Posts Tagged Cybersecurity

Simple Guide To Threat Detection & Response

Posted by centexitguy in Security on November 25, 2020

What Is Threat Detection & Response (TDR)?

Threat detection & response is an application of big data analytics, where data analysis is conducted across large and disparate data sets to find anomalies, their threat level and response actions required to tackle these anomalies. TDR facilitates security professionals to detect and neutralize attacks before they can cause a breach.

What Is The Need For TDR?

Following are some reasons that emphasize on the requirement of TDR:

The large amount of data has made it difficult for cyber security teams to investigate and act on cyber attacks across widespread networks and operating environments in an effective and efficient manner.
The cyber threats have become more evolved and stealthier. They implement advanced evasion techniques such as making use of native OS tools. These techniques enable them to infect the systems without alerting the cyber security team.
Cyber attacks are directed by human operators, who are efficient in testing and adapting different pathways, if encountered by an obstacle. Thus, once inside the network, they are highly efficient in surpassing security systems.

In these circumstances, TDR helps in forming strong line of defense in layered next-generation security system.

The analysts and threat detectors uncover the attacks by looking for suspicious events, anomalies and patterns in regular activity. These anomalies are then tested to see if they involve malicious agents.
The human insight is coupled with AI technologies such as AI-guided detection. This makes it easier to analyze a large amount of data in a short period and efficient manner.
The TDR system does not only find the hidden threats, but also works towards finding a response to neutralize it.

What Is TDR Framework?

The TDR framework consists of four pillars:

Observe: What do you see in the raw data?
Orient: What is the context or how does it map against existing attack TTPs (tactics, techniques and protocols)?
Decide: Is it malicious, suspicious or benign?
Act: Mitigate, neutralize and re-enter the analysis loop

What Are The Components Of TDR?

TDR has five core components:

Prevention: Effective prevention requires the knowledge about the location of critical data and computational resources over the network. It involves effective and regular configuration of technology and access controls. Maintaining efficient prevention techniques reduces the number of security alerts generated on a daily basis.
Collecting Security Events, Alerts And Detections: Security data may be collected and reviewed by adopting any of these methods; Event-centric, Threat-centric, or Hybrid.
Prioritizing Signals That Matter: Once the events are detected, it is important to prioritize them to find actual threats. Apply well-managed security filters to separate security incidents from event logs.
Investigation: After isolating the key signals, measure them against industry frameworks and models for further investigation. The aim of the investigation is to check if the signal is indicative of an actual attack and where does it fall in the attack sequence.
Action: This involves identifying and implementing relevant response for containing the threats.

For more information on threat detection & response, contact Centex Technologies at (254) 213 – 4740.

cyber threat, Cybersecurity, TDR, Threat Detection & Response

No Comments

What Is CryptoWall Ransomware?

Posted by centexitguy in Security on November 23, 2020

A ransomware is a type of malware that encrypts user files on victim computer or network. The attacker then demands a ransom from the victim in exchange for the decryption key. CryptoWall is a family of such file-encrypting ransomware. It first appeared in early 2014 and has numerous variants including Cryptorbit, CryptoDefense, CryptoWall 2.0, and CryptoWall 3.0. The early variants used RSA public key for file encryption, however, the new versions use AES key for file encryption. The AES key is further encrypted using a public key. This makes it impossible to get the actual key needed to decrypt the files.

Mode Of Infection:

Traditionally, CryptoWall ransomware was distributed via exploit kits. But, now spam emails are also used to infect the victims. The spam email contains RAR attachment that includes a CHM file. When the victim opens the CHM file, it downloads ‘CryptoWall binary’ to the system and copies itself into the %temp% folder.

CHM file – Compiled HTML or CHM file is an interactive html file that is compressed inside a CHM container and may hold other files such as JavaScript, images, etc. inside it.

Execution:

The Cryptowall binary downloaded on the system is compressed or encoded. Useless instructions and anti-emulation tricks are deliberately inserted in the coding to break AV engine protection.
On execution, it launches a new instance of explorer.exe process.
In the next step, the ransomware injects its unpacked CrytoWall binary and executes the injected code.
The original process automatically exits itself after launching the injected explorer process.
The files are encrypted and the ransomware deletes the volume shadow files using ‘vssadmin.exe’ tool. This makes sure that the encrypted files may not be recovered.
The CryptoWall binary is copied to various locations such as %appdata%, %startup%, %rootdrive%, etc. The copies are added to the auto start key to help them stay persistent even after the infected system is rebooted.
A new svchost.exe process is launched with user privilege and malicious binary code is injected into it.
The ransomware connects to I2P proxies to find live command and control server.
The server replies with unique encryption key generated specifically for the target system. The key starts the file encryption thread and drops ransom notes in all directories.
Finally, it launches Internet Explorer to display ransom notes and the hollowed svchost process kills itself.

Protection:

Keep antivirus up-to-date
Back up the files
Apply windows update regularly
Avoid clicking random emails
Disable remote desktop connections
Block binaries running from %appdata% and %temp% paths

For more information on Cryptowall ransomware, contact Centex Technologies at (254) 213 – 4740.

CryptoWall Ransomware, Cyber Crime, Cybersecurity, Malware, Ransomware

No Comments

Most Dangerous Virus & Malware Threats Of 2020

Posted by centexitguy in Security on October 22, 2020

Cyber criminals keep on evolving virus and malware to make them advanced and more dangerous. This allows them to target new vulnerabilities and operating system versions. To keep the business network secure, it is important for businesses to have in-depth information about new virus and malware. This knowledge comes handy in creating strategies to protect the systems against these virus & malware.

So, here is a list of most dangerous virus & malware threats of 2020 to help businesses understand and strategize against these cyber attacks:

Clop Ransomware: Clop is a variant of CryptoMix ransomware that targets Windows users. Clop ransomware blocks the Windows processes and disables multiple Windows applications including Windows Defender and Microsoft Security Essentials. Once these applications are blocked, the ransomware encrypts the data files on the target system and demands ransom in exchange of decryption key.
Fake Windows Update (Hidden Ransomware): Cyber criminals have been taking advantage of the need for installing latest Windows updates. The latest ransomware makes use of phishing email that instructs users to install urgent Windows update. The email contains ransomware ‘.exe’ files that are disguised as Windows update link. The ransomware, known as ‘Cyborg’, encrypts all the files and programs and demands a ransom payment for decrypting the files.
Zeus Gameover: It is a part of Zeus family of malware and viruses. The piece of malware is a Trojan that accesses sensitive bank account details to steal the funds. This variant of Zeus family does not require a centralized “Command & Control” server. It can actually bypass centralized servers and create independent servers to send sensitive information.
RaaS: It is also known as “Ransomware as a Service” is a growing industry. People can hire a hacker or team of hackers to perform the attack for them. These services can be used by people with zero prior knowledge of coding to carry out dangerous cyber attacks.
Fleeceware: It is a type of malware that continues to charge large amounts of money to app users, even after they have deleted their accounts from the app. Although, this malware doesn’t infect or encrypt any user files, it is still a shady practice used by app developers wanting to cash on unsuspecting users.

For more information on latest cybersecurity techniques, contact Centex Technologies at (254) 213 – 4740.

Cyber Attacks 2020, Cybersecurity, Malware Threats, Virus & Malware

No Comments

Everything You Need To Know About Click Fraud

Posted by centexitguy in Security on September 30, 2020

As the number of organizations investing in digital marketing is increasing, there has been an increase in fraudsters trying to take advantage of digital marketing platforms to drain revenue from such organizations. Click fraud is an example of frauds based on digital marketing and occurs on PPC online advertizing.

Let Us Understand The PPC Concept-

PPC or Pay-Per-Click is an online advertizing campaign. An organization contacts relevant websites, bloggers, influencers, etc. to place its ad on their page to attract target audience. When a user clicks on the advertizement, he is redirected to the landing page of the advertizing website resulting in higher lead generation. The website that places the ad on its page is paid a certain amount for every user that clicks on the advertizement.

What Is Click Fraud?

A click fraud is a technique that is used to falsely increase the number of clicks on a PPC ad. In other words, a click fraud or ‘invalid clicks’ (as termed by Google) is when a paid advertizement is intentionally clicked repeatedly. Higher the number of clicks on the ad, higher is the amount paid by the advertizer to the host website (where the ad is posted). The aim of a click fraud is to either generate higher revenue for the host website or drain revenue from the advertizer. One of the common techniques employed in click frauds is the use of click bots.

What Is A Click Bot?

A bot is a software that operates on the internet and is used to perform repetitive tasks. Click bots are used by the fraudulent websites to repetitively click on advertisements posted on their website in order to increase the number of clicks.

How Does Click Fraud Impact The Advertizer?

A click fraud impacts an advertizer in numerous ways:

It costs an advertizer higher PPC cost.
It drains a business of investment money that could be used for other business development tasks.
It results in inaccurate results from PPC campaign data analysis leading to misinformed critical marketing decisions.

How To Fight Against Click Fraud?

It is common for competitors to launch click fraud attacks to impact each other’s marketing campaign. In order to avoid this, search Google for keywords relevant to your niche and identify your competitors. After identifying the major competitors, use tools like ClickForensics, AdWatcher or ClickDefense fraudulent ad clicks.
Closely monitor your campaigns using different tools. It will give you a fair idea of how the campaign is performing in relevance to your campaign goals.
Some websites may offer low PPC rates; however be vigilant to choose high-value sites. Thoroughly research the websites to find a relevant & suitable site that is full of potential customers.
Employ bot management to identify fraud bots and block them from an application/website.
You can also invest in fraud prevention software that are specifically designed to spot and avoid click frauds.

For more information on Ads management and click-fraud prevention, contact Centex Technologies at (254) 213 – 4740.

Click Fraud, Cyber Crime, Cybersecurity, Digital Marketing, PPC Fraud

No Comments

Understanding Clop Ransomware

Posted by centexitguy in Security on August 21, 2020

Clop is a ransomware-type virus that belongs to the CryptoMix family. The word ‘Clop’ itself means ‘bug’ in Russian. The virus is mostly aimed at English-speaking users and tends to target complete networks instead of individual users.

Clop ransomware infects systems running on the Microsoft Windows platform. It has been designed to encrypt data and rename every file by appending the ‘.clop’ extension. After successful encryption of files, Clop generates a text file containing the ransom message and places its copy in every existing folder. Another unique character of Clop ransomware is the string ‘Dont Worry C|0P’ included in the ransom note. The decryption keys are stored on a remote server controlled by cyber criminals. This makes it necessary for every victim to pay the ransom in order to get the decryption key.

What Is The Payload Used For Clop Ransomware?

Transmission:

The Clop ransomware is distributed in the form of an executable that has been a code-signed digital signature. It makes the executable appear more legitimate and helps it in bypassing the system security.

The virus infection is spread through a macro or JavaScript attachment in a spam email. Sometimes, the virus may be delivered as a downloadable link in an email. Other ways of spreading the Clop ransomware include exploit kits, malwertizement, and compromised websites.

Execution:

After infection, the virus first stops the Windows services and programs to ensure the disabling of antivirus software such as Windows Defender etc. Additionally, it closes all the files so that they are ready for encryption. For disabling the Windows Defender, the virus configures various Registry values that disable behavior monitoring, real time protection, sample uploading to Microsoft, Tamper protection, cloud detections, and antispyware detections. In the case of older computer systems, Clop uninstalls Microsoft Security Essentials to surpass the security.

After terminating processes, it creates a batch file, which is executed soon after the ransomware is launched. The batch file disables windows automatic Startup repair. The ransomware then starts encrypting the files on the victim system and adds the ‘.Clop’ extension to the name of encrypted files.

The ransom note is created under the name ‘ClopReadMe.txt’ and a copy is placed in every folder.

How To Stay Protected?