Threat report H2 2012

H2_2012_incidents_calendar

Threat report H2 2012

This time of the year is always interesting. It is the time when Labs looks back on the past half-year to summarize what has happened in the threat landscape. I can proudly announce that the report for H2 2012 has been published and is free for you to download and read!

The report is once again packed with highly interesting reading on the threats that we all face when using the net. And this report is not just a repetition of what has been published in the media. A compilation like this makes it easier to spot the trends and the big picture. Thanks guys for putting it all together! And of course for the continuous research effort that it is based on. (I’m not going to list all the names here, the full list of contributors can be found in the report.)

Here’s some teasers…

Botnets. ZeroAccess was easily the most prevalent botnet we saw in 2012, with infections most visible in France, United States and Sweden. It is also one of the most actively developed and perhaps the most profitable botnet of last year. Read more about ZeroAccess and botnets in general at page 15 – 20.

Exploits. Java was the main target for most of the exploit-based attacks we saw during the past half year. This is aptly demonstrated in the statistics for the top 10 most prevalent detections recorded by our cloud lookup systems. Learn more about exploits at page 25-27.

Banking trojans. With regards to banking-trojans, a botnet known as Zeus—which is also the name for the malware used to infect the user’s machines—is the main story for 2012. Browse to page 21-24 to read how the traditional way to rob a bank has become hopelessly old-fashioned.

The web. Common sense is still important when surfing, but it is becoming increasingly difficult to spot the dangerous places. Ad-networks are integrated in an increasing number of sites and can distribute malware through web portals that should be trustworthy. More about the web’s dangerous places at page 28-31.

Mobile devices. Did you know that there is malware on all commonly used mobile platforms? But Android has the questionable honor to lead the pack, and the others are far behind. The full story is on page 35-37.

The threat report covers all this and a lot more. Why not make sure that you are up to date on the threat scenario by continuing to the report. It is highly recommended reading.

Micke

More posts from this topic

15855489588_6c209780a9_b

How “the Cloud” Keeps you Safe

“The cloud” is a big thing nowadays. It’s not exactly a new concept, but tech companies are relying on it more and more. Many online services that people enjoy use the cloud to one extent or another, and this includes security software. Cloud computing offers unique security benefits, and F-Secure recently updated F-Secure SAFE to take better advantage of F-Secure’s Security Cloud. It combines cloud-based scanning with F-Secure’s award-winning device-based security technology, giving you a more comprehensive form of protection. Using the cloud to supplement device-based scanning provides immediate, up-to-date information about threats. Device-based scanning, which is the traditional way of identifying malware, examines files against a database saved on the device to determine whether or not a file is malicious. This is a backbone of online protection, so it’s a vital part of F-Secure SAFE. Cloud-based scanning enhances this functionality by checking files against malware information in both the local database found on devices, and a centralized database saved in the cloud. When a new threat is detected by anyone connected to the cloud, it is immediately identified and becomes "known" within the cloud. This ensures that new threats are identified quickly and everyone has immediate access to the information, eliminating the need to update the database on devices when a new threat is discovered. Plus, cloud-based scanning makes actual apps easier to run. This is particularly important on mobile devices, as heavy anti-virus solutions can drain the battery life and other resources of devices. F-Secure SAFE’s Android app has now been updated with an “Ultralight” anti-virus engine. It uses the cloud to take the workload from the devices, and is optimized to scan apps and files with a greater degree of efficiency. Relying on the cloud gives you more battery life, and keeps you safer. The latest F-Secure SAFE update also brings Network Checker to Windows PC users. Network Checker is a device-based version of F-Secure’s popular Router Checker tool. It checks the Internet configuration your computer uses to connect to the Internet. Checking your configuration, as opposed to just your device, helps protect you from attacks that target home network appliances like routers – a threat not detected by traditional anti-virus products. So the cloud is offering people much more than just extra storage space. You can click here to try F-Secure SAFE for a free 30-day trial if you’re interested in learning how F-Secure is using the cloud to help keep people safe. [Image by Perspecsys Photos | Flickr]

June 30, 2015
BY 
travel, amalfi coast, digital safety, security

6 digital ways to save your summer vacation

My wife had to remind me to look up from my smartphone. We were traveling on the one-lane coastal road that connects Sorrento with Italy's Amalfi coast. I looked down and saw the Li Galli islands, which according to local legend are where the sirens beckoned the hero of Homer's Odyssey into the rocks. In Naples, my iPhone had been my tour guide, allowing me to get pizza recommendations from my friend and then scout out when was the best time to eat, according to the reviews. It had brought us to the Museo Cappella Sansevero to see Veiled Christ and helped us chose a gelateria from the hundreds of options. And now I was plotting our visit to the beachfront town of Positano. If you're addicted to your mobile device or checking in online, you know it can improve or ruin your vacation. And missing a great view could be the least of your worries. You should look up from your phone occasionally, but you can stay connected and safe with a few precautions. 1. Lock your devices. You wouldn't leave post-it note with your PIN on your ATM card. So don't invite strangers into your phone to turn off your anti-theft app and start digging through your digital life. Use an unguessable passcode on all your devices and set your devices to lock. 2. Don't bank or shop on a public computer. Strange computers can have strange keyloggers or some other malware that could slurp up your information. (If you have to use a public computer to get on Facebook, for instance, use a one-time password.) 3. Clean up your phone. You hear lots of news reports about how gross and covered with bacteria our phones are. But the inside suffers from the same buildup of crap. "Phones and computers always store information about what you do. Internet browsers store a history," Security Advisor Sean Sullivan told us. "Apps create temporary files where they store stuff to help them run faster. A lot of apps and websites have passwords and contact information about you stored." Our free Booster app makes cleaning your device easy. 4. Assume you're being watched. What do using a ATM and logging into your MacBook Pro both say to crooks? I have money that you could take. While you're sightseeing, you become the sight criminals are seeing. You use a money belt to hold your passports, cash and credit cards -- or you should. So use the same caution whenever looking at a screen. 5. Practice safe Wi-Fi and use a VPN. If you're using someone else's Wi-Fi -- whether you're at a motel, coffee shop or a rental you booked through AirBnB -- it's someone else's Wi-Fi. Even five-star hotel network isn't 100 percent safe. So don't expect others to watch out for you. "You often have to choose between using free Wi-Fi hotspots or paying roaming charges to use your mobile connection," Sullivan said. "Using a VPN like Freedome gives you a secure funnel that lets you use public Wi-Fi connections without assuming the risks." 6. Before you go, store your important passwords and PIN codes in a safe location. Have you ever struggled with forgotten passwords or PIN codes after a relaxing summer break? Why not being a bit smarter this year, so store your passwords in a password manager, and they are there waiting for you when you come back. You can download F-Secure KEY for free for your iPhone, iPad or Android phone here. Cheers, Jason [Photo by Giuseppe Milo | Flickr]

June 10, 2015
BY 
WhatsApp Scams

WhatsApp Scams: 3 Things you Need to Know

F-Secure Labs reported this week on a new WhatsApp scam that’s successfully spammed over 22,000 people. Spam seems to be as old as the Internet itself, and is both a proven nuisance AND a lucrative source of revenue for spammers. Most people don’t see what goes on behind the scenes, but spammers often employ very sophisticated schemes that can expose web surfers to more than just ads for Viagara or other “magic beans”. Spam typically tries to drive Internet traffic by tricking people into clicking certain websites, where scammers can bombard unsuspecting web surfers with various types of advertising. Profit motives are what keep spammers working hard to circumvent spam blocks, white lists, and other protective measures that people use to try and fight back – and it can pay off. Numerous spammers have been indicted and suspected of generating hundreds of thousands of dollars in revenue from their spam campaigns, with one study projecting that spammers could generate in excess of 3.5 million dollars annually. While most spam circulates via e-mail, the popularity of services like WhatsApp is giving spammers new resources to exploit people, and new ways to make money. Here’s a few ways spammers and cyber criminals are using WhatsApp to make money off users: Following Malicious Links: One way that cyber criminals use WhatsApp to scam people is to trick them into following malicious links. For example, a recent scam sent SMS messages to WhatsApp users telling them to follow a link to update the app. But the message was not from WhatsApp, and the link didn’t provide them with any kind of update. It signed them up for an additional service, and added a hefty surcharge to victims' phone bills. Sending Premium Rate Messages: Premium rate SMS sending malware was recently determined by F-Secure Labs to be the fastest growing mobile malware threat, and WhatsApp gives cyber criminals a new way to engage in this malicious behavior. Basically the users receive a message that asks them to send a response – “I’m writing to you from WhatsApp, let me know here if you are getting my messages”, “Get in touch with me about the second job interview”, and various sexual themed messages have all been documented. Responding to these messages automatically redirects your message through a premium rate service. Spanish police claim that one gang they arrested made over 5 million euros using this scheme – leaving everyday mobile phone users to foot the bill. Manipulating Web Traffic: A lot of spam tries to direct web traffic to make money off advertising. As you might imagine, this means they have to get massive numbers of people to look at the ads they’re using for their scams. Scammers use WhatsApp to do this by using the app to spread malware or social engineer large numbers of people to visit a website under false pretenses. F-Secure Labs found that people were being directed to a website for information on where they could get a free tablet. In March there was a global spam campaign claiming people could test the new WhatsApp calling feature. Both cases were textbook scams, and instead of getting new tablets or services, the victims simply wasted their time spreading misleading spam messages and/or exposing themselves to ads. WhatsApp and other services are great for people, but like any new software, requires a bit of understanding to know how to use. Hopefully these points give WhatsApp users a heads up on how they can avoid spam and other digital threats, so they can enjoy using WhatsApp to chat with their friends. [ Image by Julian S. | Flickr ]

May 8, 2015
BY