Monthly Global Security Report by Radware. June 2020

In June 2020, Radware observed a massive attack against one of our Hybrid Cloud DDoS customers, a well-known European SaaS provider. This was a very long and continuous attack, utilizing ACK floods, which persisted over an entire month. In all, the total attack volume was 3,131 TB, including nine attacks, which peaked at more than 40 Gbps.

Download

2020 Cybersecurity Outlook Report. By VMware Carbon Black

The conflict of “good vs. evil” is a theme that’s captivated humanity throughout history, spanning religion, ethics, philosophy, politics, art, literature, and cinema. Often with larger-than-life characters leading the narrative, the “good vs. evil” conflict reveals humanity’s intrinsic desire to be safe amidst an omniscient and, often, ephemeral sense of fear.

Download

New Security Realities of COVID-19 World

This year hackers got brand new opportunity to get richer based on Covid-19 hype. McAfee detects more and more criminal attempts to exploit current events. This is why organizations and business have to be on aware and understand what new attack methods are used by cybercriminals in Covid-19 world.

Phishing letters now became the best tool for cybercriminals. Amount of such a content has considerably grown over the past few months. Users get faked letters as if from World Health Organization about sales of masks and medications, coronavirus tests and other medical merchandise (subject of such a message would usually be the most relevant for the addressee from specific region).

Phishing letters either contain links to sites with malicious content or to the documents with exploits or malicious macros. The goal of these activities is to get malicious code to the workstation with the purpose of stealing user or payment data. Hackers also try to lure the victim to a faked web resource with such phishing letters.

Criminal web site would imitate appearance of the bank site or payment system where users are offered to enter personal data. Crypto extorter, cyphering the victim PC, deleting shadow file copies and demanding ransom is one more variant of malicious software. It is well known, that today most attacks are conducted not by humans but by autonomous software solutions, collecting information about victims from different sources and sending phishing letter automatically. Information needed for such attacks is often collected from social networks and other open sources, which demands practically no efforts from criminals. For instance, in user files metadata, which are often in open access, there can be found email addresses, IP-addresses, OS versions etc.

This is a very often occasion when hackers us previously stolen user databases to launch attacks. Criminals may deploy any new attack within just several hours, based on social engineering techniques and emotions of potential victims. The best defense from such attack is awareness and informing company employees of cybercriminal methods.


Coronavirus-related Malware and Ransomware

New malicious executable files associated with the Covid-19 pandemic were identified:

Other researchers saw how cyber criminals used online coronavirus disease monitoring cards, replacing them with fake websites from which malicious programs were downloaded and installed. The following are the hashes of such malicious applications:

The new version of the ransomware CoronaVirus used for system optimization fake site for its propagation. Victims downloaded the WSGSetup.exe file from this site. Then this file worked as a downloader for two types of malware: the CoronaVirus ransomware and the Trojan Kpot password stealer. This campaign is a part of the latest trend among cryptographers: it combines data encryption with information theft.

Moreover, another ransomware called CovidLock was noticed, which now affects mobile device users. This ransomware came from a malicious Android application that is supposed to track COVID-19 infections. The ransomware blocks victim’s cell phone, giving him only 48 hours to pay a ransom of $100 in bitcoins to restore access to his device. Otherwise, the victim is threatened to have all phone data deleted and social network accounts data stolen.


How to Create Safe Passwords

Creating good and reliable passwords is quite a difficult task for many. It becomes especially intimidating when you start considering unique password for each site you visit. Tens of unique passwords like [email protected]! will make anyone feel a bit perplexed and gloomy.

A typical response to this problem will be simple and insecure.  A user will use one password for all services and resources, or will create several equally simple (to remember) and unreliable passwords. Or there will be some sticker with passwords brightly hidden beneath the keyboard.

Looks like there is a collision between strong passwords you can not remember and weak passwords you can remember but can not use if you want to avoid unauthorized access to your data.  First let’s see what is a strong (and weak) password.

Strong vs Weak Password

A strong password will have sufficient length, use various upper and lower case letters with numbers and symbols. It will not contain dictionary words or ties to your personal information.

Passwords like MyPassword1 might look ok considering above advise but they are not. Word password and any other dictionary word is not a good idea for password.

Anna1989:& does contain upper and lower case, as well as numbers and symbols, but it seriously flawed. Name and year of birth can be easily discovered from open sources and they will be, in case a hacker needs your data.

C0ntekst* is a bit more secure, as it has letter o substituted for number 0, and there is a deliberate error in spelling. Yet, it’s too short unfortunately. It will not take too much time for code-breaking software to guess it.

What shall I do?

Luckily, there are several easy to use and efficient tricks you can use to create strong password which will not force you enroll for memory improvement trainings.

Phrases with Personally Valuable Information

Think of something you are unlikely to forget and build a password on its basis. The2o12’sTripT0Pariswas0key is not that difficult to remember but is truly difficult to crack.

Acronyms or shortcut codes

EksEksEksElIz0key4MaiFriend – XXXL is ok for my friend. Spelling errors, numbers instead of letters and words, easy to recall information. Good example, still you can easily make it even better. Just think about using…

Smileys

Let’s take our example based on our friend’s anthropometry and add some emotion: EksEksEksElIz0key4MaiFriend:-). It’s always good to have a big friend. One of the benefits is when you are glad it makes your passwords even stronger and you will not forget in what way 🙂

Surely, there are many more efficient techniques to build strong passwords. But you don’t have to use them all to make your passwords strong and easy to remember. Just master those listed above and always remember: mix numbers and letters, upper and lower cases, add symbols, make errors and KEEP THEM LONG!


Cybersecurity Threat Alert NXNSAttack June 1, 2020

On May 19, 2020, academics from the Tel Aviv University and The Interdisciplinary Center in Israel discovered a vulnerability in the implementation of DNS recursive resolvers that can be abused to launch disruptive DDoS attacks against any victim. The attack leveraging the vulnerability has been dubbed NXNSAttack by the researchers and detailed in their research paper.

Download