Risk

11/30/2012
03:44 PM
50%
50%

Ransomware, Social Scams Lead 2013 SMB Security Fears

Expect the bad guys to spend more time pursuing small and midsize business (SMB) targets on mobile, cloud, and social platforms, Symantec says.

Windows 8: 8 Big Benefits For SMBs
Windows 8: 8 Big Benefits For SMBs
(click image for larger view and for slideshow)
The greater the changes in security threats, the more determined businesses should be to stick with best practices to defend themselves.

That's the general takeaway from the security researchers at Symantec, who believe attackers will find new and better ways to reap profits from mobile, cloud, and social usage in 2013. But although threats such as more "professional" ransomware might evolve, the advice on how to combat them should sound familiar. The right mix of security technologies, backup and recovery processes, and employee awareness will help keep the risks, new and old, in check for small and midsize businesses (SMBs).

"I don't think any of those steps are new," said Kevin Haley, director of Symantec Security Response, in an interview. Still, it's a good time of year for an update on what SMBs should be watching for.

With ransomware, Haley predicts criminals will become more sophisticated in their attack methods, more vicious and emotional in their threats, and greedier in their demands. Whereas the fake antivirus scareware of the past might try to fool users into giving up credit card numbers or other information, its ransomware descendants are more likely to openly threaten the user to extort payment. "We're going to see that kind of harder attitude [of] 'I don't care if I fool you or not, I'm holding you hostage and you're going to pay up,'" Haley said.

[ Read Fake Antivirus Ringleader Must Pay $163 Million. ]

Threats of this nature aren't new, but they're expected to grow fiercer. One key reason: It's easier than ever for the criminal to collect the extorted funds, by using prepaid cards or electronic money services such as MoneyPak in the U.S. or Ukash in Europe. Credit cards are too easy for victims to cancel, and other tools such as premium text messaging proved to be inefficient collection methods for attackers, according to Haley. Prepaid cards and online payments, on the other hand, provide "an easy way for [criminals] to get the money and prosper, unfortunately, and to come up with creative ways to rip us off," Haley said.

Haley thinks ransomware will appear increasingly polished on affected users' PCs -- which will make it more difficult for the typical employee to identify it as a scam. The threats themselves will also progress. The classic ransomware pitch is to impersonate a law enforcement agency and claim the user has illegal material on his machine, and order him to pay a fine or face imprisonment. A newer instance, according to Haley, involved the attacker pretending to be with the hacktivist group Anonymous group and threatening online ruin unless the users paid up. For SMBs, such attacks might also take the form of taking control of databases or applications and demanding payment for their release.

"[Ransomware attacks] are going to do things to keep people scared [and] off-balance, so that they don't think clearly and are willing to pay that ransom to get it off that machine," Haley said. His advice if you're affected: Don't pay. "They're not really going to unlock your system," Haley said. "Once they've got your money, why do they care?" A company might still face a productivity problem while IT fixes affected systems, but calling the extortionist's bluffs at least prevents an added financial loss.

Symantec also predicts a new wave of malware and social engineering delivered via social networks. As sites such as Facebook and Twitter continue their hunt for revenue streams, attackers will follow the money. Expect employees who use applications such as Facebook Gifts, for example, to be hit with a rising number of scams that attempt to lift personal data, payment information or corporate credentials. Such attacks might also simply be designed to deliver malware to the user's machine and network, with similar bottom-line goals.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12716
PUBLISHED: 2018-06-25
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its l...
CVE-2018-12705
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).
CVE-2018-12706
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.
CVE-2018-12714
PUBLISHED: 2018-06-24
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial o...
CVE-2018-12713
PUBLISHED: 2018-06-24
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was ...