Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
New 'Fantom' Ransomware Poses As Windows Update
Threaded  |  Newest First  |  Oldest First
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/30/2016 | 9:46:05 PM
SMH
The very fact that we do not have the VAST majority of IT managers at mid-size and large-size businesses mandating regular backups is a serious problem.  Ransomware just makes the ineptitude of most IT departments more obvious.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 9:54:22 AM
Re: SMH
Very much agree with you. From a data management perspective, backing up the data is a pretty simplistic process and I would say in most cases when not performed is representative of negligence.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:06:20 AM
Re: SMH
"... backing up the data is a pretty simplistic process ..."

I agree. Especially with the cloud backup it is just connecting and letting it go.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 11:45:53 AM
Re: SMH
Yes, definitely but there are other considerations to make in the corporate context such as where is that data stored? What protections secure that data? Who has ownership? Due to this many institutions incorporate an onsite backup methodology.
jcavery
jcavery,
 User Rank: Moderator
8/31/2016 | 1:46:50 PM
Re: SMH
I think any backup process is simple enough for anyone who frequents this site, DarkReading, however think about parents, grandparents, people who have no idea how backups work or how to set one up. Any enterprise that falls victim to this should be ashamed, but its tougher to pin blame on the older folks in their own private homes, those are the ones we need to help watch out for and protect too. How? I'm not sure yet.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/31/2016 | 2:25:29 PM
Re: SMH
@jcavery: It's kind of dumb if you think about it.  Floppy drives used to come standard on computers (both desktops and laptops).  Local backup was a breeze.  Now floppy drives are considered obsolete because we have thumb drives.  Except thumb drives are still pretty expensive -- unless you get free ones at conferences...which may be infected with malware.

Meanwhile, I've got an old ZIP Drive and ZIP Disks kicking around somewhere and I can't get to what's backed up on those from years ago because nobody makes machines with those printer ports anymore.

Now I'm cranky and wistful for the good old days.  Get off my lawn.
jcavery
jcavery,
 User Rank: Moderator
8/31/2016 | 7:28:25 PM
Re: SMH
If you have ever gotten behind the wrong person in line at a grocery store with the chipped debit cards, you can understand why that person might also have trouble configuring a reliable backup system on their PC. Back in my day the only chips in a grocery store were right next to the salsa!

That ball that flew over my fence? I'm keeping it. It's mine now.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
9/1/2016 | 1:08:18 PM
Re: SMH
Oh, yes, I definitely understand it (heck, even I have issues with the chip scanners sometimes -- especially because of the inconsistency among retailers).  It just used to be much easier and more straightforward.  (But, of course, fewer people had personal computers back then.)

Now stop skateboarding on the sidewalk!
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 10:58:18 AM
Re: SMH
" ...regular backups ..."

I agree. Business is one thing, home users something else, mostly they do not have a backup so they have to pay for their photos.
emjones_uow
emjones_uow,
 User Rank: Apprentice
8/31/2016 | 2:36:40 AM
VPN for Additional Security
I would urge users to get additional security layers. There are plenty of good VPN service providers out there in the market who are promising 256 bit encryption, strict no log policy, agree or not, VPN has indeed become a need of the time, considering the amount of threats faced by internet users. I would suggest users to spare $5 per month and buy Purevpn, Express, Vypr etc though there are other vpn service providers as well and you are encouraged to do a comparison by yourself.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 9:56:40 AM
Re: VPN for Additional Security
Yes, but as you said make sure there is a no log policy and that other users are not sharing your pipe. People need to remember that a VPN is a tunnel for all who share that pipe and you are at the mercy of other users that may not have such a secure configuration.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:10:35 AM
Re: VPN for Additional Security
" ...  VPN is a tunnel for all who share that pipe ..."

It is not supposed to be shared, it would not be Private in that case.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:10:42 AM
Re: VPN for Additional Security
" ...  VPN is a tunnel for all who share that pipe ..."

It is not supposed to be shared, it would not be Private in that case.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 11:34:25 AM
Re: VPN for Additional Security
Ideally your correct and you would never see that for more than 2 parties in the business context. But there are some offerings of VPN from a personal perspective at lower cost that anonymizes the users but shares the pipe among smaller groups of other anonymized users.
emjones_uow
emjones_uow,
 User Rank: Apprentice
9/1/2016 | 6:23:25 AM
Re: VPN for Additional Security
The ones i mentioned, keeps no log and there are many who does'nt either. I know there are VPNs working in grey areas but not to forget the core purpose of having a VPN. Organizations have it, to secure their network, obviously there are other factors aswell but sparing a small amount for an additional security is the least a simple internet user can do. Makes it difficult to hack ones IP as VPN ensures anonymity. 
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:04:05 AM
Re: VPN for Additional Security
" ... good VPN service ..."\ I do not know how VPN service would help in this scenario, if you see windows update you would update, and VPN would not help.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/31/2016 | 2:19:24 PM
Re: VPN for Additional Security
In addition or as an alternative, one could work with a virtual sandbox (like sandbox.ie).  One InfoSec guy I know swears by them for protecting against ransomware specifically, among other threats.
lorraine89
lorraine89,
 User Rank: Ninja
9/1/2016 | 6:12:59 AM
Re: VPN for Additional Security
How has your experience been with Purevpn? I have read good reviews about their connectivity.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 10:11:04 AM
More of a pain
Great, now Windows Update has become even more of a pain. For the home user, to avoid this issue you could set your settings to apply updates automatically. This would remove user interaction and mitigate the risk of activating the ransomware.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:00:59 AM
Re: More of a pain
“… Windows Update …” Maybe best option is to keep as automated update.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:17:00 AM
Re: More of a pain
"... This would remove user interaction and mitigate the risk of activating the ransomware. ..." I think you are onto something, it is all about user behavior.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 10:55:48 AM
Ransomware
 

Ransomware became a revenue source for some companies apparently. Instead of inverting and inventing new products they are using technology against people, by using AES encryption and encrypting people's files and asking for money.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
8/31/2016 | 2:22:08 PM
Re: Ransomware
Ransomware sort of became this logical next step once the spamming business for black-market pharmaceuticals went under.  Black hatters needed to find a different way to leverage their botnets, their resources, their skillz.

In our attempt to kill a fly, we let in a hornet.
Dr.T
Dr.T,
 User Rank: Ninja
8/31/2016 | 11:11:57 AM
Fantom
 

"... There is no means of decrypting Fantom ..."

I would just say just not yet. AES is possible to creak, the problem is not enough time to do it with the current conventional computer. 
RyanSepe
RyanSepe,
 User Rank: Ninja
8/31/2016 | 11:36:45 AM
Re: Fantom
Agreed, and by that time you have probably hit the window for which the provider would have allowed you to decrypt your files.
vladsl19
vladsl19,
 User Rank: Apprentice
8/31/2016 | 1:57:40 PM
Windows 10 affected?
Windows 10 affected? Anyone knows?

Thanks.
jcavery
jcavery,
 User Rank: Moderator
8/31/2016 | 7:50:28 PM
Re: Windows 10 affected?
Ahyup,   XP through 10
Whoopty
Whoopty,
 User Rank: Ninja
9/1/2016 | 8:11:19 AM
Re: Windows 10 affected?
Ransomware still creeps me out the most but at least I have a tonne of backups. But I'd rather be aware and scared, I can't imagine the shock of having all of your most personal files and folders encrypted out of the blue with no warning. 
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
9/1/2016 | 1:12:05 PM
Re: Windows 10 affected?
Ultimately, the best advice: Just be extra careful with what you click on, use adblockers, and disable Flash and Java unless you REALLY REALLY REALLY trust the site.  And never click an attachment or link in an email unless you're expecting it and know what it is (and you trust the sender).


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file