Avoiding Malware

Avoiding Many Types of Malware

From the desk of Thomas F. Duffy, MS-ISAC Chair

Every day as we use our devices, browse the Internet, and open emails, we are also exposing those devices to potential malware (malicious software). Malware is any software that is designed to cause damage to and/or unauthorized access to devices or networks. Malware comes in many forms, all of which can have negative effects on your device and for you. With a little extra vigilance, and some good habits and practices, you can greatly reduce your likelihood of having a device infected with malware and can minimize the impact to your device, data, and life, in the event that it does become infected. Below we will explore a few common types of malware and their impacts, as well as some tips and practices that can help you as you go about your connected life.

Common Types of Malware and Their Effects

Ransomware – Ransomware is malware that stops you from being able to access your files, usually by encrypting them, and then requests payment to decrypt the files, restoring your access. Most commonly, ransomware asks for payment in bitcoin, which is a popular cryptocurrency. Unfortunately, paying the ransom does not guarantee restoring access to your files.

Trojan Horses (a.k.a. trojans) – This malware takes its name from the classic story of the Greek army sneaking soldiers into the city of Troy hidden inside a large wooden horse. Trojans of the malware variety behave in much the same way, by appearing to be legitimate apps or software that you want to install. Some trojans allow an attacker full access to your device, others steal banking and personally sensitive information, and others are simply used to download additional malware, like ransomware.

Keyloggers – This type of malware records your keystrokes and sends them to a cyber threat actor, giving them access to your usernames, passwords, and any other sensitive information you have entered using your keyboard. With this information, the cyber threat actor can access your online accounts or commit identity theft.

Tips and Practices for Avoiding and Surviving a Malware Infection

• Update and patch your devices and software. Vendors release updates and patches in order to fix security issues, not just to fix functionality! Many types of malware can be foiled by keeping your software up-to-date by accepting the updates when you get a notice about them.
• Never click suspicious or untrusted links. Even if the URL comes from a company or person you know, it is always safest to manually type in their URL. At the least, hover over the link to discover where it’s really sending you, as some malicious actors send emails that look convincing. This advice is also true for links in emails, documents, and on social media platforms, as malicious links are commonly posted to such sites. For more information on spotting suspicious emails and checking URLs, head to our past newsletter on this topic.
• Only download from trusted sources. When looking to download an app or software, only do so from a trusted vendor or source. On mobile devices, ensure that you only download apps from the Google Play store and Apple App Store, which are the trusted sources for Android and iOS devices.
• Backup your data and be sure the backups are good! Backing up your data, whether by doing a complete backup of your whole device or just key files, is the best way to protect those important files and pictures against ransomware and other data loss. For best practices and more information on backups, please reference our recent newsletter on this topic.
• Use antivirus and other protective software on your device. If your computer or router has built-in protections like antivirus or a firewall, ensure you have those enabled. Otherwise, buy or download an antivirus product from a trusted vendor. This is important for both your computers and your smartphones!
• Configure your devices with some security in mind. By setting up your devices with some basic security settings enabled, you will not only protect against some malware, but against other forms of malicious activity and access. For tips on configuring your devices, please see our past newsletter on this topic.

Adobe Flash Player Update Scam

There is a deceptive "Adobe Flash Player Update" pop-up designed to install adware on your computer without your permission. The download allows nuisance online advertisements to appear and collect information.

If you use Google Chrome, the Adobe Flash Player automatically updates and you will never need to do an install. When in doubt about a pop-up requesting to install an update on any website, close the window and navigate directly to the official company website to complete the task or call our help desk for assistance.

How to Spot Phishing Messages

The Federal Trade Commission’s definition of phishing is “when a scammer uses fraudulent emails or texts, or copycat websites, to get you to share valuable personal information.” When a user falls for a phishing message, the malicious actor achieves their purpose of getting the victim to hand over sensitive information such as login names and passwords. Though we count on technologies and controls to minimize threats, phishing exploits users through social engineering, which allows the malicious actors to side step these protections. This is why it is important that everyone learn to spot these fraudulent messages.

Let’s take a look at some example emails of phishing messages:

Message #1

Subject: Low Cost Dream Vacation loans!!!

Dear John,

     We understand that money can be tight and you may not be able to afford to go on vacation this year.   However, we have a solution. My company, World Bank and Trust is willing to offer low cost loans to get your through the vacation season. Interest rates are as low at 3% for 2 years. If you are interested in getting a loan, please fill out the attached contact form and send it back to us. We contact you within 2 days to arrange a deposit into your checking account.

Please email your completed form to VacationLoans@worldbankandtrust.com.

Your dream vacation is just a few clicks away!

Dr. Stephen Strange
World Bank and Trust
177a Bleecker Street, New York, NY10012

What did you notice in message #1? 

In this message, you can see that the phisher wants to give us a low cost loan with no credit check. They say we just need to send them our information and they will give us money, right? Not only does it seem too good to be true, but also when you hover the cursor over the email address to examine it further, you see that the link actually has a different destination. It is the email address of the attacker. Lastly, as much as you might like Dr. Strange, he’s probably not working for a bank part-time.

Message #2

Subject: Free Amazon Gift Card!!!

Dear Sally,

     You name has been randomly selected to win a $1000 Amazon gift card. In order to collect you prize, you need to log in with your Amazon account at the link below and update your contact information so we can put your prize in the mail. This is a limited time offer, so please respond to the request within 2 business days.  Failure to respond will forfeit your prize and we will select another winner.

www.amozan.com/giftredemption2321

What did you notice in message #2? 

Aside from this seeming too good to be true, you can see that “Amazon” is misspelled as “Amozan” on the link provided. If you read this quickly, you may think you are responding to the real company to get your gift certificate. In reality, you are providing your information to the attacker. For the purposes of this example, the link actually navigates to our district website, which is a trustworthy site.

Message #3

Subject: Urgent – Take Action Before Your Email Account is Deactivated

Dear User,

                  Following changes to our Microsoft email systems, each user must authenticate their account to prevent it from being deactivated. You can accomplish this by heading to the link below and entering your Microsoft Outlook email account credentials, and then we will know your account is active and should remain so.

http://www.microsoft.com/

Thank you,
Information Technology
Helpdesk Support Team

What did you notice in message #3?

This email is fairly well crafted without errors. Note that it establishes a sense of urgency that the malicious actor hopes will cloud your judgement and threatens the deactivation of your email account. Additionally the link at the bottom looks like a link to Microsoft, yet it is in fact heading somewhere else! Luckily, for the purposes of this example, that link simply leads to our district website, which is a legitimate site.

With these three examples considered, here are some basic recommendations to help protect you from becoming a phishing victim:

If it seems too good to be true, it probably is;
Hover your cursor over links in messages to find where the link is actually going;
Look for misspellings and poor grammar, which can be good signs a message is a fraud;
And, never respond to an email requesting sensitive personal information (birthday, Social Security Number, username/password, etc.).

Message #4

From: Romero Christine <CRomero10@schools.nyc.gov>
Date: Sat, Jun 30, 2018 at 2:14 PM
Subject: Attn
To:

Your Mail Box Exceeded it storage limit *CLICK HERE TO UNBLOCK
<https://docs.google.com/forms/d/e/1FAIpQLSdbtFbDOA_C0LLZVP9H_jIpaO8TAOIqmJYRa-pY9Tq1kmwGfg/viewform?c=0&w=1&gt;*

Fill and click SUBMIT for more space or you wont be able to send Mail.

What did you notice in message #4?

Notice that the email address is neither a Google address or our district address. Sometimes to identify the sender's address you will need to hover over the username, just like the false links in previous examples. 

This example also contains minor grammatical errors and refers you to a link that requests information. In this case the link directs you to our district website to keep you safe.

What to do if you interact with a phishing email?

If you do happen to respond to a phishing email, please contact our help desk to change your password.

Adapted from Thomas F. Duffy, MS-ISAC Chair: https://www.cisecurity.org/newsletter/how-to-spot-phishing-messages-like-a-pro/

Additional information and a phishing game can be found on the FTC’s website, https://www.ftc.gov/.

January 1 - April 15 is Phishing Season

While phishing attacks can occur at any time, there is an increase in attacks between January 1 and April 15. As a reminder, phishing is a tactic designed to steal personal data (think passwords, credit card numbers, banking information, etc) and/or install malware on your computer. Phishing attacks come in many forms. Emails that impersonate popular companies and services (banks, dropbox, Google, etc) are most common. Spear-phishing occurs when attackers send emails that appear to come from your trusted contacts, such as, coworkers, friends, etc. Attacks may also make phone calls impersonating others and use other methods to obtain your personal information.

Check out the following tips to avoid falling victim to phishing scams:

Be Skeptical

If something seems suspicious, use caution. Typos, too many exclamation points, and other grammatical flags can be used to question the legitimacy of emails. 

Check the sender's address. Don't trust the display name alone: hover over the display to see the full email address. Does it match other communications from the organization?

You can also hover your mouse over any links embedded in the body of the email. If the link address looks weird, don’t click on it. If you want to test the link, open a new window and type in website address directly rather than clicking on the link from unsolicited emails. 

Is the email addressed "Dear Customer" or with another generic salutation? If so, be cautious —legitimate business emails will often personalize their greetings with your name.

Legitimate banks and companies will never ask for personal credentials via email or phone. Don’t give them up.

Invoking a sense of urgency or fear is a common phishing tactic. Beware of subject lines that claim your “account has been suspended” or your account had an “unauthorized login attempt.” Urgent language is designed to make you act before thinking.

Lack of details about the signer or how you can contact a company strongly suggests a phish. Most companies have an official signature.

Including malicious attachments that contain viruses and malware is a common phishing tactic. Malware can damage files on your computer, steal your passwords or spy on you without your knowledge. Don’t open any email attachments you weren’t expecting.

Phishers are extremely good at what they do. Just because an email has convincing brand logos, language, and a seemingly valid email address, does not mean that it’s legitimate. Be skeptical when it comes to your email messages—if it looks even remotely suspicious, don’t open it.

Resource: https://blog.returnpath.com/10-tips-on-how-to-identify-a-phishing-or-spoofing-email-v2/

Choose Strong Passwords and Keep them Secure

One of the best ways to protect against phishing attacks is to use secure password management strategies. Passwords should be unique for each of your logins, with master passwords like your district synced credentials, being the strongest and most secure. While tempting to select passwords based on personal information is tempting, these passwords are often also the least secure and easy for others to guess. Examples: favorite sports team, family names, pet names, etc. The most secure passwords contain a random string of words. Passwords are also only as secure as how you store them. If you must write them down to remember them, make sure they are stored in a secure location--not on your monitor, under keyboard, etc. 

Password Resources:

• Take the password quiz Carnegie Mellon University designed to assess your perceptions of secure passwords. 
• Last Pass is a password manager that allows you to set one secure password to manage randomly generated passwords for the websites you visit.
• Password Alert gives you a warning when it detects you reusing passwords across sites.
• How Secure is My Password estimates how long it would take for someone to hack your password.

Use 2-Factor Authentication

To keep your district accounts secure, I highly recommend enabling 2-Step Verification to protect your account credentials. Since we sync your passwords across multiple websites and applications, it is critical that we all do our part to protect our accounts. This extra step does not take much additional time and keeps bad guys out even if they are able to obtain your password. Information about how it works and a link to step by step directions follow. 

• Here's how it works:

• Step by Step Directions for Enabling 2-Step Verification

Thwart Phishing Attacks with Password Alert

In the spirit of Keeping Safe Online month, I'd like to recommend the Google extension Password Alert to help thwart phishing attacks.

Phishing attacks generally come in the form of email or social media posts that appear to come from legitimate contacts and companies and request recipients to share personal information such as passwords and credit card numbers.

I attended a few conference sessions on cyber-security last week and learned that email passwords are worth far more than credit card numbers on the dark web as they provide scammers with access to your contacts. This allows scammers to use your account to phish your friends, family, coworkers, etc.

Password Alert works by providing warnings when you enter your Google password on any site that isn't a Google sign-in portal. While the main intent is to assist in defending against phishing scams, the extension also alerts you when you have reused your Google password to setup other accounts. While you are able to click "Ignore this time" to continue logging into these sites, it does subtly encourage the best practice of having unique passwords.

Two-step account verification remains the best method for protecting any of your accounts including Google because it requires scammers to have access beyond your password. Still, Password Alert is a great secondary tool for catching scammers before they obtain your account credentials.