SECUREU

SECUREU Solutions cybersecurity company logo
Menu

Author name: wcsec54

Your Smartphone Might Have Been Compromised?

Cyber Threats & Personal Safety /

Your Smartphone Might Have Been Compromised? Smartphones have crept their way into every aspect of our lives. No matter what you need, there is most likely an app available for it. And yet, in spite of our excessive use of smartphones, most of us are unaware of the exact extent of the threats we may face while using these devices. Mobile security threats are growing daily and now account for more than 60% of digital fraud ranging from stolen passwords to phishing attacks. Security is even more essential since we now use our phones to conduct online transactions and banking. Your Smartphone Might Have Been Compromised Fortunately, mobile phones can still be used safely by keeping yourself informed and taking the necessary precautions. Let us take a look at some threats that smartphone users may face. Unsecured WiFi When wireless hot spots are available nearly everywhere, why would anyone want to use up their cellular data? However, it should be noted that free WiFi networks are generally not secured. When you connect to public WiFi networks that do not require passwords or use encryption, you can allow anyone near you to spy on your online activity. Cybercriminals can create fake WiFi hotspots to trick users into connecting to them and can then steal the user’s data. For instance, these phony networks can direct you to a webpage that looks exactly like your bank’s website and then steal your password when you attempt to log in. Public WiFi networks are not as secure as private ones as there is no way of knowing who set up the network or how it is secured if it is secured at all. There is also no way of knowing who is accessing or monitoring the network. It is best to not connect to just any network that you find. If it is absolutely necessary, ensure that you do not perform any activity (like entering passwords or banking) that may compromise you. Data Leakage Often, mobile apps are the reason behind the unintentional leakage of data. “Riskware” apps pose a real threat to mobile users as they grant them varied permissions without checking the security. Generally, these are the free apps that are found in official app stores. They usually perform as advertised, but also send personal — and even possibly corporate — data to remote servers where it is used by advertisers. If these remote servers are compromised, or if a technical error leaves them prone to attack, the collected data can be used by cybercriminals for fraud. Hostile enterprise-signed mobile apps can also lead to data leakage. Such mobile malware programs use distribution code native to famous mobile OSs like Android to transport valuable data across networks without raising suspicion. To avoid data leakage, one should only give permissions that are absolutely essential for the app to perform its functions. Adjust the security controls on your mobile so that apps only collect limited data and do not install any apps that ask for more permissions than required. A common worry of many mobile users is malware sending data to cybercriminals. However, more than malware that users should be worried about but spyware instead. Often spyware can be installed by spouses, employers, or coworkers to keep track of the victim’s activities and whereabouts. Spyware is also known as stalkerware and these apps are created to be loaded on the victim’s device without their permission or knowledge to survey or collect data. Spyware is most commonly installed on mobile phones when the user clicks on malicious advertisements or through scams that trick users into unintentionally downloading it. Spyware is designed to allow very invasive digital monitoring through smartphones and one should be wary of apps that promise to surveil the activities of your children or loved ones through their mobile devices. These apps can be used by abusers to secretly listen to conversations, take pictures, read texts and emails, and track the phone’s location amongst other things. Less insidious apps can still gather information about what you do on your phone. One should avoid mobile apps that ask for a lot of permissions or permissions that have anything to do with accessibility. Accessibility permissions give apps the power to read the text in other apps or control other apps. Phishing Cybercriminals will often use text messages, voice mails, as well as emails to trick their targets into revealing sensitive information like passwords, clicking on malicious links, or confirming transactions. This practice is called phishing, which happens to be the most successful and hence most often used method that cybercriminals use to attack their victims. As mobiles are always on, they are the most common targets for phishing attacks. As mobile users often check their email in real-time, they are more susceptible to being a target of phishing. Mobile device users are more vulnerable as email applications display less information to adjust to the smaller screen size. Even when opened, an email may only show the sender’s name unless the header information bar is expanded. This is why one should never click on unknown email links. And unless the matter is urgent, it is best to let the response wait until you can access a computer. To avoid becoming a victim of phishing, you should always confirm who is calling you for your personal information. For instance, if the caller claims to be calling from the bank, you can say that you will call back using the bank’s official number. One should also not respond to messages claiming you have won prize money or any other such scenario and delete those messages immediately as they are generally scams. Network Spoofing Hackers may set up fake access points, i.e. connections that look like WiFi networks but are bait, in public locations with high traffic like restaurants, libraries, etc. This is called network spoofing. Cybercriminals also give access points names that encourage users to connect to them such as “Coffeehouse WiFi” or “Free Airport WiFi”. Often, hackers will force users to

Your Smartphone Might Have Been Compromised? Read More »

Your Smartphone Might Have Been Compromised? Smartphones have crept their way into every aspect of our lives. No matter what you need, there is most likely an app available for it. And yet, in spite of our excessive use of smartphones, most of us are unaware of the exact extent of the threats we may face while using these devices. Mobile security threats are growing daily and now account for more than 60% of digital fraud ranging from stolen passwords to phishing attacks. Security is even more essential since we now use our phones to conduct online transactions and banking. Your Smartphone Might Have Been Compromised Fortunately, mobile phones can still be used safely by keeping yourself informed and taking the necessary precautions. Let us take a look at some threats that smartphone users may face. Unsecured WiFi When wireless hot spots are available nearly everywhere, why would anyone want to use up their cellular data? However, it should be noted that free WiFi networks are generally not secured. When you connect to public WiFi networks that do not require passwords or use encryption, you can allow anyone near you to spy on your online activity. Cybercriminals can create fake WiFi hotspots to trick users into connecting to them and can then steal the user’s data. For instance, these phony networks can direct you to a webpage that looks exactly like your bank’s website and then steal your password when you attempt to log in. Public WiFi networks are not as secure as private ones as there is no way of knowing who set up the network or how it is secured if it is secured at all. There is also no way of knowing who is accessing or monitoring the network. It is best to not connect to just any network that you find. If it is absolutely necessary, ensure that you do not perform any activity (like entering passwords or banking) that may compromise you. Data Leakage Often, mobile apps are the reason behind the unintentional leakage of data. “Riskware” apps pose a real threat to mobile users as they grant them varied permissions without checking the security. Generally, these are the free apps that are found in official app stores. They usually perform as advertised, but also send personal — and even possibly corporate — data to remote servers where it is used by advertisers. If these remote servers are compromised, or if a technical error leaves them prone to attack, the collected data can be used by cybercriminals for fraud. Hostile enterprise-signed mobile apps can also lead to data leakage. Such mobile malware programs use distribution code native to famous mobile OSs like Android to transport valuable data across networks without raising suspicion. To avoid data leakage, one should only give permissions that are absolutely essential for the app to perform its functions. Adjust the security controls on your mobile so that apps only collect limited data and do not install any apps that ask for more permissions than required. A common worry of many mobile users is malware sending data to cybercriminals. However, more than malware that users should be worried about but spyware instead. Often spyware can be installed by spouses, employers, or coworkers to keep track of the victim’s activities and whereabouts. Spyware is also known as stalkerware and these apps are created to be loaded on the victim’s device without their permission or knowledge to survey or collect data. Spyware is most commonly installed on mobile phones when the user clicks on malicious advertisements or through scams that trick users into unintentionally downloading it. Spyware is designed to allow very invasive digital monitoring through smartphones and one should be wary of apps that promise to surveil the activities of your children or loved ones through their mobile devices. These apps can be used by abusers to secretly listen to conversations, take pictures, read texts and emails, and track the phone’s location amongst other things. Less insidious apps can still gather information about what you do on your phone. One should avoid mobile apps that ask for a lot of permissions or permissions that have anything to do with accessibility. Accessibility permissions give apps the power to read the text in other apps or control other apps. Phishing Cybercriminals will often use text messages, voice mails, as well as emails to trick their targets into revealing sensitive information like passwords, clicking on malicious links, or confirming transactions. This practice is called phishing, which happens to be the most successful and hence most often used method that cybercriminals use to attack their victims. As mobiles are always on, they are the most common targets for phishing attacks. As mobile users often check their email in real-time, they are more susceptible to being a target of phishing. Mobile device users are more vulnerable as email applications display less information to adjust to the smaller screen size. Even when opened, an email may only show the sender’s name unless the header information bar is expanded. This is why one should never click on unknown email links. And unless the matter is urgent, it is best to let the response wait until you can access a computer. To avoid becoming a victim of phishing, you should always confirm who is calling you for your personal information. For instance, if the caller claims to be calling from the bank, you can say that you will call back using the bank’s official number. One should also not respond to messages claiming you have won prize money or any other such scenario and delete those messages immediately as they are generally scams. Network Spoofing Hackers may set up fake access points, i.e. connections that look like WiFi networks but are bait, in public locations with high traffic like restaurants, libraries, etc. This is called network spoofing. Cybercriminals also give access points names that encourage users to connect to them such as “Coffeehouse WiFi” or “Free Airport WiFi”. Often, hackers will force users to

A Worm Named Stuxnet

Cyber Threats & Personal Safety /

In December of 2012, a virus named Stuxnet crippled Iranian nuclear facilities. In development since at least 2005, this virus was discovered in 2010 and is a prime example of a virus whose threat extends far beyond the digital space. What is Stuxnet? Stuxnet is a very powerful computer worm that first appeared in 2010 and which also happens to be the biggest and most expensive of this type of malware. It is known to have exploited previously unknown Windows zero-day vulnerabilities to infect a target system and spread to other such systems. Stuxnet primarily attacked the centrifuges of Iran’s uranium enrichment facilities. Since then, it has been modified by cyber attackers, and this mutation has allowed it to spread to other energy-producing and industrial facilities. The original Stuxnet attack was aimed at programmable logic controllers (PLCs) that are used to automate machine processes. Although no country has officially owned up to creating Stuxnet, it is largely believed to have been created by the US and Israel in a joint effort. Stuxnet garnered a lot of media attention after its discovery, as it is the first virus known to cripple hardware and cause physical destruction of devices that have been infected with it. Iran’s nuclear programme was greatly crippled by Stuxnet, and owing to its aggressive nature, this virus accidentally spread beyond Iran’s nuclear facilities. However, it did not do much damage to external devices outside of the actual target locations. How Does Stuxnet Work? Stuxnet is a very complex and intrusive piece of malware. It has been designed to only affect targets that have certain configurations and cause minimal damage to other systems and devices. The targeted nuclear facilities in Iran were isolated and air-gapped from the global network, and so Stuxnet was probably transmitted through USB sticks that were carried into these facilities by agents. Stuxnet has code for a man-in-the-middle attack that can fake sensor signals and prevent a target system from shutting down due to unusual behaviour. Stuxnet is also abnormally large and written in multiple programming languages, and spreads fast. Three systemic layers are targeted by Stuxnet: Windows OS, Siemens PCS 7, WinCC, and STEP7 industrial software apps Siemens S7 PLC Windows systems were infiltrated by Stuxnet by exploiting several zero-day vulnerabilities like remote code execution. It utilised enabled printer sharing or LNK/PIF vulnerability executing the file when it was viewed in Windows Explorer. This malware can gain access at the user level as well as the kernel level. The device drivers in Stuxnet are signed by two public certificates, which enables it to access kernel drivers without the knowledge of the user. Because of this, Stuxnet could remain undiscovered for a long time. Once it has infiltrated Windows systems, Stuxnet proceeds to infect files that belong to Siemens industrial software applications and interrupts their communications. It modifies the code on PLC devices too. Stuxnet instals malware blocks in PLC monitors and repeatedly changes the frequency of the system. It alters the operation of motors by changing the rotational speed. Stuxnet also has a rootkit that helps the worm hide from monitoring systems. What Did Stuxnet Do? Stuxnet is reported to have destroyed several centrifuges in Iran’s Natanz uranium enrichment facility by making them burn out. Since then, Stuxnet has been modified by other malicious groups to make it capable of targeting facilities such as water treatment plants, gas lines, and power plants. Stuxnet is a multi-part worm that is believed to have travelled on USB drives and spread through systems running Windows. This virus scanned every infected computer for signs of Siemens Step 7 software. Siemens Step 7 software is used by industrial computers used as PLCs that automate and monitor electro-mechanical equipment. Once a PLC computer was found, Stuxnet updated its code over the Internet and started sending damaging instructions to the electro-mechanical equipment controlled by the affected system. Simultaneously, it also sent false feedback to the main controller so that anyone monitoring the equipment would not have any idea of an attack being underway until the equipment began to destroy itself. Stuxnet’s History Though it had been in development since 2005, Stuxnet was first identified and reported in 2010. The first known version of Stuxnet is Stuxnet 0.5 [McD13]. In January 2010, the inspectors who visited the Natanz uranium enrichment plant noted that its centrifuges were failing at an unusual rate. They were unable to detect the cause of this failure at the time. Another five months passed and researchers found malicious files in one of the systems. The worm started spreading around March 2010, but its first variant was found in 2009. On July 15, 2010, the worm became widely known because of a DDoS attack on an industrial systems security mailing list. This attack has interrupted a necessary source of information for power plants and factories. Stuxnet spread in two waves. The second wave was more visible and less targeted than the first. It was during the second wave that Stuxnet came to be known to the public, as it was more aggressive and widespread. This worm managed to infiltrate and infect more than 20,000 devices in 14 Iranian nuclear facilities and destroyed around 900 centrifuges. Although Stuxnet didn’t cause a lot of damage outside its target area, it provides an example for later malware that targets various infrastructures. Modified versions of Stuxnet target non-nuclear facilities as well. The Offsprings of Stuxnet Stuxnet had a massive influence on the development of future malware. While the creators of Stuxnet reportedly designed it to expire in June 2012, the legacy of Stuxnet survives in other malware based on the original code. The “offsprings” of Stuxnet are as follows: Duqu is a group of computer malware that also exploits zer0-day vulnerabilities in Windows. Based on the Stuxnet code, it was created to log keystrokes and collect data from industrial facilities, possibly to launch an attack later. It is very similar to Stuxnet and also targets Iranian nuclear entities. Like its predecessor Stuxnet, Flame also travelled via

A Worm Named Stuxnet Read More »

In December of 2012, a virus named Stuxnet crippled Iranian nuclear facilities. In development since at least 2005, this virus was discovered in 2010 and is a prime example of a virus whose threat extends far beyond the digital space. What is Stuxnet? Stuxnet is a very powerful computer worm that first appeared in 2010 and which also happens to be the biggest and most expensive of this type of malware. It is known to have exploited previously unknown Windows zero-day vulnerabilities to infect a target system and spread to other such systems. Stuxnet primarily attacked the centrifuges of Iran’s uranium enrichment facilities. Since then, it has been modified by cyber attackers, and this mutation has allowed it to spread to other energy-producing and industrial facilities. The original Stuxnet attack was aimed at programmable logic controllers (PLCs) that are used to automate machine processes. Although no country has officially owned up to creating Stuxnet, it is largely believed to have been created by the US and Israel in a joint effort. Stuxnet garnered a lot of media attention after its discovery, as it is the first virus known to cripple hardware and cause physical destruction of devices that have been infected with it. Iran’s nuclear programme was greatly crippled by Stuxnet, and owing to its aggressive nature, this virus accidentally spread beyond Iran’s nuclear facilities. However, it did not do much damage to external devices outside of the actual target locations. How Does Stuxnet Work? Stuxnet is a very complex and intrusive piece of malware. It has been designed to only affect targets that have certain configurations and cause minimal damage to other systems and devices. The targeted nuclear facilities in Iran were isolated and air-gapped from the global network, and so Stuxnet was probably transmitted through USB sticks that were carried into these facilities by agents. Stuxnet has code for a man-in-the-middle attack that can fake sensor signals and prevent a target system from shutting down due to unusual behaviour. Stuxnet is also abnormally large and written in multiple programming languages, and spreads fast. Three systemic layers are targeted by Stuxnet: Windows OS, Siemens PCS 7, WinCC, and STEP7 industrial software apps Siemens S7 PLC Windows systems were infiltrated by Stuxnet by exploiting several zero-day vulnerabilities like remote code execution. It utilised enabled printer sharing or LNK/PIF vulnerability executing the file when it was viewed in Windows Explorer. This malware can gain access at the user level as well as the kernel level. The device drivers in Stuxnet are signed by two public certificates, which enables it to access kernel drivers without the knowledge of the user. Because of this, Stuxnet could remain undiscovered for a long time. Once it has infiltrated Windows systems, Stuxnet proceeds to infect files that belong to Siemens industrial software applications and interrupts their communications. It modifies the code on PLC devices too. Stuxnet instals malware blocks in PLC monitors and repeatedly changes the frequency of the system. It alters the operation of motors by changing the rotational speed. Stuxnet also has a rootkit that helps the worm hide from monitoring systems. What Did Stuxnet Do? Stuxnet is reported to have destroyed several centrifuges in Iran’s Natanz uranium enrichment facility by making them burn out. Since then, Stuxnet has been modified by other malicious groups to make it capable of targeting facilities such as water treatment plants, gas lines, and power plants. Stuxnet is a multi-part worm that is believed to have travelled on USB drives and spread through systems running Windows. This virus scanned every infected computer for signs of Siemens Step 7 software. Siemens Step 7 software is used by industrial computers used as PLCs that automate and monitor electro-mechanical equipment. Once a PLC computer was found, Stuxnet updated its code over the Internet and started sending damaging instructions to the electro-mechanical equipment controlled by the affected system. Simultaneously, it also sent false feedback to the main controller so that anyone monitoring the equipment would not have any idea of an attack being underway until the equipment began to destroy itself. Stuxnet’s History Though it had been in development since 2005, Stuxnet was first identified and reported in 2010. The first known version of Stuxnet is Stuxnet 0.5 [McD13]. In January 2010, the inspectors who visited the Natanz uranium enrichment plant noted that its centrifuges were failing at an unusual rate. They were unable to detect the cause of this failure at the time. Another five months passed and researchers found malicious files in one of the systems. The worm started spreading around March 2010, but its first variant was found in 2009. On July 15, 2010, the worm became widely known because of a DDoS attack on an industrial systems security mailing list. This attack has interrupted a necessary source of information for power plants and factories. Stuxnet spread in two waves. The second wave was more visible and less targeted than the first. It was during the second wave that Stuxnet came to be known to the public, as it was more aggressive and widespread. This worm managed to infiltrate and infect more than 20,000 devices in 14 Iranian nuclear facilities and destroyed around 900 centrifuges. Although Stuxnet didn’t cause a lot of damage outside its target area, it provides an example for later malware that targets various infrastructures. Modified versions of Stuxnet target non-nuclear facilities as well. The Offsprings of Stuxnet Stuxnet had a massive influence on the development of future malware. While the creators of Stuxnet reportedly designed it to expire in June 2012, the legacy of Stuxnet survives in other malware based on the original code. The “offsprings” of Stuxnet are as follows: Duqu is a group of computer malware that also exploits zer0-day vulnerabilities in Windows. Based on the Stuxnet code, it was created to log keystrokes and collect data from industrial facilities, possibly to launch an attack later. It is very similar to Stuxnet and also targets Iranian nuclear entities. Like its predecessor Stuxnet, Flame also travelled via

Scroll to Top