Risk
11/30/2012
03:44 PM
Connect Directly
RSS
E-Mail
50%
50%

Ransomware, Social Scams Lead 2013 SMB Security Fears

Expect the bad guys to spend more time pursuing small and midsize business (SMB) targets on mobile, cloud, and social platforms, Symantec says.

Windows 8: 8 Big Benefits For SMBs
Windows 8: 8 Big Benefits For SMBs
(click image for larger view and for slideshow)
The greater the changes in security threats, the more determined businesses should be to stick with best practices to defend themselves.

That's the general takeaway from the security researchers at Symantec, who believe attackers will find new and better ways to reap profits from mobile, cloud, and social usage in 2013. But although threats such as more "professional" ransomware might evolve, the advice on how to combat them should sound familiar. The right mix of security technologies, backup and recovery processes, and employee awareness will help keep the risks, new and old, in check for small and midsize businesses (SMBs).

"I don't think any of those steps are new," said Kevin Haley, director of Symantec Security Response, in an interview. Still, it's a good time of year for an update on what SMBs should be watching for.

With ransomware, Haley predicts criminals will become more sophisticated in their attack methods, more vicious and emotional in their threats, and greedier in their demands. Whereas the fake antivirus scareware of the past might try to fool users into giving up credit card numbers or other information, its ransomware descendants are more likely to openly threaten the user to extort payment. "We're going to see that kind of harder attitude [of] 'I don't care if I fool you or not, I'm holding you hostage and you're going to pay up,'" Haley said.

[ Read Fake Antivirus Ringleader Must Pay $163 Million. ]

Threats of this nature aren't new, but they're expected to grow fiercer. One key reason: It's easier than ever for the criminal to collect the extorted funds, by using prepaid cards or electronic money services such as MoneyPak in the U.S. or Ukash in Europe. Credit cards are too easy for victims to cancel, and other tools such as premium text messaging proved to be inefficient collection methods for attackers, according to Haley. Prepaid cards and online payments, on the other hand, provide "an easy way for [criminals] to get the money and prosper, unfortunately, and to come up with creative ways to rip us off," Haley said.

Haley thinks ransomware will appear increasingly polished on affected users' PCs -- which will make it more difficult for the typical employee to identify it as a scam. The threats themselves will also progress. The classic ransomware pitch is to impersonate a law enforcement agency and claim the user has illegal material on his machine, and order him to pay a fine or face imprisonment. A newer instance, according to Haley, involved the attacker pretending to be with the hacktivist group Anonymous group and threatening online ruin unless the users paid up. For SMBs, such attacks might also take the form of taking control of databases or applications and demanding payment for their release.

"[Ransomware attacks] are going to do things to keep people scared [and] off-balance, so that they don't think clearly and are willing to pay that ransom to get it off that machine," Haley said. His advice if you're affected: Don't pay. "They're not really going to unlock your system," Haley said. "Once they've got your money, why do they care?" A company might still face a productivity problem while IT fixes affected systems, but calling the extortionist's bluffs at least prevents an added financial loss.

Symantec also predicts a new wave of malware and social engineering delivered via social networks. As sites such as Facebook and Twitter continue their hunt for revenue streams, attackers will follow the money. Expect employees who use applications such as Facebook Gifts, for example, to be hit with a rising number of scams that attempt to lift personal data, payment information or corporate credentials. Such attacks might also simply be designed to deliver malware to the user's machine and network, with similar bottom-line goals.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant