Security researchers discover malware that infected 90,000 computers worldwide

Agencies
October 8, 2019

Security researchers have discovered that the Smominru malware infected 90,000 machines worldwide during the month of August, with an infection rate of up to 4,700 computers per day.

In its post-infection phase, it steals victim credentials, installs a Trojan module and a cryptominer and propagates inside the network, according to researchers from Guardicore, a data centre and cloud security company.

The botnet uses several methods to propagate, but primarily it infects a system in one of two ways -- either by brute-forcing weak credentials for different Windows services, or more commonly by relying on the infamous EternalBlue exploit, cybersecurity firm Kaspersky said in a blog post last week.

Even though Microsoft patched the vulnerability EternalBlue exploits, which made the WannaCry and NotPetya outbreaks possible, many companies are simply ignoring updates, Kaspersky said.

China, Taiwan, Russia, Brazil and the US have seen the most attacks, but that doesn't mean other countries are out of its scope. For example, the largest network Smominru targeted was in Italy, with 65 hosts infected.

The criminals involved are not too particular about their targets, which range from universities to healthcare providers.

However, one detail is very consistent. About 85 per cent of infections occur on Windows 7 and Windows Server 2008 systems. The rest include Windows Server 2012, Windows XP and Windows Server 2003.

After compromising the system, Smominru creates a new user, called admin$, with admin privileges on the system and starts to download a whole bunch of malicious payloads.

The most obvious objective is to silently use infected computers for mining cryptocurrency (namely, Monero) at the victim's expense.

The malware also downloads a set of modules used for spying, data exfiltration, and credential theft.

On top of that, once Smominru gains a foothold, it tries to propagate further within the network to infect as many systems as possible.

To protect their network, computers, and data from Smominru, users need to update operating systems and other software regularly, Kaspersky said.

It is also important for users to use strong passwords. A reliable password manager that helps you create, manage, and automatically retrieve and enter passwords may help protect you against brute-force attacks.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 22,2020

New Delhi, Jan 22: "Don't get into a trap. Your security is in your hands," the Border Security Force (BSF) has said issuing its social media rules for its officers and men. It has directed them not to use 42 mobile applications and show caution while using Facebook, Twitter and WhatsApp.

"Be cautious while using social media," said the BSF in a circular issued recently.

"Before using WhatsApp, Facebook, Twitter and other social media platforms, one needs to keep in mind that you are border guarding force and Central Civil Services (Conduct) Rules rule duly are applicable," it said.

It further pointed out that by commenting/writing about or forwarding unverified reports and rumours one violates laws of land.

"Several times unverified reports would be presented in way that they are absolutely true and start believing it. Seeing such post always use your commonsense and never get into the trap (sic.)," it state adding that the anti-national elements uses social media to propagate their agenda to cause unrest in India.

A picture clicked by Border Security Force personnel and posted on a social media platform remains there for always. Therefore, one should use officially approved pictures about any incident or untoward incidents related to Border Security Force, stated the circular. It pointed that unauthorised persons should not engage into taking pictures of the incidents.

It also highlighted how through social media, a few BSF personnel have fallen into trap of espionage racket carried out by enemy countries.

"Our security and respect is in our hands. Always think twice whether you are doing correct by accepting friendship requests from unknown persons, especially women and girls," it cautioned the troopers and officers.

It also highlighted that while going on leave and joining back the force, always follow the rules and regulations laid out for safety and security. "This is for your own safety," it stressed in the end.

The BSF has also issued a list of 42 mobile applications that needs to be completely avoided by serving BSF officers and jawans.

They are MI store, Weibo, Wechat, Shareit, Truecaller, UC News, UC Browser, Beautyplus, NewsDog, Viva Video - QU video Inc, Parallel Space, Apus Browser, Perfect Corp, Virus Cleaner - HI Security Lab, CM browser, MI Community, DU recorder, Vault Hide - No mobile Security, Youcam Makeup, Cachecleaner DU Apps Studio, DU battery saver, DU privacy, 360 security, DU Browser,Clean master - Cheeta Mobile, Baidu Translate, Wonder Camera - Bindu Inc, ES Ifle Explorer, Photo Wonder, QQ international , QQ music, QQ Mail, AA player, QQ News Feed, Wesync, QQ security Center, Selfie City, Mail Master, Mi Video Call -Xaomi and QQ launcher.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
May 30,2020

May 30: Patients undergoing surgery after contracting the novel coronavirus are at an increased risk of postoperative death, according to a new study published in The Lancet journal which may lead to better treatment guidelines for COVID-19.

In the study, the scientists, including those from the University of Birmingham in the UK, examined data from 1,128 patients from 235 hospitals from a total of 24 countries.

Among COVID-19 patients who underwent surgery, they said the death rates approach those of the sickest patients admitted to intensive care after contracting the virus.

The scientists noted that SARS-CoV-2 infected patients who undergo surgery, experience substantially worse postoperative outcomes than would be expected for similar patients who do not have the infection.

According to the study, the 30-day mortality among these patients was nearly 24 per cent.

The researchers noted that mortality was disproportionately high across all subgroups, including those who underwent elective surgery (18.9 per cent), and emergency surgery (25.6 per cent).

Those who underwent minor surgery, such as appendicectomy or hernia repair (16.3 per cent), and major surgery such as hip surgery or for colon cancer also had higher mortality rates (26.9 per cent), the study said.

According to the study, the mortality rates were higher in men versus women, and in patients aged 70 years or over versus those aged under 70 years.

The scientists said in addition to age and sex, risk factors for postoperative death also included having severe pre-existing medical problems, undergoing cancer surgery, undergoing major procedures, and undergoing emergency surgery.

"We would normally expect mortality for patients having minor or elective surgery to be under 1 per cent, but our study suggests that in SARS-CoV-2 patients these mortality rates are much higher in both minor surgery (16.3%) and elective surgery (18.9%)," said study co-author Aneel Bhangu from the University of Birmingham.

Bhangu said these mortality rates are greater than those reported for even the highest-risk patients before the pandemic.

Citing an example from the 2019 UK National Emergency Laparotomy Audit report, he said the 30-day mortality was 16.9 per cent in the highest-risk patients.

Based on an earlier study across 58 countries, Bhangu said the 30-day mortality was 14.9 per cent in patients undergoing high-risk emergency surgery.

"We recommend that thresholds for surgery during the SARS-CoV-2 pandemic should be raised compared to normal practice," he said.

"For example, men aged 70 years and over undergoing emergency surgery are at particularly high risk of mortality, so these patients may benefit from their procedures being postponed," Bhangu added.

The study also noted that patients undergoing surgery are a vulnerable group at risk of SARS-CoV-2 exposure in hospital.

It noted that the patients may also be particularly susceptible to subsequent pulmonary complications, due to inflammatory and immunosuppressive responses to surgery and mechanical ventilation.

The scientists found that overall in the 30 days following surgery 51 per cent of patients developed a pneumonia, acute respiratory distress syndrome, or required unexpected ventilation.

Nearly 82 per cent of the patients who died had experienced pulmonary complications, the researchers said.

"Worldwide an estimated 28.4 million elective operations were cancelled due to disruption caused by COVID-19," said co-author Dmitri Nepogodiev from the University of Birmingham.

"Our data suggests that it was the right decision to postpone operations at a time when patients were at risk of being infected with SARS-CoV-2 in hospital," Nepogodiev said.

According to the researchers, there's now an urgent need for investment by governments and health providers in to measures which ensure that as surgery restarts patient safety is prioritised.

They said this includes the provision of adequate personal protective equipment (PPE), establishment of pathways for rapid preoperative SARS-CoV-2 testing, and consideration of the role of dedicated 'cold' surgical centres.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.