Stay protected and avoid attacks online

You’ve probably seen the news about the latest cyberattack which has affected the NHS as well as approximately 200,000 other victims across 150 countries. This particular attack used Ransomware (2016-2017 Ransomware statistics and facts), known as WannaCry, which is a malicious piece of software that locks files on a computer and demands payments to unlock them. WannaCry affected an exploit in the Windows XP operating system on PCs, and Microsoft shortly sent out a fix for the security flaw. But authorities such as the U.K.’s National Cyber Security Center (NCSC), warned over the weekend that as the working week begins, further cases of ransomware could come to light.

 

Am I at Risk?

The WannaCry ransomware affects machines running the Windows operating system. It was a security flaw that was originally exploited by the U.S. National Security Agency (NSA) which was then leaked earlier this year. Hackers are now using this themselves. If you or your organisation is running a version of Windows, you could be at risk.

 

What types of other attacks are there?

 

Social Engineering

Socially engineered Trojans are the number one method of attack. Users are prompted to visit certain websites, usually through an innocent looking email, which downloads malicious software to the users computer. Sometimes the website is legitimate and has been temporarily compromised by hackers. Socially engineered Trojans are responsible for hundreds of millions of successful hacks each year.

Ransomware

A malicious piece of software that locks files on a computer and demands payments to unlock them. Ransomware attacks have been on the rise and WannaCry was called “unprecedented” by Europol.

Malware

Malware is the term for a variety of cyber threats including Trojans, viruses and worms. Malware is any code with malicious intent, stealing data or destroying something on the computer. Malware gets on to computers through email attachments, software downloads or operating system vulnerabilities.

Phishing

Phishing attacks are sent via email and ask users to click on a link. Once the user is on the innocent looking website, they enter their personal data which is intercepted by hackers. Phishing emails have become much more sophisticated recently and it is often very difficult to identify one.

Password Attacks

This type of attack requires the hacker to use software to try and crack a users password. Hackers use brute force attacks which guess passwords over and over again, sometimes using various word combinations.

Denial-of-Service (DoS) Attacks

A DoS attack involves hackers sending high volumes of data or traffic through the network until the network becomes overloaded and can no longer function. The most common type is distributed-denial-of-service (DDoS) attack which involves hackers using multiple computers to send the traffic or data that will overload the system.

“Man in the Middle” (MITM)

By impersonating points on a network, a MITM attack can obtain information from users and data they are sending and receiving. For example, if you are banking online, the man in the middle sits between you and your bank, receiving all of the information transferred between the two. Normally, a MITM gains access through a non-encrypted wireless networks.

Rogue Software

Rogue security software designers make pop-up windows and alerts that look legitimate, advising users to download security software, agree to terms or update their current system in an effort to stay protected. By clicking “yes” to any of these scenarios, the rogue software is downloaded to the user’s computer.

 

 

How can you protect yourself?

Remember SECURED:

 

S-Software

Make sure you have up-to-date firewall, anti-virus, anti-malware and anti-adware software on your computer. Scan your computer regularly and set up auto-scans at regular intervals.

Free security software available for both Windows (Microsoft) and OSX (Apple) – Sophos, AVG, Comodo, Malwarebytes.

E-Educate

Educate family, friends, employees and co-workers on how to identify scams, malicious links and emails that may contain viruses.

C-Click

Never click on links contained in emails, always type the address into your browser manually.

U-Update

Always make sure you have downloaded the latest Windows or OSX software updates.

R-Reserve

Back up data regularly and keep a reserve copy somewhere off your computer e.g. Time Machine (OSX), USB Flash Drive, DropBox, OneDrive. If you're a Mac (OSX) user and not a fan of Time Machine, check out this great blog post on Time Machine alternatives. 

E-Emails

Only open emails from sources you trust and if you don’t trust the source, don’t open the email, even to unsubscribe. Install software that scans outgoing and incoming email for malicious attachments.

D-Download

Only download software from trusted sources.

 

If you’re a business, run “penetration tests” regularly against the security of your network. Security professionals recommend you do this once a year.

 

What if you have already been attacked?

Do not pay any money demanded by ransomware. There is no evidence of hackers giving people files back.

For individuals, it might be worth contacting local IT support services and businesses should contact the police and provide as much information as possible.

Restore backups of data.