Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/30/2012
03:44 PM
50%
50%

Ransomware, Social Scams Lead 2013 SMB Security Fears

Expect the bad guys to spend more time pursuing small and midsize business (SMB) targets on mobile, cloud, and social platforms, Symantec says.

Windows 8: 8 Big Benefits For SMBs
Windows 8: 8 Big Benefits For SMBs
(click image for larger view and for slideshow)
The greater the changes in security threats, the more determined businesses should be to stick with best practices to defend themselves.

That's the general takeaway from the security researchers at Symantec, who believe attackers will find new and better ways to reap profits from mobile, cloud, and social usage in 2013. But although threats such as more "professional" ransomware might evolve, the advice on how to combat them should sound familiar. The right mix of security technologies, backup and recovery processes, and employee awareness will help keep the risks, new and old, in check for small and midsize businesses (SMBs).

"I don't think any of those steps are new," said Kevin Haley, director of Symantec Security Response, in an interview. Still, it's a good time of year for an update on what SMBs should be watching for.

With ransomware, Haley predicts criminals will become more sophisticated in their attack methods, more vicious and emotional in their threats, and greedier in their demands. Whereas the fake antivirus scareware of the past might try to fool users into giving up credit card numbers or other information, its ransomware descendants are more likely to openly threaten the user to extort payment. "We're going to see that kind of harder attitude [of] 'I don't care if I fool you or not, I'm holding you hostage and you're going to pay up,'" Haley said.

[ Read Fake Antivirus Ringleader Must Pay $163 Million. ]

Threats of this nature aren't new, but they're expected to grow fiercer. One key reason: It's easier than ever for the criminal to collect the extorted funds, by using prepaid cards or electronic money services such as MoneyPak in the U.S. or Ukash in Europe. Credit cards are too easy for victims to cancel, and other tools such as premium text messaging proved to be inefficient collection methods for attackers, according to Haley. Prepaid cards and online payments, on the other hand, provide "an easy way for [criminals] to get the money and prosper, unfortunately, and to come up with creative ways to rip us off," Haley said.

Haley thinks ransomware will appear increasingly polished on affected users' PCs -- which will make it more difficult for the typical employee to identify it as a scam. The threats themselves will also progress. The classic ransomware pitch is to impersonate a law enforcement agency and claim the user has illegal material on his machine, and order him to pay a fine or face imprisonment. A newer instance, according to Haley, involved the attacker pretending to be with the hacktivist group Anonymous group and threatening online ruin unless the users paid up. For SMBs, such attacks might also take the form of taking control of databases or applications and demanding payment for their release.

"[Ransomware attacks] are going to do things to keep people scared [and] off-balance, so that they don't think clearly and are willing to pay that ransom to get it off that machine," Haley said. His advice if you're affected: Don't pay. "They're not really going to unlock your system," Haley said. "Once they've got your money, why do they care?" A company might still face a productivity problem while IT fixes affected systems, but calling the extortionist's bluffs at least prevents an added financial loss.

Symantec also predicts a new wave of malware and social engineering delivered via social networks. As sites such as Facebook and Twitter continue their hunt for revenue streams, attackers will follow the money. Expect employees who use applications such as Facebook Gifts, for example, to be hit with a rising number of scams that attempt to lift personal data, payment information or corporate credentials. Such attacks might also simply be designed to deliver malware to the user's machine and network, with similar bottom-line goals.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.