Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/30/2012
03:44 PM
50%
50%

Ransomware, Social Scams Lead 2013 SMB Security Fears

Expect the bad guys to spend more time pursuing small and midsize business (SMB) targets on mobile, cloud, and social platforms, Symantec says.

Windows 8: 8 Big Benefits For SMBs
Windows 8: 8 Big Benefits For SMBs
(click image for larger view and for slideshow)
The greater the changes in security threats, the more determined businesses should be to stick with best practices to defend themselves.

That's the general takeaway from the security researchers at Symantec, who believe attackers will find new and better ways to reap profits from mobile, cloud, and social usage in 2013. But although threats such as more "professional" ransomware might evolve, the advice on how to combat them should sound familiar. The right mix of security technologies, backup and recovery processes, and employee awareness will help keep the risks, new and old, in check for small and midsize businesses (SMBs).

"I don't think any of those steps are new," said Kevin Haley, director of Symantec Security Response, in an interview. Still, it's a good time of year for an update on what SMBs should be watching for.

With ransomware, Haley predicts criminals will become more sophisticated in their attack methods, more vicious and emotional in their threats, and greedier in their demands. Whereas the fake antivirus scareware of the past might try to fool users into giving up credit card numbers or other information, its ransomware descendants are more likely to openly threaten the user to extort payment. "We're going to see that kind of harder attitude [of] 'I don't care if I fool you or not, I'm holding you hostage and you're going to pay up,'" Haley said.

[ Read Fake Antivirus Ringleader Must Pay $163 Million. ]

Threats of this nature aren't new, but they're expected to grow fiercer. One key reason: It's easier than ever for the criminal to collect the extorted funds, by using prepaid cards or electronic money services such as MoneyPak in the U.S. or Ukash in Europe. Credit cards are too easy for victims to cancel, and other tools such as premium text messaging proved to be inefficient collection methods for attackers, according to Haley. Prepaid cards and online payments, on the other hand, provide "an easy way for [criminals] to get the money and prosper, unfortunately, and to come up with creative ways to rip us off," Haley said.

Haley thinks ransomware will appear increasingly polished on affected users' PCs -- which will make it more difficult for the typical employee to identify it as a scam. The threats themselves will also progress. The classic ransomware pitch is to impersonate a law enforcement agency and claim the user has illegal material on his machine, and order him to pay a fine or face imprisonment. A newer instance, according to Haley, involved the attacker pretending to be with the hacktivist group Anonymous group and threatening online ruin unless the users paid up. For SMBs, such attacks might also take the form of taking control of databases or applications and demanding payment for their release.

"[Ransomware attacks] are going to do things to keep people scared [and] off-balance, so that they don't think clearly and are willing to pay that ransom to get it off that machine," Haley said. His advice if you're affected: Don't pay. "They're not really going to unlock your system," Haley said. "Once they've got your money, why do they care?" A company might still face a productivity problem while IT fixes affected systems, but calling the extortionist's bluffs at least prevents an added financial loss.

Symantec also predicts a new wave of malware and social engineering delivered via social networks. As sites such as Facebook and Twitter continue their hunt for revenue streams, attackers will follow the money. Expect employees who use applications such as Facebook Gifts, for example, to be hit with a rising number of scams that attempt to lift personal data, payment information or corporate credentials. Such attacks might also simply be designed to deliver malware to the user's machine and network, with similar bottom-line goals.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...