Ransomware threat: Get patched, find a firewall or upgrade fast

May 15, 2017

New Delhi, May 15: It was coming. On March 14 this year, Microsoft released a security update which addressed the vulnerability in the 16-year-old Windows XP operating system that the hackers behind the massive ransomware attack exploited and created havoc in 150 countries.

wannacry

The vulnerability in the Microsoft Windows software — exploited by “WannaCrypt” — crippled computers from hospitals in Britain to police stations in India, with hackers demanding hundreds of dollars from the users for them to regain control over their data.

Once Microsoft released the patch for the vulnerability — exploited by hacker group “Shadow Brokers” after stealing a software from the US National Security Agency (NSA) — some Window XP users installed the update called “Microsoft Security Bulletin MS17-010” on their desktops and laptops.

But several didn"t.

There are nearly 150 million computers running Windows XP operation system globally. Those who didn"t pay heed to the Windows XP patch are the ones who have fallen prey to the world"s biggest ransomware attack.

Microsoft which had discontiued security updates to its out-of-date software, has also provided a security update for all customers using Windows 8 and Windows Server 2003, anticipating further attacks on these earlier platforms being used by millions.

According to the company, “customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March.

“If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible,” said Phillip Misner, Principal Security Group Manager, Microsoft Security Response Centre, in a statement.

Meanwhile, “WannaCrypt” locked up machines, encrypted files and demanded approximately $600 in Bitcoin for a recovery key.

According to global cyber security firms, paying heed to updates can only save your data from being put to ransom.

“Install the official patch from Microsoft that closes the vulnerability used in the attack. Ensure that security solutions are switched on all nodes of the network. If Kaspersky Lab"s solution is used, ensure that it includes the "System Watcher", a behavioural proactive detection component and that it is switched on,” Altaf Halde, Managing Director of Kaspersky Lab (South Asia), told.

“Run the "Critical Area Scan" task in Kaspersky Lab"s solution to detect possible infection as soon as possible (otherwise it will be detected automatically, if not switched off, within 24 hours),” he added.

According to Subhendu Sahu, Acting Country Manager for India, FireEye, the ransomware poses high risks to organisations using potentially vulnerable Windows machines.

“We can certainly expect follow-on attacks. Organisations seeking to take risk management steps related to this campaign should install the latest Windows patches. They should also use the indicators of compromise which are associated with this activity. FireEye has also taken steps to help secure its customers,” Sahu told.

As investigators were working to track down those responsible for the ransomware attack, Microsoft President and Chief Legal Officer Brad Smith said the governments should treat this attack as a “wake-up call”.

The news led software security providers to ramp up anti-malware software.

“Upon learning of these incidents, McAfee quickly began working to analyse samples of the ransomware and develop mitigation guidance and detection updates for its customers. McAfee has subsequently provided DAT (that contain data in text or binary format) updates to all its customers and provided them and the public further analysis on the attacks,” Ian Yip, Chief Technology Officer, Asia Pacific, McAfee, told.

If you are a home Windows XP user, patch immediately follow up with an upgrade. If you are running a vulnerable system and cannot install the patch for some reason, try doing the following:

“Disable SMBv1 (a server component) with the steps documented at "Microsoft Knowledge Base Article 2696547" and as recommended previously. Consider adding a rule on your router or firewall to block incoming Server Message Block (SMB) traffic on port 445,” said a report in the technology website Engadget.

“This is big and set to get bigger. We haven"t seen anything like this since Conficker in 2008,” Amit Nath, Head of Asia Pacific-Corporate Business at cyber security firm F-Secure Corporation, told IANS.

The Conficker worm infected millions of computers including government, business and home computers in over 190 countries.
Always make sure your files are backed up.

“That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup. Using Cloud storage with anti-virus scanning abilities to share files will help users to mitigate any possible threats,” suggested Anand Ramamoorthy, Managing Director, South Asia, McAfee.

Remember this: “WannaCrypt” probably won"t work across the internet for PCs behind a firewall or router.

“But if a server is connected directly to the internet or a PC is on the same network as an infected computer, it can spread quickly — which is exactly what has happened,” the Engadget report added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
February 6,2020

Washington D.C., Feb 6: An international team of astronomers has found an unusual monster galaxy that existed about 12 billion years ago when the universe was only 1.8 billion years old.

The team of astronomers was led by scientists at the University of California, Riverside.

Dubbed XMM-2599, the galaxy formed stars at a high rate and then died. Why it suddenly stopped forming stars is unclear.

"Even before the universe was 2 billion years old, XMM-2599 had already formed a mass of more than 300 billion suns, making it an ultra massive galaxy," said Benjamin Forrest, a postdoctoral researcher in the UC Riverside Department of Physics and Astronomy and the study's lead author.

"More remarkably, we show that XMM-2599 formed most of its stars in a huge frenzy when the universe was less than 1 billion years old and then became inactive by the time the universe was only 1.8 billion years old," Forrest added.

The team used spectroscopic observations from the W. M. Keck Observatory's powerful Multi-Object Spectrograph for Infrared Exploration or MOSFIRE, to make detailed measurements of XMM-2599 and precisely quantify its distance.

The study results appear in the Astrophysical Journal.

"In this epoch, very few galaxies have stopped forming stars, and none are as massive as XMM-2599," said Gillian Wilson, a professor of physics and astronomy at UCR in whose lab Forrest works.

"The mere existence of ultramassive galaxies like XMM-2599 proves quite a challenge to numerical models. Even though such massive galaxies are incredibly rare at this epoch, the models do predict them."

"The predicted galaxies, however, are expected to be actively forming stars. What makes XMM-2599 so interesting, unusual, and surprising is that it is no longer forming stars, perhaps because it stopped getting fuel or its black hole began to turn on. Our results call for changes in how models turn off star formation in early galaxies," the professor stated.

The research team found XMM-2599 formed more than 1,000 solar masses a year in stars at its peak of activity -- an extremely high rate of star formation. In contrast, the Milky Way forms about one new star a year.

"XMM-2599 may be a descendant of a population of highly star-forming dusty galaxies in the very early universe that new infrared telescopes have recently discovered," said Danilo Marchesini, an associate professor of astronomy at Tufts University and a co-author on the study.

"We have caught XMM-2599 in its inactive phase," Wilson said, who led the W. M. Keck Observatory data acquisition
Co-author Michael Cooper, a professor of astronomy at UC Irvine, said this outcome is a strong possibility.

"Perhaps during the following 11.7 billion years of cosmic history, XMM-2599 will become the central member of one of the brightest and most massive clusters of galaxies in the local universe," he said.

"Alternatively, it could continue to exist in isolation. Or we could have a scenario that lies between these two outcomes," he stated.

The study was supported by grants from the National Science Foundation and NASA.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 18,2020

New Delhi, Jul 18: India's national cybersecurity agency CERT-in, has warned people of credit card skimming spreading across the world through e-commerce platforms.

Attackers are typically targeting e-commerce sites because of their wide presence, popularity and the environment LAMP (Linux, Apache, MySQL, and PHP), the Computer Emergency Response Team (CERT-In) said in a notice on Thursday.

Recently, attackers targeted sites which were hosted on Microsoft's IIS server running with the ASP.NET web application framework, it said.

Some of the sites affected by the attack were found to be running ASP.NET version 4.0.30319, which is no longer officially supported by Microsoft and may contain multiple vulnerabilities, CERT-In said.

The notice also included a list of best practices for website developers including the use of the latest version of ASP.NET web framework, IIS web server and database server.

The advisory is based on research by Malwarebytes which found that this skimming campaign likely began sometime in April this year.

Credit card skimming has become a popular activity for cybercriminals over the past few years, and the increase in online shopping during the pandemic means additional business for them, too, Malwarebytes said in a blog post, adding that attackers do not need to limit themselves to the most popular e-commerce platforms.

Researchers from global cybersecurity and anti-virus brand Kaspersky had warned in December last year that more cybercriminal groups will target online payment processing systems in 2020. 

It said that over the past couple of years, so-called JS-skimming (the method of stealing of payment card data from online stores), has gained immense popularity among attackers. 

Kaspersky researchers in their report said they are currently aware of at least 10 different actors involved in these type of attacks.

Their number will continue to grow during the next year, the report said, adding that the most dangerous attacks will be on companies that provide services such as e-commerce as-a-service, which will lead to the compromise of thousands of companies.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 20,2020

Washington D.C., Jan 20: An American bride asked for money from her invitees so that they can be on the 'exclusive guest list'.

Weddings can be surely expensive. But is it feasible for one to charge the guests to make up for the expenses?

According to Fox News, that is exactly what happened in a recent American wedding. A 19-year-old shared on Reddit that her cousin was getting married on Sunday and announced that she would charge 50 dollars to those who wanted to attend her wedding.

"She said that they can Venmo her money so there won't be no [sic] problems and everyone who paid will be added onto the 'exclusive guest list' which basically means you won't have to wait in line while other guests pay," wrote the user named DaintySheep.

While she refused to pay for entry into her cousin's wedding the bride-to-be contacted the elders in the family which ended up in an embarrassing situation.

"She wanted to get the money she spent on her special day back. I told her I wouldn't be able to come because this was outrageous and that I wish her well on her special day. She contacted my aunt and my aunt called me cheap and rude. My parents offered to pay for my entry, but I refused," continued the disheartened girl.

While in almost every nook and cranny of the world gifting the bride-groom with money is a tradition, asking for money from friends and family to replenish the money spent on a wedding is can be said to be a rare scenario.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.