The Reality of Passphrase Token Attacks
In my blog, Password Constraints and Their Unintended Security Consequences, I advocate for the use of passphrases. Embedded in the comments section, one of our readers Ben makes a very astute observation:
What happens when attackers start guessing by the word instead of by the letter? Then a four-word passphrase effectively becomes a four-character password.
What Ben is describing is called a “passphrase token attack,” and it’s real. With a good passphrase, the attack is not much of a threat though. First, a definition, then I’ll explain why.
What’s a token?
In the context of a passphrase token attack, a token is a grouping of letters, AKA a word. The passphrase made famous by the comic xkcd, “correct horse battery staple,” is 28 characters long. But, in a passphrase token attack, I wouldn’t try to guess all possible combinations of 28 letters. I would guess combinations of entire words, or tokens, each representing a group of characters.
The math behind passphrases
One might assume, as Ben did, that a four-word password is the same as a four-character password. But that’s a math error. Specifically, 95≠1,000,000.
Here’s why: There are 95 letters, numbers, and symbols that can be used for each character in a password. However, there are over a million words in the English language. For simplicity’s sake, let’s call it an even million words. If I’m thinking of a single character, then at most you have to try 95 characters to guess it. But if I ask you to guess which word I am thinking of, then you may need to guess a million words before you have guessed the word that I am thinking of.
So while there are 95^4 possible combinations of characters for a four-character password, there are over 1,000,000^4 combinations of words for a four-word password.
You might be thinking “But nobody knows a million words,” and you are correct. According to some research, the average person uses no more than 10,000. So, as an attacker, I’d try combinations of only the most common words. Actually, I may be able to get by with a dictionary as small as 5,000 words. But 5,000^4 is still a whole lot more combinations than 95^4.
Here is one list of 5,000 of the most commonly used words in the English language, and another of the 10,000 most commonly used words. Choosing an uncommon word is great, but even words in the top 5,000 are still far better than a complex nine-character password.
Why and how to use a passphrase
There are two major strengths of passphrases:
- Passphrases allow for longer, more secure passwords. It’s length that makes a passphrase a killer password. A password/passphrase that’s 20 lowercase characters long is stronger than a 14 character password that uses uppercase letters, lowercase letters, numbers, and symbols.
- Passphrases can be easy to remember, making creating and using passwords a lot less painful. “Aardvarks eat at the diner” is easy to remember and, at 26 characters long and including uppercase and lowercase letters, is more than 9 trillion times stronger than the password “eR$48tx!53&(oPZe”, or any other complex, 16-character password, and potentially uncrackable.
Why potentially uncrackable? Because “aardvark” is not one of the 10,000 most frequently used words and, if a word is not in the attacker’s dictionary, then you win. This is why it helps to use foreign-language words. Even common foreign words require an attacker to increase the size of their dictionary, the very factor that makes passphrase token attacks impractical. Learning a word in an obscure foreign language can be fun and pretty much assures a passphrase won’t be cracked.
As we’ve seen, cracking a passphrase can be far more difficult than cracking a password, unless you make one of two common mistakes. The first is choosing a combination of words without enough characters. “I am a cat,” for example. Although it’s four words, it’s only 10 characters long and an attacker can use a conventional brute force attack, even for a passphrase. Spaces between words can be used to increase the length and complexity of passphrases.
The second most common mistake is using a common phrase as a passphrase. I can create a dictionary of the top 1,000,000 common phrases and, if you’re using one, then it only takes at most 1,000,000 guesses to crack (about the same as a complex three-character password).
So create your own unique passphrases and you’re all set. Most experts recommend passphrases be at least 20 characters long. But if you only go from eight characters to 16 upper and lower case letters, you’ll already be 430 trillion times better off. And if you’re creating a passphrase for a site requiring a number or symbol, it’s fine to add the same number and symbol to the end of your phrase, provided the passphrase is long to begin with.
As a side note, according to math, a five word passphrase is generally stronger than a four word passphrase, but don’t get too hung up on that.
So Ben, you are 100% right about the reality of passphrase token attacks. But, with a strong passphrase, the math says it doesn’t matter. Note: If this stuff fascinates you, or you suffer from insomnia, you might enjoy “Linguistic Cracking of Passphrases using Markov Chains.” You can download the PDF or watch this riveting thriller on YouTube. Sweet dreams.
Common WordPress Vulnerabilities & How to Protect Against Them
The WordPress website platform is a vital part of the small business economy, dominating the content management system industry with a 60% market share. It gives businesses the ability to run easily-maintained and customizable websites, but that convenience comes at a price. The easy-to-use interface has given even users who are not particularly cybersecurity-savvy a presence on the web, drawing cyber-criminals out of the woodwork to look for easy prey through WordPress vulnerabilities in the process.
Here are some of these common vulnerabilities, and how can you prepare your website to protect against them.
WordPress Plugins
The WordPress Plugin Directory is a treasure trove of helpful website widgets that unlock a variety of convenient functions. The breadth of its offerings is thanks to an open submission policy, meaning anyone with the skill to develop a plugin can submit it to the directory. WordPress reviews every plugin before listing it, but clever hackers have been known to exploit flaws in approved widgets.
The problem is so prevalent that, of the known 3,010 unique WordPress vulnerabilities, 1,691 are from WordPress plugins. You can do a few things to impede your site from being exploited through a plugin. Only download plugins from reputable sources, and be sure to clean out any extraneous plugins you are no longer using. It’s also important to keep your WordPress plugins up-to-date, as outdated code is the best way for a hacker to inject malware into your site.
Phishing Attacks
Phishing remains a favored attack form for hackers across all platforms, and WordPress is no exception. Keep your eyes out for phishing attacks in the comments section, and only click on links from trusted sources. In particular, WordPress admins need to be on alert for attackers looking to gain administrative access to the site. These phishing attacks may appear to be legitimate emails from WordPress prompting you to click a link, as was seen with a recent attack targeting admins to update their WordPress database. If you receive an email prompting you to update your WordPress version, do a quick Google search to check that the update is legitimate. Even then, it’s best to use the update link from the WordPress website itself, not an email.
Weak Administrative Practices
An often overlooked fact about WordPress security: Your account is only as secure as your administrator’s. In the hubbub of getting a website started, it can be easy to create an account and immediately get busy populating content. But hastily creating administrator credentials are a weak link in your cybersecurity, and something an opportunistic hacker will seize upon quickly. Implementing administrative best practices is the best way to increase your WordPress security.
WordPress automatically creates an administrator with the username of “admin” whenever a new account is created. Never leave this default in place; it’s the equivalent of using “password” as your password. Instead, create a new account and grant it administrative privileges before deleting the default administrator account. You’ll also need to change the easily-located and often-targeted administrator url from the default of “wp-admin” to something more ambiguous of your own choosing.
One of the most important practices for any WordPress administrator is keeping the WordPress version up-to-date. An ignored version update can easily become a weak point for hackers to exploit. The more out-of-date your version, the more likely you are to be targeted by an attack. According to WordPress, 42.6% of users are using outdated versions. Don’t be one of them.
Additional Security Practices
The use of reputable security plugins like WordFence or Sucuri Security can add an additional layer of protection to your site, especially against SQL injections and malware attacks. Research any security plugins before you install them, as we’ve previously seen malware masquerading as WordPress security plugins. If your security plugin doesn’t offer two-factor authentication, you’ll still need to install a secure two-factor authentication plugin to stop brute force attacks. Keeping your data safe and encrypted behind a trusted VPN is also key to WordPress security, especially for those who find themselves working on their WordPress site from public WiFi networks.
WordPress is a powerful platform, but it’s only as secure as you keep it. Keep your website and your users secure with these tips on enhancing WordPress security, and check back here often for updates on all things cybersecurity.
Cyber News Rundown: Apple Removes Facebook Research App
Facebook Research App Removed from App Store
After seeing their Onavo VPN application removed from the Apple App Store last year, Facebook has re-branded the service as a “research” app and made it available through non-Apple testing services. The app itself requires users download and install a Facebook Enterprise Developer Certificate and essentially allow the company complete access to the device. While many users seem to be in it only for the monthly gift cards, they remain unaware of the extreme levels of surveillance the app is capable of conducting, including accessing all social media messages, sent and received SMS messages and images, and more. Apple has since completely removed Facebook’s iOS developer certificate after seeing how they collect data on their customers.
Japan Overwhelmed by Love Letter Malware Campaign
Following the discovery of the Love Letter malware a couple weeks ago, the campaign has been determined to be responsible for a massive spike in malicious emails. Hidden amongst the contents of the suspiciously-titled attachments are several harmful elements, ranging from cryptocurrency miners to the latest version of the GandCrab ransomware. Unfortunately for users outside of the origin country of Japan, the initial payload is able to determine the system’s location and download additional malicious payloads based on the specific country.
Apple FaceTime Bug Leads to Lawsuit
With the recent announcement of a critical vulnerability for Apple’s FaceTime app, the manufacturer has been forced to take the application offline. Unfortunately, prior to the shutdown, one Houston lawyer filed a case alleging that the vulnerability allowed for unauthorized callers to eavesdrop on a private deposition without any consent. By simply adding a user to a group FaceTime call, callers were able to listen through the other device’s microphone without that user answering the call.
Authorities Seize Servers for Dark Online Marketplace
Authorities from the US and Europe announced this week that, through their combined efforts, they had successfully located and seized servers belonging to an illicit online marketplace known as xDedic. While this was only one of many such server sites, administrators could have used it to facilitate over $68 million in fraudulent ad revenue and other malicious activities. Hopefully, this seizure will help law enforcement gain an understanding of how such marketplaces operate and assist with uncovering larger operations.
French Engineering Firm Hit with Ransomware
Late last week the French engineering firm Altran Technologies was forced to take its central network and supported applications offline after suffering a ransomware attack. While not yet confirmed, the malware used in the attack has likely been traced to a LockerGoga ransomware sample uploaded to a malware engine detection site the very same day. Along with appending extensions to “.locked”, LockerGoga has been spotted in multiple European countries and seems to spread via an initial phishing campaign, and then through compromised internal networks.
The Rise of Information Stealers
This is the second of a three-part report on the state of three malware categories: miners, ransomware, and information stealers.
As noted in the last blog, mining malware is on a decline, partly due to turmoil affecting cryptocurrencies. Ransomware is also on a decline (albeit a slower one). These dips are at least partly the result of the current criminal focus on information theft.
Banking Trojans, hacks, leaks, and data-dealing are huge criminal enterprises. In addition to suffering a breach, companies might now be contravening regulations like GDPR if they didn’t take the proper precautions to secure their data. The ways in which stolen data is being used is seeing constant innovation.
Motivations for data theft
Currency
The most obvious way to profit from data theft is by stealing data directly related to money. Examples of malware that accomplishes this could include:
- Banking Trojans. These steal online banking credentials, cryptocurrency private keys, credit card details, etc. Originally for bank theft specialists, this malware group now encompasses all manner of data theft. Current examples include Trickbot, Ursnif, Dridex.
- Point of Sale (POS). These attacks scrape or skim card information from sales terminals and devices.
- Information stealing malware for hijacking other valuables including Steam keys, microtransactional or in-game items
Trade
Data that isn’t instantly lucrative to a thief can be fenced on the dark web and elsewhere. Medical records can be worth ten times more than credit cards on dark web marketplaces. A credit card can be cancelled and changed, but that’s not so easy with identity. Examples of currently traded information include:
- Credit cards. When cards are skimmed or stolen, they’re usually taken by the thousands. It’s easier to sell these on at a reduced cost and leave the actual fraud to other crooks.
- Personal information. It can be used for identity theft or extortion, including credentials, children’s data, social security information, passport details, medical records that can be used to order drugs and for identity theft, and sensitive government (or police) data
Espionage
Classified trade, research, military, and political information are constant targets of hacks and malware, for obvious reasons. The criminal, political, and intelligence worlds sometimes collide in clandestine ways in cybercrime.
As a means of attack
While gold and gemstones are worth money, the codes to a safe or blueprints to a jewellery store are also worth a lot, despite not having much intrinsic value. Similarly, malware can be used to case an organisation and identify weaknesses in its security setup. This is usually the first step in an attack, before the real damage is done by malware or other means.
“In late 2013, an A.T.M. in Kiev started dispensing cash at seemingly random times of day. No one had put in a card or touched a button. Cameras showed that the piles of money had been swept up by customers who appeared lucky to be there at the right moment.” –From a story that appeared in the New York Times
Just another day in the Cobalt/Carbanak Heists
Some examples of “reconnaissance” malware include:
- Carbanak. This was the spear-tip of an attack in an infamous campaign that stole over €1 billion ($1.24 billion) from European banks, particularly in Eastern Europe. The Trojan was emailed to hundreds of bank employees. Once executed, it used keylogging and data theft to learn passwords, personnel details, and bank procedures before the main attacks were carried out, often using remote access tools. ATMs were hacked to spill out cash to waiting gang members and money was transferred to fraudulent accounts.
- Mimikatz, PsExec, and other tools. These tools are freely available and can help admins with legitimate issues like missing product keys or passwords. They can also indicate that a hacker has been on your network snooping. These software capabilities can be baked into other malware.
- Emotet. Probably the most successful botnet malware campaign of the last few years, this modular Trojan steals information to help it spread before dropping other malware. It usually arrives by phishing email before spreading like wildfire through an organisation with stolen/brute-forced credentials and exploits. Once it has delivered its payload (often banking Trojans), it uses stolen email credentials to mail itself to another victim. It’s been exfiltrating the actual contents of millions of emails for unknown purposes, and has been dropping Trickbot recently, but the crew behind the campaign can change the payload depending what’s most profitable.
“Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Emotet continues to be among the most costly and destructive malware affecting state, local, tribal, and territorial (SLTT) governments, and the private and public sectors.”- An August 2018 warning from the American DHS
- Trickbot/Ryuk. Trickbot is a banking Trojan capable of stealing a huge array of data. In addition to banking details and cryptocurrency, it also steals data that enables other attacks, including detailed information about infected devices and networks, saved online account passwords, cookies, and web histories, and login credentials. Trickbot has been seen dropping ransomware like Bitpaymer onto machines, but recently its stolen data is used to test a company’s worth before allowing attackers to deploy remote access tools and Ryuk (ransomware) to encrypt the most valuable information they have. The people behind this Trickbot/Ryuk campaign are only going after big lucrative targets that they know they can cripple.
What are the current trends?
Emotet is hammering the business world and, according to our data, has surged in the last six months of 2018:
Data recorded between 1 July and December 31, 2018. Webroot SecureAnywhere client data.
![](https://blog-en.webroot.com/wp-content/uploads/2019/01/25171034/New-Emotet-Files-Seen.png)
Detection of related malware surged alongside these detections. Almost 20% of Webroot support cases since the start of December have been related to this “family” of infections (Emotet, Dridex, Ursnif, Trickbot, Ryuk, Icedid).
What can I do?
- Update everything! The success of infections such as WannaMine proved that updates to many operating systems still lag years behind. Emotet abuses similar SMB exploits to WannMine, which updates can eliminate.
- Make sure all users, and especially admins, adhere to proper password practices.
- Disable autoruns and admin shares, and limit privileges where possible.
- Don’t keep sensitive information in plain text.
What can Webroot do?
- Webroot SecureAnywherehome security products detect and remove information stealers including Emotet, Trickbot, Ursnif, Heodo, and Mimikatz, as well as any other resultant malware.
- Our Identity and Privacy Shield stops keylogging and clipboard theft, even if malware isn’t detected.
- Ongoing cybersecurity education and trainingfor end users is a must for businesses to stay secure. Remember: phishing and email tend to be the top delivery methods for this malware.
- As well as helping you clean machines, Webroot’s support (in the case of infections such as Emotet) will help you plug security holes. Our specialised security hardening tools can be deployed through our console to all endpoints in a few clicks.
Information theft can be a very complicated business, but to tackle it, the basics have to be done. Criminals will always go for the low hanging fruit, so lifting your organisation’s data out of this category should be your first priority.But proper device protection and knowledge of good cyber hygiene are also essential to protecting your data. Stay tuned to the Webroot blog for the latest information on the newest threats.
Building a Cybersecurity Talent Pipeline One Coding Challenge at a Time
Like many technology companies, Webroot is constantly on the hunt for a diverse pool of engineering and technical cybersecurity talent. According to Jon Oltsik, senior principal analyst with Enterprise Security Group, a cybersecurity skills deficit holds the top position for problematic skills in ESG’s annual survey of IT professionals. In fact, the percentage of organizations reporting this problem has jumped more than 10 percent in just three years.
Here are the results from the last 4 years’ surveys:
- 2018-2019: 53% of organizations report a problematic shortage of cybersecurity skills
- 2017-2018: 51% of organizations report a problematic shortage of cybersecurity skills
- 2016-2017: 45% of organizations report a problematic shortage of cybersecurity skills
- 2015-2016: 42% of organizations report a problematic shortage of cybersecurity skills
The time has come for the private sector to take action to help develop the talent pipeline.
Start with real-world simulations
At Webroot, this need for more cybersecurity talent sprouted a partnership with the University of California San Diego Jacobs School of Engineering, which has culminated in an annual Coding Challenge.
The Challenge—presented in the form of a game—is a way for Webroot to impart real-world skills like problem solving, coding, and creative technical thinking onto the students.
The goal of the game is to be the best in the room. For the competitive students, that translated to beating everyone above them on the leaderboard. To do so, the students had to write code to control three characters to capture ghosts:
- A hunter, who worked to reduce ghost stamina,
- A ghost catcher, who trapped and released ghosts,
- A support character who focused on stunning the competition and observing the playing field as a whole.
But, as Daniel Kusper, senior QA engineer at Webroot points out, “it also provides an amazing opportunity for students to ask [industry experts] any and all questions they may have about cybersecurity and software engineering.”
In addition to honing skills like creative thinking and problem solving, students get a glimpse of real-world life for engineers and developers.
Xingyao Wu, a computer science student, said that this type of problem doesn’t have a single, specific right answer. You need creativity to come up with a solution.
“I learned how to solve this problem by thinking outside the box to create new rules or algorithms instead of just following the normal ideas.”
The advantage of real-world practice was not lost on Chris Mayton, another computer science major, either. Chris shared,“In my opinion, what you learn in class is more isolated from the real world; the data is clean and the environment is ready for you to start coding. With hackathons or coding challenges, you have to apply the concepts learned in class—which are big-picture—to real-world situations.”
Ryan Willett, a current Webroot engineering intern, may have put it best. “You need room for personal growth in the computer science field. Few classes give you the liberty to try to fail boundlessly. And there is a lot to be learned in failing. Events like the Coding Challenge help students realize that, sometimes, you’ll start down a route on a project that is very bad. You may have to throw away all your code and start again. Sometimes that’s just what you have to do to get to a workable solution.”
Given the large range and variety of technical employees that volunteered their time, the students got a diverse overview of a day-in-the-life of an engineer. Some students already had a good idea of why they’re interested in the field. Computer science and mathematics double major Guanxin Li said she“joined computer science because [she] felt like it’s really cool to build something with a couple lines of code. That’s so powerful.”
![](https://blog-en.webroot.com/wp-content/uploads/2019/01/22161922/Coding-Challenge-2019b3-1-1024x683.jpg)
Value in internships
The winners of the event are invited to apply for internship positions at Webroot’s San Diego office. Some of the rock star students from past events have even become full-time employees. These internships provide valuable experience for those who are still figuring out where they want to focus, or what industries to explore further.
Fred Yip, manager of software development and intern manager at Webroot, challenges his interns “to solve real-world problems, and to join the team by participating in the scrum and developer sprints just like full-time employees.”
Will one Coding Challenge solve the industry’s skills shortage? No. But it is a start. And I see many other cybersecurity and tech companies taking small steps that will have an impact on our future workforce. Webroot is also seeking more partnership opportunities with other universities to host learning events, and is even looking to extend its internship program globally.
We should all be excited about the next generation of talent and what they will bring to the industry. Who knows; one of the Coding Challenge participants might someday solve a present-day cybersecurity conundrum.
Advice to students from students
“I learned you really have to focus on small ideas first before implementing something more advanced. When we started, we tried to think about implementing everything at once. But then, where do we start? Think about it as a layer by layer at a time. Build it up.” – Leo Sack, computer science major
“Design what you want to implement before you start implementing. Thinking through the strategies of what each of your ghostbusters should do. Work through each problem step by step. And be patient, definitely be patient.” – Edward Chen, computer science major
Would You Like To Know My Social Security Number?
It’ll cost you a buck. Just like everyone else’s. The use of a Social Security Number (SSN) as unique identifiers has long been a contentious subject. SSNs were never intended to be used for identification, and their ubiquitous abuse for identification and authentication has lead me to call them “Social Insecurity Numbers,” or SINs.
There was a time when my response to a breach that leaked SSNs was “the horror, the horror.” Now my cynical reaction is “big deal, they stole my public information… again.” Yes, I know it’s improper for a security expert to feel this way, but an improper response is sometimes still the correct response.
Let me walk you through both sides of the issue: the horror and the dispassion.
The Horror
When aliens visit our lifeless planet in 2525, they will run DNA tests on our remains and they will catalog or index us by our SINs. That’s one of the things that makes the theft of SSNs worrisome. SSNs do not expire. A person may expire, their SSN does not. Social security numbers are not reused. They just stop being used. Funds may be paid to surviving spouses and children, but after that the SSNs are a permanent entry in a database.
Let’s put this into perspective. Of all of the credit cards issued between 1946 and 2012, virtually none are valid. Of all of the compromised credit cards issued between 2012 and 2018, very few remain valid. Sometimes the cards are replaced before they’re fraudulently used, and other times fraudulent use results in the cancellation of the cards. In either case, the cards are simply replaced with new account numbers.
Compare this to SSNs. Of all of the SSNs issued since 1934, well… Have you ever see an expiration date on a Social Security card? You can change your credit card number. You can change bank. You can change your career, your doctor, your vet, your clothes, or your mind. But unless you enter the United States Federal Witness Protection Program, your SSN isn’t changing. (Actually, that’s a bit overstated. Under certain circumstances you can get a new SSN, but your SSN simply being compromised does not qualify you to change SSNs.)
According to a study published by Javelin, more social security numbers were involved in breaches in 2017 than credit cards. Think about that for a moment. Do you know anyone who has had a fraudulent purchase made on their credit card? Here’s where the problem becomes insidious. Credit card fraud is loud. You can hear it coming. I have alerts set up on my bank accounts so that I know each time a charge is made. I am alerted through text and email. One fraudulent charge and I know. I can act.
But SSNs are quiet. Multiple applications for credit cards can be made simultaneously, but you’re not likely to find out very quickly. Pair this with a compromised email account, and you could be in big trouble. For me, it’s of serious concern.
The Dispassion
Why don’t I worry about my SSN being leaked? Because it’s already been leaked multiple times in multiple breaches.
How do I know that?
I don’t, I just assume it has been. Why? Because my SSN has been vulnerable to theft for decades, and there are so many compromised SSNs stocking the dark web that they’re a cheap commodity. You might even expect to encounter a “buy five credit card numbers get two SSNs free” deal, or to see them sold by the dozen, like Kleenex at Costo.
According to Brian Stack, the Vice President of Dark Web Intelligence at Experian, Social Security numbers sell for only $1 on the dark web. In the massive Marriot breach, it wasn’t my SSN I was worried about, it was my loyalty program information. My loyalty program information is worth 20 times more than my SSN on the dark web. Loyalty program points can be used to buy travel or merchandise in airline shopping malls.
For several years, “assume the breach” has been the mindset of many security professionals, meaning that we should assume a company will be breached, or already has been breached, and we should be clear-eyed about it. It is a call to action. Put mitigations and remediation processes in place. Have an action plan.
For the public, and I cannot emphasize this enough, this means you should assume it was your data that was compromised in the breach, and put a remediation plan in place. If the businesses holding your data assumes your data is toast, then you should too.
What You Can Do
So, if we’re adopting the fatalist position on SSN theft, but still want to protect ourselves, what’s a person to do?
- Credit freezes and fraud alerts. Both are good proactive defenses. The Federal Trade Commission (FTC) is a good place to start if you don’t know how. For information about credit freezes, check here. For information about fraud alerts and extended fraud alerts, take a look here and here.
- Use two-factor authentication. Gmail, Facebook, Twitter, and other sites offer two-factor authentication. Typically, this means you’ll need to respond to a text or email in order to log into your account. This makes it harder for the bad guys to hijack it. Not impossible, but significantly more difficult.
- Take advantage of alerts offered by financial institutions. If someone tries to log into my bank account or make a charge on my credit or debit card, I will know it immediately.
- Be Prepared for Identity Theft. Once again, the FTC consumer information page on identity theft is a great resource for consumers, security evangelists, and businesses alike on how to build a strong defensive posture.
Identity theft is real, it can be devastating, and you need to be prepared for it. But reports of breaches that include SSNs tell me what I already know; my SSN is in the hands of cybercriminals. It has been for years.
So no, I’m not going to tell you my SSN. You’ll have to pay your dollar for it, just like everyone else.
A Miner Decline: The Slowdown of a Once-Surging Threat
This is the first of a three-part report on the state of three malware categories: miners, ransomware and information stealers.
In Webroot’s 2018 mid-term threat report, we outlined how cryptomining, and particularly cryptojacking, had become popular criminal tactics over the first six months of last year. This relatively novel method of cybercrime gained favour for being less resource-intensive and overtly criminal when compared to tactics involving ransomware. But mining cases and instances of mining malware seem to have dropped off significantly in the six months since this report, both anecdotally and in terms of calls to our support queue.
The crytpo world has gone through significant turmoil in this time, so it’s possible the reduced use of malicious cryptojacking scripts is the result of tanking cryptocurrency values. It’s also possible users are benefitting from heightened awareness of the threat and taking measures to prevent their use, such as browser extensions purpose-built to stop these scripts from running.
Setting aside the question of why for a moment, let’s take a look at some stats illustrating that decline during that time period.
Cryptojacking URLs seen by Webroot over six months beginning 1 July through 31 December, 2018, Webroot SecureAnywhere client data.
![](https://blog-en.webroot.com/wp-content/uploads/2019/01/25164331/Urls-Associated-with-Cryptojacking-That-Have-Been-Seen-by-Webroor-Endpoints.png)
New miner malware seen by Webroot
Data from six months beginning 12 July through 9 Jan, 2019, Webroot data, units logarithmic.
![](https://blog-en.webroot.com/wp-content/uploads/2019/01/25164443/New-Miner-PE-Files-Seen.png)
Monero mining profitability ($)
Data covering six months from 12 July – 9 Jan, 2019, Bit Info Charts, units logarithmic
![](https://blog-en.webroot.com/wp-content/uploads/2019/01/25164548/Monero-Mining-Probability-historical-chart.png)
Monero price ($)
Data covering six months from 12 July through 9 Jan, 2019, World Coin Index
![](https://blog-en.webroot.com/wp-content/uploads/2019/01/25164648/Monero-price.png)
Interpreting the data
None of the graphs are identical, but without too much statistical comparison, I think a broad trend can be seen: malicious mining is on the decline alongside a general decline in coin value and coin mining profitability.
Profitability affecting criminal tactics is of course not surprising. The flexibility of exploit kits and modern malware campaigns like Emotet mean that cybercriminals can change tactics and payloads quickly when they feel their malware isn’t netting as much as it should.
Thanks to the dark web, criminal code has never been easier to buy or rent than in recent years, and cryptocurrencies themselves make it easy to swap infection tactics while keeping the cash flowing. Buying or renting malicious code and malware delivery services online is easy, so the next time the threat landscape changes, expect criminals to quickly change with it.
Should I still care about miners?
Yes, absolutely.
Cryptocurrency, cryptomining, and malicious cryptomining aren’t disappearing. Even with this dip, 2018 was definitely a year of overall cryptocrime growth. Our advanced malware removals teams often spot miner malware on machines infected by other malware, and it can be an indication of security holes in need of patching. And any illegal mining is still capable of constantly driving up power bills and frustrating users.
Where are cybercriminals focused now?
Information theftis the current criminal undertaking of choice, a scary development with potentially long-lasting consequences for its victims that are sometimes unpredictable even to thieves. The theft, trade, and use for extortion of personal data will be the focus of our next report.
What can I do?
Cryptojacking may only be on the decline because defences against them have improved. To up your chances of turning aside this particular threat, consider doing the following:
- Update everything. Even routers can be affected by cryptojacking, so patch/update everything you can.
- Is your browser using up lots of processor? Even after a reset/reinstall? This could be a sign of cryptojacking.
- Are you seeing weird spikes in your processor? You may want to scan for miner infections.
- Don’t ignore repeated miner detections. Get onto your antivirus’ support team for assistance. This could be only the tip of the iceberg.
- Secure your RDP.
What can Webroot do?
Webroot SecureAnywhere®antivirus products detect and remove miner infections, and the web threat shield blocks malicious cryptojacking sites from springing their code on home office users. For businesses, however, the single best way to stop cryptojacking, is with DNS-level protection. DNS is particularly good at blocking cryptojacking services, no matter how many sites they try to hide behind.
Persistent mining detections might point to other security issues, such as out-of-date software or advanced persistence methods, that will need extra work to fix. Webroot’s support is quick and easy to reach.
In the end, cryptomining and cryptojacking aren’t making the same stir in the cybersecurity community they were some months ago. But they’ve far from disappeared. More users than ever are aware of the threat they pose, and developers are reacting. Fluctuations in cryptocurrency value have perhaps aided the decline, but as long as these currencies have any value cryprojackers will be worth the limited effort they require from criminals.
Watch for the use of cryptominers to be closely related to the value of various cryptocurrencies and remain on the lookout for suspicious or inexplicable CPU usage, as these may be signs that you’re being targeted by these threats.
And of course, stay tuned to the Webroot blog for information on the latest threat trends.
Cyber News Rundown: Anatova Ransomware Infects the Globe
Anatova Ransomware Reaches Global Market
A new ransomware family, dubbed Anatova by researchers, has been infecting machines across the globe. During encryption, Anatova appears to focus on small files to speed up overall encryption times, but doesn’t append the encrypted files with a new extension. Unexpectedly, this variant demands DASH crypto coins, rather than using a currency with a less visible transaction ledger. It also uses several tactics to prevent analysis in both real-world and virtual environments.
Android Malware Remains Dormant until it Detects Motion
On the Google Play store, researchers have discovered several malicious apps that rely on an unusual trigger to install a banking Trojan: motion sensors. By monitoring the motion sensor in a specific mobile device, the malware can determine if it is a real victim device or a research emulator (which would likely remain stationary during analysis.) In particular, one of these insidious apps was downloading the Anubis banking Trojan, which launched a fake Android update screen to start keylogging in hopes of capturing banking credentials.
Google Faces First Major GDPR Fine
Regulators in France have issued a fine against Google for two separate complaints, the first being the company’s misuse of their users’ data, the second being the legal use of that data without providing the user enough details to give fully-informed consent. This fine is the first issued by the CNIL, the official regulator for France, and could cost Google up to $57 million.
ElasticSearch Database Exposes Online Gambling Bets
In the last couple days, security researchers have discovered a database holding sensitive information on dozens of online casino sites’ bettors. After contacting the hosting provider, researchers verified that the database, which contained over 100 million bet entries, had finally been secured. However, it’s still unclear whether the database’s owner or the ISP was responsible.
Chinese Crypto Farms Get Unique Ransomware Strain
Since China houses most of the world’s cryptocurrency mining farms, it comes as little surprise that malware authors are beginning to focus on this lucrative market. By infecting Antminer devices, which mine Litecoin and Bitcoin, this variant can quickly shut down the device and prevent further mining operations. Victims must choose between paying an extremely high ransom and allowing the infection to spread to thousands of other devices. For victims who do not pay, this variant also threatens to shut down devices’ fans, causing them to overheat and eventually destroy themselves.
Smart Wearables: Convenience vs. Security
Fitness trackers and other digital wearables have unlocked a new era of convenience and engagement in consumer health. Beyond general fitness trackers, you can find wearables for a variety of purposes; some help diabetics, some monitor for seizure activity, and some can aid in senior citizens’ health and quality of life. But the convenience of an interconnected lifestyle may be a double-edged sword. Fitness trackers and wearables are notoriously unsecured. Wearables record and store some of our most sensitive health data—which is often 10x more valuable than a stolen credit card— making them a particularly attractive target for hackers.
So what types of data does your fitness tracker store? For a start, it holds the identifying information required to set up your account, such as your email, username, and password. But other fitness tracking specifics can make a user easier to identify, including as gender, birthdate, geographical location, height, and weight. Health and activity data provides an in-depth look at the user’s daily habits through the power of GPS monitoring. If your device is paired inside of a network, other personal device information will also be stored, such as your Unique Device IDs or MAC addresses. Depending on the device, your wearables may also store your credit card information or bank account information.
New vulnerabilities
Because of their versatility, wearables and fitness trackers leave us vulnerable in many ways. In last year’s MyFitnessPal hack, which affected 150 million users, attackers hoped to access credit card information but came away with only usernames and passwords. But what about the information that is more specific to wearables, like GPS tracking? After the fitness tracker Strava revealed hidden army bases through heatmap tracking, the Pentagon began to restrict the use of wearables by military personnel due to the potential security threat. And the recently uncovered MiSafe vulnerability left thousands of children unsecured, allowing hackers to track their movements, listen in on conversations, and actually call children on their smart watches.
Even with these concerns, the wearables market continues to grow, with the prevalence of such devices predicted to double by 2021. Large healthcare organizations and insurance carriers are also starting to use insights from fitness trackers to influence both patient care and insurance rates. We’re even beginning to see the introduction of wearables for employee tracking, although this has met with mixed response. With this increased exposure to potentially insecure technologies, you’ll need to take extra steps to ensure your family’s security.
Where to start
Always research any fitness trackers or wearable devices before you commit, and be sure to avoid devices with any known security flaws. Notable examples to avoid are Medion’s Life S2000 Activity Tracker and Moov’s Now tracker. The Life S2000 requires no authentication and sends data unencrypted, and the Now tracker can leave users vulnerable to attack via Bluetooth connectivity. Even larger brands like Lenovo struggle to maintain an adequate level of security in their fitness trackers; the Lenovo HW01 smart band sends both registration and login data to its servers unencrypted.
Although it’s tedious, we recommend you always read the privacy policy of any wearable device or fitness tracking app before you use it. If the data storage and security measures outlined in the policy aren’t up to snuff, request a refund and let the manufacturer know why. Periodically reviewing your app’s privacy settings on your phone is also a good practice—just to make sure you’re comfortable with the app’s level of access. Take common-sense cybersecurity measures to help keep your wearables as secure as possible. Never reuse passwords or use third party login services like Facebook Login, and consider using a password manager like LastPass® instead.
Wearables and fitness trackers are here to stay, and the Internet of Things (IOT) is only going to keep growing. We have to work together to protect ourselves as we integrate these technologies into our daily lives. After all, the price of convenience cannot match the value of our personal security.
As always, be sure to check back here to stay updated on the newest cybersecurity trends.
Cyber News Rundown: Ransomware Halts Texas Town
Texas Town Brought to a Halt by Ransomware
Several days ago the town of Del Rio, Texas, fell victim to a ransomware attack that knocked most of the town’s major systems offline. While the town’s IT department quickly worked to isolate the infection, remaining departments were forced to switch to hand-written transactions in order to not completely shut down. Fortunately, the attack was quickly resolved and all city websites returned to normal within only a couple of days.
Data Vulnerability Affects Booking Systems for 141 Airlines
Researchers recently discovered a data vulnerability affecting the Amadeus ticket booking system, which is used by more than a hundred international airlines. By making simple changes to a provided URL link, researchers were able to access passenger records and view related flight information. They were also able to access an Israeli airline’s user portal and make changes to the user account, and even change or cancel flight reservations.
Ryuk Ransomware Surpasses $4 Million in Ransom Payments
The ransomware variant known as Ryuk has pulled in nearly $4 million in Bitcoin payments alone since last August. By remaining dormant on previously infected systems, Ryuk can stay hidden for months or even years while its operators build an understanding of the system. In doing so, the attackers are able to command much higher ransom payments by focusing on victims with the means to pay a larger sum.
Account Vulnerability Plaguing Fortnite Players
A new vulnerability has been found pertaining to user accounts for Fortnite that could allow attackers to take full control of an account. By intercepting game-specific authentication tokens, attackers could access a user’s payment card details and use them to purchase in-game currency, or even gain access to a victim’s in-game conversations. Fortunately, Epic Games reacted swiftly to the announced exploits and quickly resolved the security flaws.
Advertising Hack Pushes Malware on Online Shoppers
The latest MageCart attack has compromised the entire distribution network for Adverline, a French advertising company that conducts a substantial amount of business in Europe. By injecting a malicious JavaScript code into dozens of online stores, the attack has been used to steal payment data from at least 277 unique websites thus far. By starting the attack at the top of the distribution chain, these types of attacks have an increased chance of success as the number of victims rises.
MSPs: Your Security Vendor Should Integrate with More Than Just Your RMM and PSA
For many MSPs, integrating their security solution with their remote monitoring and management (RMM) and professional service automation (PSA) platforms is essential for doing business. Together, these platforms help lower the cost of keeping up with each client, ensuring profitable margins for a healthy, growing business.
For true providers of IT services—MSPs that sell services rather than licenses and take a holistic approach to client IT health—RMM and PSA integrations are critical for keeping track of hundreds or even thousands of unique endpoints and automating recurring operations for numerous clients.
Like many of the other features of our security solutions, our RMM and PSA integrations are custom-built with the needs of MSPs in mind. They’re designed to help MSPs create the most efficient, well-oiled versions of their businesses possible so that service is prompt, solutions are effective, and profit is preserved.
Here’s what you should expect from your RMM and PSA security integrations:
- Faster rollouts- One of the core benefits of RMM-assisted deployments, expect rollouts to new endpoints to be fast and hassle-free with well-designed integrations. New endpoints should be easy to set up with protection turned on in just a few clicks.
- Simplified management- Efficiency is key to profitability. So a centralized dashboard displaying what’s running, what’s broken and how, infection statuses, endpoints requiring attention, and more helps increase the number of endpoints a single technician can manage, boosting efficiency and, ultimately, profitability.
- The data you need- The best RMM and PSA integrations make it possible to get the data you need to run a successful business. Whether it’s per-client data for calculating a client’s cost to you, information on policy settings for sites and endpoints, or additional reporting delivered to clients to promote peace-of-mind, having access to allof your data empowers decision-making.
Integrations don’t have to end there
Integrating disparate products can be a laborious, time-intensive process. For that reason, many security vendors are reluctant to coordinate too closely with customers to automate functions unique to their businesses. But it doesn’t have to be that way.
Advanced plugins and tools allow for complete customization of dashboards, reporting, and data tracking. Each can be customized to track the metrics most useful to the organization. Critical processes, like issuing periodic reports, can be fully automated. This can be extremely beneficial when it comes to communicating with customers. Weekly or monthly reports demonstrate that, despite a lack of any major security incidents, it wasn’t for lack of trying on the part of cybercriminals.
More than simply allowing different business platforms to talk to one another, integration plugins can be used for running commands and performing actions. This includes creating, modifying, or deleting licenses, removing duplicate endpoints, or quickly creating new console sites.
Insist on better integrations
So when considering which cybersecurity vendor offers the most for your MSP, consider not only whether the solution allows you to communicate with your RMM and PSA platforms, but also how deeply. Does the vendor have a dedicated integrations team? Do they offer tools for the customization of business-specific reporting? Can essential, recurring business processes be automated?
The answers to the questions above will help you determine how much value RMM and PSA integrations add for your business. In a market where margins can be razor thin and built-in efficiencies can make or break the bottom line, the answers may make all the difference.
Cyber News Rundown: Bad Apps Infect Google Play
Malicious Apps Get Millions of Installs
Google recently removed 85 apps from the Play Store after they were found to contain predatory adware. With over nine million combined downloads, the apps were mostly fake games or utility apps that began pushing a constant stream of full-screen ads to users until the app itself crashed. More worrisome, while nearly all the apps shared similar code, they were mostly uploaded from different developer accounts and used different digital certificates to minimize detection.
Tuition Scam Targets UK College
Several parents of students attending St. Lawrence College in the UK fell victim to an email scam over the holidays that requested early tuition payment at a discounted rate for the upcoming terms. While security measures surrounding parental information have since been improved, at least two separate families confirmed they sent undisclosed amounts of money to the scammers. Though these types of attacks target large audiences, it takes only a small number of successful attempts to make the campaign profitable.
Australian EWN System Hacked
With the help of a strong detection system, a brief hack of the Australian Early Warning Network (EWN) was quickly shutdown. Some of the messages contained warnings about the security of the EWN and listed several links that the user could navigate through. Fortunately, staff were quick to notice the severity of what was occurring and acted to prevent additional customers from being spammed.
Ransomware Uses Children’s Charity as Cover
When CryptoMix first came to light, it included a ransom note masquerading as a request for a “donation” to a children’s charity. It has since returned, but now includes actual information from crowdfunding sites attempting to help sick children and using their stories to guilt victims into paying a ransom. Even worse, as victims navigate the payment process, the ransomware continues to urge them on with promises that the sick child will know their name for the aid they provide.
Exploit Broker Raises Bounties for New Year
Following the New Year, a known exploit broker, Zerodium, announced they would be effectively doubling all bounty payouts for zero-day exploits. While lower-end Windows exploits will net a researcher $80,000, some Android and iOS zero-days will pay out up to $2 million. Unfortunately for many working on the lawful side, nearly all the exploits obtained by Zerodium will be privately sold, rather than used for patching or improving security.