targeting Indian enterprises in 2019.

The rapid integration of IoT devices, BYOD (bring your own device), and third-party APIs into enterprise networks has created newer security vulnerabilities that might go unnoticed until a major breach occurs.

Threat researchers at Seqrite observed several large-scale advanced persistent threats (APT) attacks deployed against organisations in the government sector.

"The entry of nation-states and organised cybercrime cells into the fray is expected to add more complication to this situation and will require Indian government bodies and corporate enterprises to shore up their cyber defence strategies in 2020 and beyond," the report noted.

More alarming, however, was the continued lack of security awareness amongst enterprises and government organisations.

"Unsecured Remote Desktop Protocol (RDP) and Server Message Block (SMB) protocols continued to be targeted through brute-force attacks," said the report.

Spear phishing attack campaigns leveraging Office exploits and infected macros were also used extensively by cybercriminals to gain access to enterprise networks and steal critical data.

"India's digital journey depends on ensuring robust cybersecurity for all stakeholders within the enterprise ecosystem," said Katkar.

The sharp spike should be a cause of concern for CIOs and CISOs in the country, especially given the growing digital penetration within their enterprise networks.

"With network vulnerabilities and potential entry points increasing at a rapid pace, threat actors are expected to leverage artificial intelligence (AI) capabilities to power their malware campaigns in the future to capitalise on newer attack vectors," the report added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 13,2020

New Delhi, Jul 13: The Income Tax Department has facilitated a new functionality for banks and post offices to ascertain TDS applicability rates on cash withdrawal of above Rs 20 lakh in case of a non-filer of the income-tax return and that of above Rs 1 crore in case of a filer of the income-tax return.

In a statement, the Central Board of Direct Taxes (CBDT) said that now banks and post offices have to only enter the PAN of the person who is withdrawing cash for ascertaining the applicable rate of TDS.

So far, more than 53,000 verification requests have been executed successfully on this facility, a statement by the CBDT said.

"CBDT today said that this functionality available as 'Verification of applicability u/s 194N' on www.incometaxindiaefiling.gov.in since 1st July 2020, is also made available to the Banks through web-services so that the entire process can be automated and be linked to the Bank's internal core banking solution," it said.

On entering PAN by the bank or the post office, a message will be instantly displayed on the departmental utility: "TDS is deductible at the rate of 2 per cent if cash withdrawal exceeds Rs 1 crore", in case the person withdrawing cash is a filer of the income-tax return.

In case the person withdrawing cash is a non-filer of income tax return, the message shown would be: "TDS is deductible at the rate of 2 per cent if cash withdrawal exceeds Rs 20 lakh and at the rate of 5 per cent if it exceeds Rs 1 crore."

The CBDT said that the data on cash withdrawal indicated that huge amount of cash is withdrawn by the persons who have never filed income-tax returns.

To ensure filing of return by these persons and to keep track on cash withdrawals by the non-filers, and to curb black money, the Finance Act, 2020 with effect from July 1, 2020 further amended IT Act to lower threshold of cash withdrawal to Rs 20 lakh for the applicability of this TDS for the non-filers and also mandated TDS at the higher rate of 5 per cent on cash withdrawal exceeding Rs 1 crore by the non-filers.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.