December 8, 2015

Malware And The Opportunistic Holiday Season Bonanza

By Jennifer Klostermann

‘Tis The Season To Be Careful

Malware Vulnerabilities

Earlier this year, Menlo Security published a report suggesting that one-third of the top million global websites were vulnerable to malware, and one in five sites were running software with known vulnerabilities. 5% of the sites measured were identified as serving spam or malware or were part of a botnet. With a billion websites already running, and an additional 100,000 coming online daily, 2014 saw over $70 billion spent on cyber security tools. Malware, however, continues to be a dominant threat.

Black Friday

Shoppers are being warned of a new Malware threat, ModPOS, discovered by ISight Partners, enabling point-of-sale malware code to collect credit card details as customers scan their cards.

And with news of the data breach at Hilton Worldwide spreading, analysts are expecting an increase in POS attacks against retailers, just as Black Friday launched the shopping season. Mark Bower, global product management director for HPE Security, says, “Point of sale systems – what consumers often call the checkout system – are often the weak link in the chain. A checkout terminal in constant use is usually less frequently patched and updated, and is thus vulnerable to all manner of malware compromising the system to gain access to cardholder data.” With this holiday shopping season being the first after the EMV liability shift has taken effect, merchant or card issuers who haven’t implemented EMV Chip-and-PIN technology will be held accountable.

Cyber Threat Monday

In Singapore, mobile banking clients have been warned of malware risks on Android phones that attempt to hijack online passwords and one-time security codes. It appears that these malware injections pose as Android software updates or service updates for messaging app WhatsApp. The fake Android update is spread through direct link downloads and exhibits clicker behavior, constantly visiting hard coded URLs without user consent. More dangerous, this malware collects device information such as email accounts, phone numbers, and similarly sensitive information, and after requesting super user access becomes incredibly difficult to remove. The ‘WhatsApp’ Instance of the malware appears as a pop-up insisting users download the new version or risk losing access to the service. Once users install the software, sensitive information is scammed from users. Mobile users are being warned not to click on strange links or accept unknown downloads, and an antivirus app is as necessary for mobile phones as laptops, desktops, and tablets.

Conficker

Yet another threat to beware of, Conficker was the most commonly used malware to attack organizations in October, accounting for 20% of all global attacks. This worm, first appearing in 2008, is able to spread across networks and brute force passwords, and its return has seen dangerous infections such as that of police body cameras. Security vendor Check Point reveals that three malware families, Conficker, Sality, and Cutwail, accounted for 40% of all recorded attacks, showing a trend toward gaining control of PCs and turning them into DDoS and spamming botnets. Neutrino Exploit Kit, associated with ransomware scams, is the fourth most common malware detected in October globally and attacks computers using Java.

As ransomware and data-stealing malware attacks rise, consumers and holiday makers would be wise to beware of threats both physical and online; Icy roads and crazed shoppers aren’t the only challenges we face this festive season.

By Jennifer Klostermann

Jennifer Klostermann

Jennifer Klostermann is an experienced writer with a Bachelor of Arts degree majoring in writing and performance arts. She has studied further in both the design and mechanical engineering fields, and worked in a variety of areas including market research, business and IT management, and engineering. An avid technophile, Jen is intrigued by all the latest innovations and trending advances, and is happiest immersed in technology.
Lon Clark

Fueling MSP Growth: The Power of Distributor Collaboration

Fueling MSP Growth Call it a cutting-edge paradox: As the demand across industries for MSPs [...]
Read more
Dolores

Q&A: Airport Security Trends with Dolores Alemán, Frost & Sullivan Analyst

Airport Security Trends In this CloudTweaks interview, we delve into the evolving landscape of airport [...]
Read more
Steve Prentice

Episode 19: Why AWS Needs to Become Opinionated about FinOps

On today’s episode of the CloudTweaks podcast, Steve Prentice chats with Rahul Subramaniam, CEO at CloudFix [...]
Read more
Rahul Subramanyam

Episode 18: Fixing AWS: The CloudFix Story 

Fixing AWS: The CloudFix Story A conversation with Rahul Subramanyam. CEO at CloudFix, and CTO [...]
Read more

A.I. is Not All It’s Cracked Up to Be…At Least Not Yet!

Exploring AI’s Potential: The Gap Between Aspiration and Reality Recently Samsung releases its new Galaxy [...]
Read more
Gary Bernstein

The AI Vanguard: MixMode’s 2024 Insight into Cybersecurity’s New Era

Insight into Cybersecurity’s New Era As we enter into 2024, the adoption of AI in [...]
Read more

SPONSOR PARTNER

Explore top-tier education with exclusive savings on online courses from MIT, Oxford, and Harvard through our e-learning sponsor. Elevate your career with world-class knowledge. Start now!
© 2024 CloudTweaks. All rights reserved.