Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
New 'Fantom' Ransomware Poses As Windows Update
Threaded  |  Newest First  |  Oldest First
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/30/2016 | 9:46:05 PM
SMH
The very fact that we do not have the VAST majority of IT managers at mid-size and large-size businesses mandating regular backups is a serious problem.  Ransomware just makes the ineptitude of most IT departments more obvious.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 9:54:22 AM
Re: SMH
Very much agree with you. From a data management perspective, backing up the data is a pretty simplistic process and I would say in most cases when not performed is representative of negligence.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:06:20 AM
Re: SMH
"... backing up the data is a pretty simplistic process ..."

I agree. Especially with the cloud backup it is just connecting and letting it go.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 11:45:53 AM
Re: SMH
Yes, definitely but there are other considerations to make in the corporate context such as where is that data stored? What protections secure that data? Who has ownership? Due to this many institutions incorporate an onsite backup methodology.
jcavery
jcavery,
 User Rank: Moderator
8/31/2016 | 1:46:50 PM
Re: SMH
I think any backup process is simple enough for anyone who frequents this site, DarkReading, however think about parents, grandparents, people who have no idea how backups work or how to set one up. Any enterprise that falls victim to this should be ashamed, but its tougher to pin blame on the older folks in their own private homes, those are the ones we need to help watch out for and protect too. How? I'm not sure yet.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/31/2016 | 2:25:29 PM
Re: SMH
@jcavery: It's kind of dumb if you think about it.  Floppy drives used to come standard on computers (both desktops and laptops).  Local backup was a breeze.  Now floppy drives are considered obsolete because we have thumb drives.  Except thumb drives are still pretty expensive -- unless you get free ones at conferences...which may be infected with malware.

Meanwhile, I've got an old ZIP Drive and ZIP Disks kicking around somewhere and I can't get to what's backed up on those from years ago because nobody makes machines with those printer ports anymore.

Now I'm cranky and wistful for the good old days.  Get off my lawn.
jcavery
jcavery,
 User Rank: Moderator
8/31/2016 | 7:28:25 PM
Re: SMH
If you have ever gotten behind the wrong person in line at a grocery store with the chipped debit cards, you can understand why that person might also have trouble configuring a reliable backup system on their PC. Back in my day the only chips in a grocery store were right next to the salsa!

That ball that flew over my fence? I'm keeping it. It's mine now.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
9/1/2016 | 1:08:18 PM
Re: SMH
Oh, yes, I definitely understand it (heck, even I have issues with the chip scanners sometimes -- especially because of the inconsistency among retailers).  It just used to be much easier and more straightforward.  (But, of course, fewer people had personal computers back then.)

Now stop skateboarding on the sidewalk!
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 10:58:18 AM
Re: SMH
" ...regular backups ..."

I agree. Business is one thing, home users something else, mostly they do not have a backup so they have to pay for their photos.
emjones_uow
emjones_uow,
 User Rank: Apprentice
8/31/2016 | 2:36:40 AM
VPN for Additional Security
I would urge users to get additional security layers. There are plenty of good VPN service providers out there in the market who are promising 256 bit encryption, strict no log policy, agree or not, VPN has indeed become a need of the time, considering the amount of threats faced by internet users. I would suggest users to spare $5 per month and buy Purevpn, Express, Vypr etc though there are other vpn service providers as well and you are encouraged to do a comparison by yourself.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 9:56:40 AM
Re: VPN for Additional Security
Yes, but as you said make sure there is a no log policy and that other users are not sharing your pipe. People need to remember that a VPN is a tunnel for all who share that pipe and you are at the mercy of other users that may not have such a secure configuration.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:10:35 AM
Re: VPN for Additional Security
" ...  VPN is a tunnel for all who share that pipe ..."

It is not supposed to be shared, it would not be Private in that case.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:10:42 AM
Re: VPN for Additional Security
" ...  VPN is a tunnel for all who share that pipe ..."

It is not supposed to be shared, it would not be Private in that case.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 11:34:25 AM
Re: VPN for Additional Security
Ideally your correct and you would never see that for more than 2 parties in the business context. But there are some offerings of VPN from a personal perspective at lower cost that anonymizes the users but shares the pipe among smaller groups of other anonymized users.
emjones_uow
emjones_uow,
 User Rank: Apprentice
9/1/2016 | 6:23:25 AM
Re: VPN for Additional Security
The ones i mentioned, keeps no log and there are many who does'nt either. I know there are VPNs working in grey areas but not to forget the core purpose of having a VPN. Organizations have it, to secure their network, obviously there are other factors aswell but sparing a small amount for an additional security is the least a simple internet user can do. Makes it difficult to hack ones IP as VPN ensures anonymity. 
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:04:05 AM
Re: VPN for Additional Security
" ... good VPN service ..."\ I do not know how VPN service would help in this scenario, if you see windows update you would update, and VPN would not help.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/31/2016 | 2:19:24 PM
Re: VPN for Additional Security
In addition or as an alternative, one could work with a virtual sandbox (like sandbox.ie).  One InfoSec guy I know swears by them for protecting against ransomware specifically, among other threats.
lorraine89
lorraine89,
 User Rank: Ninja
9/1/2016 | 6:12:59 AM
Re: VPN for Additional Security
How has your experience been with Purevpn? I have read good reviews about their connectivity.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 10:11:04 AM
More of a pain
Great, now Windows Update has become even more of a pain. For the home user, to avoid this issue you could set your settings to apply updates automatically. This would remove user interaction and mitigate the risk of activating the ransomware.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:00:59 AM
Re: More of a pain
“… Windows Update …” Maybe best option is to keep as automated update.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:17:00 AM
Re: More of a pain
"... This would remove user interaction and mitigate the risk of activating the ransomware. ..." I think you are onto something, it is all about user behavior.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 10:55:48 AM
Ransomware
 

Ransomware became a revenue source for some companies apparently. Instead of inverting and inventing new products they are using technology against people, by using AES encryption and encrypting people's files and asking for money.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/31/2016 | 2:22:08 PM
Re: Ransomware
Ransomware sort of became this logical next step once the spamming business for black-market pharmaceuticals went under.  Black hatters needed to find a different way to leverage their botnets, their resources, their skillz.

In our attempt to kill a fly, we let in a hornet.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:11:57 AM
Fantom
 

"... There is no means of decrypting Fantom ..."

I would just say just not yet. AES is possible to creak, the problem is not enough time to do it with the current conventional computer. 
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 11:36:45 AM
Re: Fantom
Agreed, and by that time you have probably hit the window for which the provider would have allowed you to decrypt your files.
vladsl19
vladsl19,
 User Rank: Apprentice
8/31/2016 | 1:57:40 PM
Windows 10 affected?
Windows 10 affected? Anyone knows?

Thanks.
jcavery
jcavery,
 User Rank: Moderator
8/31/2016 | 7:50:28 PM
Re: Windows 10 affected?
Ahyup,   XP through 10
Whoopty
Whoopty,
 User Rank: Ninja
9/1/2016 | 8:11:19 AM
Re: Windows 10 affected?
Ransomware still creeps me out the most but at least I have a tonne of backups. But I'd rather be aware and scared, I can't imagine the shock of having all of your most personal files and folders encrypted out of the blue with no warning. 
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
9/1/2016 | 1:12:05 PM
Re: Windows 10 affected?
Ultimately, the best advice: Just be extra careful with what you click on, use adblockers, and disable Flash and Java unless you REALLY REALLY REALLY trust the site.  And never click an attachment or link in an email unless you're expecting it and know what it is (and you trust the sender).


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...