Still Getting Served: A Look at Recent Malvertising Campaigns Involving Exploit Kits

| March 15, 2017

article image
Malvertising occurs when an online advertising network knowingly or unknowingly serves up malicious advertisements on a website. Malvertisements are a type of “drive-by” threat that tend to result in users being infected with malware for simply visiting a website. The victims of this threat are often compromised when the malvertisement directs them to an exploit kit (EK) landing page. Depending on the applications running on the user’s system, the EK can successfully load malware into a system without user consent and without tipping the victim off that something suspicious is happening.

Spotlight

AppRiver

AppRiver is a Software-as-a-Service (SaaS) application provider offering award-winning email and Web security solutions to businesses of all sizes. Understanding the need to protect networks from today's increasingly complex IT threats, AppRiver offers businesses a comprehensive, yet affordable subscription-based solution that incorporates the latest spam and virus protection, email encryption and Web security on the market. In addition, the company provides a complete managed service for Microsoft Exchange, as well as a bundled Office 365 solution. Since its inception, AppRiver has sustained an impressive 93% customer retention rate while growing its customer base to more than 47,000 companies and over 10 million mailboxes worldwide. The company is led by an Ernst & Young Florida Entrepreneur of the Year award winner, and has been identified as a Top 20 Cloud Security Vendor by Everything Channel's CRN magazine.

OTHER ARTICLES

5 Benefits of Investing in Cyber Security & IT solutions in 2021

Article | June 2, 2021

Cyber Security has quickly evolved from being just an IT problem to a business problem. Recent attacks like those on Travelex and the SolarWinds hack have proved that cyber-attacks can affect the most solid of businesses and create PR nightmares for brands built painstakingly over the years. Investing in cyber security training, cyber security advisory services and the right kind of IT support products, has therefore, become imperative in 2021. Investing in cyber security infrastructure, cyber security certification for employees and IT solutions safeguards businesses from a whole spectrum of security risks, ransomware, spyware, and adware. Ransomware refers to malicious software that bars users from accessing their computer system, whereas adware is a computer virus that is one of the most common methods of infecting a computer system with a virus. Spyware spies on you and your business activities while extracting useful information. Add social engineering, security breaches and compromises to your network security into the mix, and you have a lethal cocktail.

Read More

NATO Adds Cyber Commitments, Potential Ransomware Response

Article | August 30, 2021

As President Biden prepared to meet with Russian President Putin this past week in a high-profile summit in Geneva, Switzerland, cyber-attacks originating from criminals within Russia were near the top of a list of contentious issues on the agenda. However, there were important events that received minimal media attention that strengthened the U.S. President’s position. President Biden walked into those meetings with something new and bold: the strong backing of NATO countries on a series of new cyber commitments. In a NATO Summit held in Brussels on June 14, 2021, the heads of state and government participating in the meeting of the North Atlantic Council reaffirmed their unity and commitments on a long list of mutual defense topics. And there was also a major new commitment discussed in the press release — cyber-attacks against critical infrastructure within any NATO member country were now on the table. That is, online (Internet-based) attacks could result in the same response as physical attacks (with guns and bombs.) Yes, this is a very significant global development which highlights another way that the physical world and online world are merging fast, with ramifications in both directions. HOW DID WE GET TO THIS MOMENT? The ransomware attacks that recently struck critical infrastructure companies such as Colonial Pipeline and JBS resulted in more than just long lines for gas and meat price hikes. It raised alarm bells in countries all over the globe regarding the susceptibility of the majority of countries to ransomware and other forms of malware. These ransomware incidents led to NATO’s new Comprehensive Cyber Defense Policy. The big news: Cyber-attacks against critical infrastructure might (on a case-by-case basis) now trigger the famous Article 5 clause. “The Parties agree that an armed attack against one or more of them in Europe or North America shall be considered an attack against them all and consequently they agree that, if such an armed attack occurs, each of them, in exercise of the right of individual or collective self-defense recognized by Article 51 of the Charter of the United Nations, will assist the Party or Parties so attacked by taking forthwith, individually and in concert with the other Parties, such action as it deems necessary, including the use of armed force, to restore and maintain the security of the North Atlantic area. …” Here are two sections I’d like to highlight from last week’s communiqué (take special notice of section in bold): “In addition to its military activities, Russia has also intensified its hybrid actions against NATO Allies and partners, including through proxies. This includes attempted interference in Allied elections and democratic processes; political and economic pressure and intimidation; widespread disinformation campaigns; malicious cyber activities; and turning a blind eye to cyber criminals operating from its territory, including those who target and disrupt critical infrastructure in NATO countries. It also includes illegal and destructive activities by Russian Intelligence Services on Allied territory, some of which have claimed lives of citizens and caused widespread material damage. We stand in full solidarity with the Czech Republic and other Allies that have been affected in this way. “Cyber threats to the security of the Alliance are complex, destructive, coercive and becoming ever more frequent. This has been recently illustrated by ransomware incidents and other malicious cyber activity targeting our critical infrastructure and democratic institutions, which might have systemic effects and cause significant harm. To face this evolving challenge, we have today endorsed NATO’s Comprehensive Cyber Defence Policy, which will support NATO’s three core tasks and overall deterrence and defence posture, and further enhance our resilience. Reaffirming NATO’s defensive mandate, the Alliance is determined to employ the full range of capabilities at all times to actively deter, defend against and counter the full spectrum of cyber threats, including those conducted as part of hybrid campaigns, in accordance with international law. We reaffirm that a decision as to when a cyber-attack would lead to the invocation of Article 5 would be taken by the North Atlantic Council on a case-by-case basis. Allies recognize that the impact of significant malicious cumulative cyber activities might, in certain circumstances, be considered as amounting to an armed attack. We remain committed to act in accordance with international law, including the UN Charter, international humanitarian law and international human rights law as applicable. We will promote a free, open, peaceful and secure cyberspace, and further pursue efforts to enhance stability and reduce the risk of conflict by supporting international law and voluntary norms of responsible state behavior in cyberspace.” MEDIA COVERAGE OF NATO ANNOUNCEMENTS Global media coverage leading up to this NATO Summit was rather limited, especially when compared to the U.S.-Russia Summit and many of President Biden’s other European meetings – such as the G7 Summit and the his meeting with Queen Elizabeth II. Nevertheless, Meritalk offered this article: “Cybersecurity, Ransomware Climb Policy Ladder at NATO, G-7 Meetings,” which said, “cybersecurity in general, and ransomware in specific, climbed high onto the ladder of major policy issues at both the weekend meeting of G-7 nations this weekend, and the NATO Summit that concluded on June 14. “The increasing importance of cybersecurity on the national stage tracks with U.S. policy in recent months, including federal government responses to major software supply chain cyber assaults and ransomware attacks against U.S. critical infrastructure sector companies that are believed to have originated from organizations based in Russia. President Biden has promised to confront Russian President Vladimir Putin with cybersecurity and ransomware issues when the two leaders meet on June 16. …” Also, Info security Magazine ran an excellent piece entitled: “NATO Warns it Will Consider a Military Response to Cyber-Attacks,” which said, “NATO has warned it is prepared to treat cyber-attacks in the same way as an armed attack against any of its allies and issue a military response against the perpetrators. “In a communique issued by governments attending the meeting of the North Atlantic Council in Brussels yesterday, the military alliance revealed it had endorsed a Comprehensive Cyber Defence Policy, in which a decision will be taken to invoke Article 5 “on a case-by-case basis” following a cyber-attack. Under Article 5 of the NATO treaty, first signed in 1949, when any NATO ally is the victim of an armed attack, it will be considered an attack on all alliance members, who will theoretically take any actions necessary to defend that ally….” When I posted this NATO cyber topic on LinkedIn, the responses were all over the map. You can join that discussion here. Here are a few comments worth noting: Michael Kaiser, president and CEO at Defending Digital Campaigns: “Attribution better be 110 percent.” Paul Gillingwater, management consultant, Chaucer Group: “A cyber counter-attack *is* a military response. It's now one battlefield, from sea, land, air, space to cyberspace. Next: your AI will be trying to persuade my AI that it was actually a pacifist.” Kaushik (Manian) Venkatasubramaniyan, project manager, Global Business Research (GBR): “These kind of cyber-attacks targeting hospitals etc. are acts of war anyway.” FINAL THOUGHTS ON IMPORTANCE OF NATO ANNOUNCEMENT For many years, cyber pros have been talking about a “Cyber 9/11” or “Cyber Pearl Harbor.” Many experts still believe that those major cyber incidents are inevitable. Still, “smaller” cyber-attacks are now happening all the time all over the world — with very serious consequences. Bad actors are asking for larger ransoms and causing more harm. Ransomware is evolving, and future cyber-attacks may not be ended by paying a ransom to the cyber criminals. With many cyber-attacks against governments, hospitals and now critical infrastructure like gas pipeline companies and food processing plants taking place, new government actions were a must. These ransomware attacks via different types of malware are becoming more frequent and serious, and are a growing global challenge for public- and private-sector leaders. Many questions must be answered quickly, such as: Where are the “red lines” that cannot be crossed? Once the lines are identified, what happens if they are crossed? When does a cyber-attack become an act of war? Make no mistake, NATO’s new policy on cyber-attacks against critical infrastructures is a big deal. Expect more ransomware attacks to occur and those global commitments for action to be tested in the years ahead. Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/nato-adds-cyber-commitments-potential-ransomware-response

Read More

Authentication and Passwords Concerns Top New Ponemon Institute Report

Article | February 20, 2020

IT security practitioners are aware of good habits when it comes to strong authentication and password management, yet often fail to implement them due to poor usability or inconvenience, says the 2020 State of Password and Authentication Security Behaviors Report by Yubico and Ponemon Institute. According to the report,IT security practitioners and individuals are both engaging in risky password and authentication practices, yet expectation and reality are often misaligned when it comes to the implementation of usable and desirable security solutions. The tools and processes that organizations put in place are not widely adopted by employees or customers, making it abundantly clear that new technologies are needed for enterprises and individuals to reach a safer future together.

Read More

As Ransomware Surge Continues, Where Next for Government?

Article | August 30, 2021

Global leaders want to carve out specific areas of critical infrastructure to be protected under international agreements from cyber-attacks. But where does that leave others? There are ‘four or five steps you could take that could significantly mitigate this risk,’ Falk said. These are patching, multifactor authentication and all the stuff in the Australian Signals Directorate's Essential Eight baseline mitigation strategies. …” Back in April of this year, a BBC News headline read, "The ransomware surge ruining lives." And that was before the cyber-attacks on critical infrastructure sectors like Colonial Pipeline, meat-processing giant JBS, the Irish Health Service and so many others. And when President Biden met with Russian President Putin last month in Geneva, he declared that certain critical infrastructure should be “off-limits” to cyber-attacks. “We agreed to task experts in both our countries to work on specific understandings about what is off-limits,” Biden said. “We’ll find out whether we have a cybersecurity arrangement that begins to bring some order.” As an initial positive step forward, this cyber defense policy makes sense. In fact, most global experts applaud these moves and efforts to better protect and clarify international crimes in cyberspace. Previous administrations going back to George W. Bush have taken aggressive steps to ensure critical infrastructure is protected in the U.S. and around the world through actions involving people, process and technology, both offline and online. The 16 critical infrastructure sectors identified by DHS/CISA can be found here. Still, many questions remain regarding this new policy: Will all global governments actually agree on the wording? More importantly, even if they do agree, how will the agreements be enforced? Also, what happens if some countries continue to allow criminals to attack these critical infrastructure sectors from their soil? And my main question goes further: Even if all of these agreements and actions are 100 percent agreed upon and enforced, which most people don’t believe will happen, does this imply that every organization not covered under these 16 critical infrastructure sectors can be openly attacked without a response? Is this giving into cyber criminals for everyone else? For example, would K-12 schools or small businesses be “fair game” and not off limits? Could this actually increase attacks for any organization not considered on the CISA list? No doubt, some will say that schools are a part of government, and yet there are private schools. In addition, if we do cover all others somehow, perhaps as a supplier of these 16 sectors, doesn’t that make the “off-limits” list essentially meaningless? Essentially, where is the line? Who is included, and what happens when some nation or criminal group crosses the line? These questions became more than an intellectual thought exercise recently when the Kaseya ransomware attack impacted more than 1,500 businesses, without, in their words, impacting critical infrastructure. CBS News reports, “Still, Kaseya says the cyber-attack it experienced over the July 4th weekend was never a threat and had no impact on critical infrastructure. The Russian-linked gang behind the ransomware had demanded $70 million to end the attack, but CNBC reported that the hackers reduced their demands to $50 million in private conversations. "The Miami-based company said Tuesday that it was alerted on July 2 to a potential attack by internal and external sources. It immediately shut down access to the software in question. The incident impacted about 50 Kaseya customers.” OTHER RECENT RANSOMWARE NEWS Meanwhile, in a bit of a surprise, ransomware group REvil disappeared from the Internet this past week, when its website became inaccessible. As Engadget reported, “According to CNBC, Reuters and The Washington Post, the websites operated by the group REvil went down in the early hours of Tuesday. Dmitri Alperovitch, former chief technology officer of the cyber firm CrowdStrike, told The Post that the group's blog in the dark web is still reachable. However, its critical sites victims use to negotiate with the group and to receive decryption tools if they pay up are no longer available. Visitors to those websites now see a message that says ‘A server with the specified host name could not be found.’" CNBC reported: “There are 3 main possibilities for the criminal gang’s disappearance — each of which carries good and bad news for U.S. efforts to combat the ransomware scourge emanating from Russia. The Kremlin bent under U.S. pressure and forced REvil to close up shop. U.S. officials tired of waiting for Kremlin cooperation and launched a cyber operation that took REvil offline. REvil’s operators were feeling the heat and decided to lay low for a while. "This situation may send a message to some of the players that they need to find a less-aggressive business model, which could mean avoiding critical infrastructure, or it could mean avoiding U.S. targets.” Also, the Biden administration announced several other measures to combat ransomware: “The Biden administration will offer rewards up to $10 million for information leading to the identification of foreign state-sanctioned malicious cyber activity against critical U.S. infrastructure — including ransomware attacks — and the White House has launched a task force to coordinate efforts to stem the ransomware scourge. "It is also launching the website stopransomware.gov to offer the public resources for countering the threat and building more resilience into networks, a senior administration official told reporters.” And yet, many experts are still predicting that ransomware will continue to grow in the near future. For example, TechHQ wrote that “identifying the culprits often isn't as big an obstacle as apprehending them.” To show recent growth of ransomware attacks, Fox Business offered details on a Check Point report this past week that “ransomware attacks surge, growing 93 percent each week.” Also: “'The ransomware business is booming. We’re seeing global surges in ransomware across every major geography, especially in the last two months,' said Lotem Finkelstein, head of threat intelligence at Check Point Software. 'We believe the trend is driven by scores of new entrants into the ransomware business.'" For more background on this hot topic, a few weeks back I appeared on MiTech News to discuss the ransomware crisis. FINAL THOUGHTS I’d like to close with this article which offers a slightly different perspective on ransomware from ZDNet Australia: “The threat of ransomware dominates the cyber news right now, and rightly so. But this week Rachael Falk, chief executive officer of Australia's Cyber Security Cooperative Research Centre, made a very good point. Ransomware is ‘Totally foreseeable and preventable because it's a known problem," Falk told a panel discussion at the Australian Strategy Policy Institute (ASPI) on Tuesday. ‘"It's known that ransomware is out there. And it's known that, invariably, the cyber criminals get into organisations through stealing credentials that they get on the dark web [or a user] clicking on a link and a vulnerability," she said. ‘We're not talking about some sort of nation-state really funky sort of zero day that's happening. This is going on the world over, so it's entirely foreseeable.’" Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/as-ransomware-surge-continues-where-next-for-government

Read More

Spotlight

AppRiver

AppRiver is a Software-as-a-Service (SaaS) application provider offering award-winning email and Web security solutions to businesses of all sizes. Understanding the need to protect networks from today's increasingly complex IT threats, AppRiver offers businesses a comprehensive, yet affordable subscription-based solution that incorporates the latest spam and virus protection, email encryption and Web security on the market. In addition, the company provides a complete managed service for Microsoft Exchange, as well as a bundled Office 365 solution. Since its inception, AppRiver has sustained an impressive 93% customer retention rate while growing its customer base to more than 47,000 companies and over 10 million mailboxes worldwide. The company is led by an Ernst & Young Florida Entrepreneur of the Year award winner, and has been identified as a Top 20 Cloud Security Vendor by Everything Channel's CRN magazine.

Events