Posts Tagged Cyber Security

Features Of Data Protection Solution

Data is one of the most important business asset. During the course of business, there may be instances which can lead to data breach or complete data loss. Such occurrences can result in huge financial losses and litigation for an enterprise. This makes investing in state-of-the-art data recovery and protection solutions as one of the most important tasks for an enterprise.

Comprehensive data protection solutions enable enhanced data backup and data recovery. These solutions help in eliminating accidental data loss, recovering quickly from ransomware, virus or other malicious attacks and preventing data corruption.

Some of the main features that you should look for in a data protection solution for your organization are:

  • Incremental Forever Backup Solutions: This type of backup technology requires only one initial full backup. Once the full backup is completed, it is followed by an ongoing sequence of incremental backups. These solutions are useful in reducing the amount of data that goes around the network and the length of backup window. It is an optimized process of data restoration as only the latest version of backup blocks are restored.
  • Instant Recoveries: There are a variety of new technologies that allow data to be restored almost instantly from backups that are both local and in the cloud. It is a feature that allows a backup snapshot to run temporarily on secondary storage so as to reduce the downtime of an application.
  • Cloud Data Backup: Cloud backup solutions offer many advantages such as accessibility, file recovery and ability to tackle corrupted documents. It is commonly used in cases such as long-term retention, disaster recovery or even application testing. Cloud backup can replace on-site disk and tape libraries or they can also be used to store additional protected copies of data.
  • Orchestration: Today’s advanced orchestration tools have made it possible to automate the entire recovery process. Also, orchestration provides coordination across many automated activities. It mainly enforces a workflow order to automated tasks and enhances data security with identity & access management policies. Additionally, orchestration eliminates the potential for any errors in provisioning scaling and other cloud processes.
  • Deep Application Integration: It is important to ensure that the protected data can be accessed instantly without cumbersome consistency checks or other processes that may delay data access. Some of the basic requirements for a deep application integration are appropriate business rules and data transformational logic, adequate connectivity between platforms, longevity and flexibility of business processes, flexibility of software, hardware and other business goals.

For more information on Data Protection Solutions, call Centex Technologies at (254) 213 – 4740.

, , , ,

No Comments

Protecting Your Home IoT Devices

View Full Image

, , , ,

No Comments

What Is SamSam Ransomware?

SamSam is a targeted ransomware attack which incorporates custom infection using a wide range of exploits or brute force tactics. The ransomware is also known as Samas or SamsamCrypt. The first version of the ransomware was released in late 2015. The SamSam ransomware attacks do not make use of phishing or malware downloads to infect a network; instead they utilize following modes of infection:

  • Vulnerabilities in Remote Desktop Protocols (RDP)
  • Vulnerabilities in Java based web servers
  • Vulnerabilities in File Transfer Protocol (FTP)
  • Brute force against weak passwords
  • Stolen login credentials

Once, the ransomware has initial foothold on the victim’s network, it compromises the network to gain control. Also, SamSam is a manual attack. Thus, in case an application detects the ransomware, the attackers modify a registry entry to disable the endpoint tool’s detection. This enables them to compromise the application and control the network. SamSam uses a number of applications to accomplish the attack such as Mimikatz, reGeorg, PsExec, PsInfo, RDPWrap, NLBrute, Impacket, CSVDE, PowerSploit and JexBoss.

During the reconnaissance phase, the attackers try to write a plain text file named test.txt to target. If successful, they add the target to a list titled alive.txt on Domain Controller (DC). After ensuring that DC has writing privileges for machines, the ransomware is deployed and pushed to all the machines controlled by DC simultaneously.

The ransomware follows an efficient approach for encrypting the files on infected machines.

  • The encryption is initiated on holidays, weekends or late nights to buy time for maximizing the impact before getting noticed.
  • Files with selective extensions or important files required for running the machines are encrypted first.
  • The remaining applications or files are encrypted later; starting from smaller files and gradually moving towards larger files.
  • A unique AES key is generated for every encrypted file.
  • As soon as encryption is complete, ransomware deletes its installer and removes any traces of the attack.
  • It becomes difficult for victims to download files from off shore backup because the applications required to run the machine are also inaccessible. Thus, they are required to go thorough time consuming process of reloading the disk and installing applications before downloading back up files.

A ransom note is left on target organization’s machines demanding a set amount of bitcoin currency to decrypt a single machine and a lump sum amount for decrypting all the machines at once. Every victim is provided a unique web address on dark web which leads to chat feature for communicating with the attackers. The chat is deleted after a victim pays the ransom.

Security Practices To Prevent SamSam Attack:

  • Regularly install available patches for RDP service. Also, disable the service when not needed by the users.
  • Ensure that no RDP ports are left open during interactions between cloud-based virtual machines and public IPs. If it is required to leave RDP Port of a system open, keep the system behind firewall and instruct users to communicate with this machine via VPN.
  • Enable, two-factor authentication, strong passwords and account lockout policies.

For more information on how to secure your network, call Centex Technologies at (254) 213 – 4740.

, , , , ,

No Comments

Surprising Places Where Hackers Hide

Though most of the businesses follow the basic IT security protocols like using strong passwords, installing updated security solutions and blocking unauthorized access; there is a constant increase in number of hacking instances. Nowadays, hackers utilize diverse mediums to serve as an entry points to infect a system or network and initiate widespread attacks. It is important to be aware of these entry points in order to develop effective cybersecurity strategies.

  1. Off-brand Apps: Some apps may not be available on certain operating systems. Hackers design off-brand apps with similar features and offer them for download on these operating systems. Once a user installs this app, the system is compromised and hackers gain access to his personal data like login details,  photos, videos, etc. An example of such attack is the phishing attack that targeted Snapchat users. Hackers sent a link to users via a compromised account. This link pointed to a mobile site that was designed to look like Snapchat login page. As the users entered their login information, the details were copied and saved by the hackers. The stolen login information including passwords of affected users was then publicly posted on a phishing site.
  2. Home Appliances: Hackers now use home appliances like smart refrigerators to launch an attack. The smart home devices are generally factory configured including a preset password. It is common for users to forget to reset or personalize their password which makes them an easy target for hackers.
  3. Your Car: Most cars are installed with wireless or Bluetooth connectivity. The system enables users to enjoy benefits like keyless entries, remote start, navigation, etc. These features collect data like locations saved in navigation system, location where car is parked and other such vulnerable data. Car manufacturers tie up with third party data storage companies to store this personal information of users. This provides an opportunity for hackers to breach the system and steal the data.
  4. Cash Register: Hackers steal payment card details of customers by using POS Malware. When a card is swiped to make the payment, the payment card data is encrypted. The data is then decrypted in RAM of processing device to complete the payment. POS Malware attacks inefficiently secured systems to steal the payment card details from their RAM. The unencrypted data is then sent to the hacker. Stolen card details are then sold by the hackers.
  5. Fax Machine: The communication protocols of fax machines offer security vulnerabilities that can be used as loopholes by the hackers to launch widespread cyberattacks in organizations. Hackers create a colored jpeg image file coded with any type of malware. The coded image is sent to a target fax device where the image is decoded and saved into fax-printer’s memory. The malware can now spread over any network to which the fax printer is connected.

For more information about cybersecurity risks, call Centex Technologies at (254) 213 – 4740.

, , , ,

No Comments

Tips to Secure Data Access

PDF Version: Tips-to-Secure-Data-Access

,

No Comments