Security researchers discover malware that infected 90,000 computers worldwide

Agencies
October 8, 2019

Security researchers have discovered that the Smominru malware infected 90,000 machines worldwide during the month of August, with an infection rate of up to 4,700 computers per day.

In its post-infection phase, it steals victim credentials, installs a Trojan module and a cryptominer and propagates inside the network, according to researchers from Guardicore, a data centre and cloud security company.

The botnet uses several methods to propagate, but primarily it infects a system in one of two ways -- either by brute-forcing weak credentials for different Windows services, or more commonly by relying on the infamous EternalBlue exploit, cybersecurity firm Kaspersky said in a blog post last week.

Even though Microsoft patched the vulnerability EternalBlue exploits, which made the WannaCry and NotPetya outbreaks possible, many companies are simply ignoring updates, Kaspersky said.

China, Taiwan, Russia, Brazil and the US have seen the most attacks, but that doesn't mean other countries are out of its scope. For example, the largest network Smominru targeted was in Italy, with 65 hosts infected.

The criminals involved are not too particular about their targets, which range from universities to healthcare providers.

However, one detail is very consistent. About 85 per cent of infections occur on Windows 7 and Windows Server 2008 systems. The rest include Windows Server 2012, Windows XP and Windows Server 2003.

After compromising the system, Smominru creates a new user, called admin$, with admin privileges on the system and starts to download a whole bunch of malicious payloads.

The most obvious objective is to silently use infected computers for mining cryptocurrency (namely, Monero) at the victim's expense.

The malware also downloads a set of modules used for spying, data exfiltration, and credential theft.

On top of that, once Smominru gains a foothold, it tries to propagate further within the network to infect as many systems as possible.

To protect their network, computers, and data from Smominru, users need to update operating systems and other software regularly, Kaspersky said.

It is also important for users to use strong passwords. A reliable password manager that helps you create, manage, and automatically retrieve and enter passwords may help protect you against brute-force attacks.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 13,2020

New Delhi, Jul 13: The Telecom Regulatory Authority of India (TRAI) has blocked Bharti Airtel's Platinum and Vodafone Idea's RedX premium plans that offer faster data speeds and priority services to customers as both the plans were violating net neutrality norms.

The telecom watchdog has asked Bharti Airtel to explain within seven days how such a similar plan being launched does not violate the rules of net neutrality.

Vodafone Idea's RedX plan has been in the market since November 2019. They made some modifications in May 2020 and the Bharti Airtel was soon going to launch a similar plan.

According to TRAI, the higher speed for premium customers discriminate against others and violates net neutrality.

Responding to TRAI's move, Airtel spokesperson said: "We are passionate about delivering the best network and service experience to all our customers. This is why we have a relentless obsession to eliminate faults and have been consistently recognised by international agencies as the best network in terms of speed, latency and video experience."

"At the same time, we want to keep raising the bar for our post-paid customers in terms of service and responsiveness. This is an ongoing effort at our end," the spokesperson said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 15,2020

New Delhi, Jul 15: The employees union of state-run telecom operator BSNL will stage protests across the country on Thursday on a host of issues including the cancellation of its 4G tender and non-payment of salaries.

All major unions are organising ‘lunch-hour black-flag' demonstrations throughout the country under the banner of All Unions and Association of BSNL (AUAB), said a statement by AUAB. These demonstrations will be organised, by maintaining social distancing and by taking other precautions, like wearing of masks. The BSNL employees will also wear black-badges the whole day on July 16.

The employees body would demand that BSNL should immediately be allowed to roll out its 4G services and the tender should be issued immediately. Further, they want that in the matter of procuring new equipment and upgradation, there should not be any discrimination between BSNL and other private telecom service providers.

Recently, the Centre cancelled the 4G upgradation tender for BSNL as it had decided to come up with fresh specifications for the upgrade process, in a move to keep Chinese technology companies at bay as the border tussle escalated with the northern neighbour.

The Department of Telecommunications (DoT) would issue a fresh tender for the same, and people in the know said that Chinese companies may not be allowed to participate.

"The agitational programme is being organised to express the deep anguish and resentment of the employees against cancellation of BSNL's 4G tender, cancellation of BSNL's proposal for upgradation of its 49,300 BTSs to 4G, abnormal delay in issuing ‘Add on Order' for 4G equipments, inordinate delay in the implementation of BSNL's Revival Package and against the non-settlement of the burning problems of the employees," said the statement.

The umbrella body of BSNL's employees' unions noted that rolling out of 4G services is the backbone for the revival of this telecom PSU, but the recent cancellation of the tender floated by BSNL for procuring 4G equipment at a cost of Rs 9,300 crore, has brought the company back to square one.

It said that BSNL is already having 49,300 base transceiver stations (BTS), which are 4G compatible and through minor upgradation, all these equipment can be converted into 4G BTSs with an investment of about Rs 1,500 crore.

In addition to this, BSNL could have added another 15,000 BTSs, by placing an Add on Order to the existing mobile tender, it added.

Noting that in October 2019, the PSU could have rolled out pan-India 4G services, AUAB said: "Being the sole owner of the company, the Government of India also cannot shirk its responsibility in this matter."

"Adding insult to injury, the tender floated by BSNL to procure 4G equipment, has been cancelled by the government, based on a complaint from the Telecom Equipments and Services Promotional Council (TEPC)," it said.

AUAB said that BSNL is already lagging four years behind the private operators, in terms of 4G and the cancellation of the tender is going to inordinately delay the company's 4G launch.

Saying that TEPC's contention has been to bar foreign companies from participating in BSNL's tender, AUAB statement pointed out that when private operators are procuring equipment from multinationals, "why BSNL alone should be compelled to procure 4G equipments from domestic vendors, whose 4G technology is not tested or proven so far."

It alleged a conspiracy to destabilise BSNL by disrupting its rolling out of 4G services.

AUAB further said that even after the lapse of nine months, the implementation of the much publicised BSNL's Revival Package is moving at a snail's pace.

"Except the swift retrenchment of 79,000 BSNL employees under VRS, all other assurances given in BSNL's Revival Package have been put in cold storage."

The management should ensure that the salary payment of the employees is made on the last working day of every month. Deductions made from employees' salary, on account of "society dues", should immediately be remitted, it said.

Regarding the monetisation of the company's assets under the revival package, the organisation said that the land asset should not be handed over to corporates, at "throwaway" prices.

"These lands should be sold in a transparent manner and at the prevailing market rates. They should not be sold at book value or at circle rates. The AUAB will strictly monitor these dealings," it said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.