Over 40% of online login attempts are attackers trying to invade accounts

As many as 43% of online login attempts globally are made by bots that are used for evil ends, as attackers are increasingly leveraging the automated tools for credential abuse, a report by Akamai has revealed.

Focusing on data for November, 2017, the content delivery network provider found that 3.6 billion out of 8.3 billion login requests during that month were malicious, specifically “attempts to log in to an account using password guessing or account details gathered from elsewhere on the Internet”.

A breakdown of the figures shows that the websites of retailers handled the highest number of login requests in November – 2.8 billion. “Only” 36% of them were intended to break into the accounts, according to Akamai’s Fourth Quarter 2017 State of the Internet / Security Report.

Meanwhile, the hospitality industry had to contend with the highest concentration of bad bots. A staggering 82% of nearly 1 billion login attempts on the websites of airlines, hotels and online travel agencies were found to be malicious.

Swarms of villain bots also swooped on the sites of high-tech businesses, with 57% out of 1.4 billion login attempts deemed malevolent.

The data was obtained by Akamai’s identifying “IP addresses that make multiple attempts to log into accounts using leaked credentials with no other activity to the target site”.

The data set covers mainly websites that use email addresses as login names. As a result, Akamai cautioned that the figures may understate the extent of the problem in industries in which email addresses are not used as user IDs, notably the financial industry.

Credential abuse attempts according to selected industries (Source: Akamai, Fourth Quarter 2017 State of the Internet / Security Report)

Bots that traverse the internet on behalf of their human operators can fulfill both legitimate and malicious automated tasks. Statistics indicate that bot-driven internet traffic, by helper and harmful bots combined, surpasses human traffic.

“Increased automation and data mining have caused a massive flood of bot traffic to impact websites and Internet services. Although most of that traffic is useful for Internet businesses, cybercriminals are looking to manipulate the powerful volume of bots for nefarious gains,” Akamai’s senior security advocate Martin McKeay is quoted as saying.

“Enterprises need to watch who is accessing their sites to differentiate actual humans from both legitimate and malicious bots. Not all web traffic and not all bots are created equal,” he added.

In an automated technique known as ‘credential stuffing’, criminals leverage stolen or leaked access credentials that belong to one account in order to break into other – often higher-value – accounts. This tactic has been found to pay dividends in anywhere between 0.1% and 2% of attempts, owing its success primarily to the fact that many netizens recycle their credentials across multiple accounts. Databases with reams of stolen username and password pairs can be easily bought online.

DDoS traffic

After several quarters of increases, the number of distributed denial-of-service (DDoS) attacks dropped by less than 1% in the fourth quarter of 2017 compared to the third quarter. On an annual basis, however, the attacks were up 14%, according to Akamai’s stats.

The gaming industry bore the brunt of the onslaughts, suffering 79% of all DDoS traffic. Germany and China between themselves accounted for the majority of source IP addresses involved in the attacks.

To say that DDoS attacks aren’t going anywhere would be an understatement, nor have we seen the last of Mirai. The notorious botnet, which took the internet by storm in the fall of 2016, remains alive and kicking. This is not least because of the proliferation of hackable Internet-enabled things, coupled with attackers continuing to adapt Mirai’s source code to befit their evil intentions.

Web app attacks

The number of web application attacks decreased by 9% following a quarter-over-quarter jump of 30% in the third quarter. They still rose by one-tenth compared to the last three months of 2016, however.

This type of threat most commonly involves scans to identify vulnerable sites with the ultimate aim of data thefts or other compromises. SQL injections, which Akamai highlighted as “easily automated and scalable”, accounted for one-half of web app attacks. On 36%, local file inclusion was the second-most-frequent attack vector.

The United States is by far both the top source and top target of web app attacks. The incursions that originate in the US soared by 31% compared to the last quarter of 2016.

 

 

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

 

About ESET

Founded in 1992, ESET is a global provider of security software for enterprises and consumers. ESET’s award-winning, antivirus software system, NOD32, provides real-time protection from known and unknown viruses, spyware, rootkits and other malware. ESET NOD32 offers the smallest, fastest and most advanced protection available, with more Virus Bulletin 100 Awards than any other antivirus product. ESET was named to Deloitte’s Technology Fast 500 five years running, and has an extensive partner network, including corporations like Canon, Dell and Microsoft. ESET has offices in Bratislava, SK; Bristol, U.K.; Buenos Aires, AR; Prague, CZ; San Diego, USA; and is represented worldwide in more than 100 countries. 

Privacy by Design: Can you create a safe smart home?

The Internet of Things (IoT) is, for many, about devices we connect to a network for convenience, such as thermostats, light switches, connected cars and interactive toys for our kids.

While the IoT is indeed a marvelous invention, designed to make daily digital life even easier, how safe is it in terms of protecting your privacy?

Alongside an ESET researcher team, I investigated some of the more popular IoT devices on the market today with the aim of creating a basic ‘smart home’ that mimics the connectable objects likely to be found in a typical household.

Notions of interconnectivity and the ‘smart home’ are now rarely seen as the main focus of science fiction narrative, but assumed as background. Today, the IoT makes the ‘smart home’ not only achievable, but in some respects commonplace.

But how plausible is it to create your own ‘smart home’? Many issues can crop up when trying to create your own interconnected dwelling space. One of the challenges facing even the most basic implementation of a ‘smart home’ is interoperability between devices provided by different manufacturers to provide a harmonious, unified experience… or as close as possible!

We purchased a few IoT devices that could be deemed as essential for the creation of a type of starter kit for anyone wanting the convenience of an interconnected experience in their home. We also purchased a virtual personal assistant (a device that takes verbal commands and can control many of the devices purchased; in fact, a ‘smart home’ may actually start with a device like this and then expand functionally with additional IoT devices).

Privacy concerns

The main area of concern was constructing a ‘smart home’ that did not compromise on privacy.

In that respect, there was unease that the devices in the home could potentially collect private data. Of course, we understood the need for most devices and services to collect basic personal details. Worryingly, however, we found that companies often used the term “but not limited to”, meaning they might collect more than what was on the applicable privacy policy.

In total, the team tested twelve products from seven vendors, including one product that we have not included in the final report due to discovery of significant vulnerabilities. As a security company, we value the commitment to responsible disclosure and the collaborative nature of the IT security industry — therefore, we notified the company in question with specific details of the device’s shortcomings and will not publish these details until the vendor has had time to rectify the issues.

While each device tested led to some privacy issues, it was the role of voice-activated intelligent assistants that raised the most concerns. This is due, among other things, to concerns the fear of oversharing of data by commercial services, insufficient protection of stored personal data, and the possibility of interception of digital traffic by cybercriminals or the mischievous.

Can you create a safe smart home?

The answer is… possibly. No device or software is guaranteed to be secure or immune to potential vulnerabilities. However, a company’s security culture can be judged based on its reaction to vulnerabilities when they are disclosed. Some of the devices tested had vulnerabilities that have been dealt with quickly with new software and firmware. When vulnerabilities are not fixed promptly (or at all), then choosing an otherwise equivalent device would be an appropriate response. But with sound judgement and caution, it is possible to start a basic ‘smart home’.

Conclusion

At its inception, the goal of this project was to create a basic ‘smart home’ that mimics something that could end up in typical household. The concern from our research team was “what if we don’t find any issues?” Alas, this was not the case, and in fact the conclusion that I have written is different from what we had envisioned at the start.

The potential for home, lifestyle, health and even browsing data collected by internet service providers to be available to a single entity should only be permitted after due consideration for the consequences.

A full list of the tested devices, along with a more technical breakdown of the products, may be found in the white paper: IoT and Privacy by Design in the Smart Home.

 

 

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

 

About ESET

Founded in 1992, ESET is a global provider of security software for enterprises and consumers. ESET’s award-winning, antivirus software system, NOD32, provides real-time protection from known and unknown viruses, spyware, rootkits and other malware. ESET NOD32 offers the smallest, fastest and most advanced protection available, with more Virus Bulletin 100 Awards than any other antivirus product. ESET was named to Deloitte’s Technology Fast 500 five years running, and has an extensive partner network, including corporations like Canon, Dell and Microsoft. ESET has offices in Bratislava, SK; Bristol, U.K.; Buenos Aires, AR; Prague, CZ; San Diego, USA; and is represented worldwide in more than 100 countries. 

Fighting persistent malware with a UEFI scanner, or ‘What’s it all about UEFI?”

The short answer to the headline’s question is that a UEFI scanner is all about helping you protect your computer against people who seek to take it over by abusing its Unified Extensible Firmware Interface (UEFI). A successful attack on a system’s UEFI can give the attacker complete control of that system, including persistence: the ability to secretly maintain unauthorized access to the machine despite rebooting and/or reformatting of the hard drive.

As you can imagine, this form of persistence is not a virtue and can prolong the pain and inconvenience of a malicious code infection. If your security software only scan drives and memory, without scanning UEFI, it is possible to think you have a clean machine when you don’t, that’s why we recommend a security solution that scans it, like ESET.

Why does my device have a UEFI?

Computing devices work by executing code: the instructions that we call software and which make the hardware – such as a laptop or smartphone – do something useful. Code can be fed to the device in several ways. For example, it can be read from storage on a disk, held in memory, or delivered via a network connection. But when you power on a digital device it has to start somewhere (bootstrap), and that first piece of code is typically stored in a chip on the device. This code, referred to as firmware, may include a “power-on self-test” or POST to make sure things are working correctly, followed by the loading into memory of the basic instructions for handling input and output.

If you’ve been into computers for a while you might recognize this chip-based code as BIOS or Basic Input Output System. In fact, BIOS technology dates back to the 1970s and so it is not surprising that it would eventually struggle to meet the demands of today’s computers, a point made by my colleague, Cameron Camp, in this excellent article on UEFI scanning. As Cameron details, UEFI technology has evolved to replace BIOS, although some devices still refer to it as BIOS. (I’m tempted to say “Meet the new BIOS, same as the old BIOS” but UEFI is signifcantly different, and besides, this article already has a headline that exploits a classic lyric: “What’s it all about, Alfie?”)

“FOR MOST PEOPLE, THIS IS THE RIGHT QUESTION TO BE ASKING, AND THE RIGHT ANSWER WILL DEPEND ON WHO YOU ARE”

Technically, UEFI is a specification, maintained by the Unified Extensible Firmware Interface Forum (uefi.org). According to the forum, the specification defines a new model for the interface between personal computer operating systems and platform firmware, and it “consists of data tables that contain platform-related information, plus boot and runtime service calls that are available to the operating system and its boot loader.” Without going into greater technical detail, UEFI added a great deal of functionality to the boot process, including some serious security measures (these are discussed in the  ESET white paper referenced by this article).

Unfortunately, the illicit benefits of devising code that can surreptitiously take over a system early in the boot process – generically referred to as a bootkit – are a powerful motivator to the folks who specialize in unauthorized access to digital devices. Such folks could be: cybercriminals; domestic and foreign agencies like NSA and CIA; and private companies that sell “surveillance tools” to governments.

For more details, check out the excellent article by my ESET colleague Cassius Puodzius that discusses these “threat actors” and their interest in UEFI. The broader topic of bootkit evolution from early days through 2012 is ably covered by ESET Senior Research Fellow, David Harley, in this article. You might also check out the paper “Bootkits, Past, Present, and Future”, presented at Virus Bulletin 2014. And of course there are plenty of technical papers on the UEFI Forum site.

So what’s my UEFI risk?

For most people, this is the right question to be asking, and the right answer will depend on who you are. For example, are you someone whose computer might be of interest to the NSA or CIA or other government entity that has the resources to invest in code that abuses UEFI, either its own code or a commercial surveillance product purchased from a commercial vendor? Are you using your computer to develop, review, or otherwise handle intellectual property worth stealing? If you answered either of those questions in the affirmative, then I would say you have an above average risk of encountering UEFI malware.

Currently, I am not aware of any large-scale, broadly-targeted criminal malware campaigns that exploit UEFI to attack the general public’s computer systems (if you know of any, please share the knowledge). However, even if you are not in a high risk category, I strongly suggest you still need security software with UEFI scanning capability. Why? Remember those three letter agencies that have been developing UEFI attacks? Well, they don’t have a stellar reputation for keeping their tools secret. In fact, the biggest news in malware so far this year has been WannaCryptor a.k.a. WannaCry, and one reason that particular ransomware spread so fast was because it used a “top secret” exploit developed by the NSA, an agency known to have dabbled in UEFI compromise.

In other words, we just don’t know when a new malware campaign that abuses UEFI to maintain persistence on compromised systems will appear in the wild. What I can say is that folks who are performing UEFI scans on a regular basis will be better prepared to protect their systems from future malware than people who are not. And that is what UEFI scanning is all about.

ESET latest endpoint security products now include an industry first UEFI scanning.

 

 

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

 

About ESET

Founded in 1992, ESET is a global provider of security software for enterprises and consumers. ESET’s award-winning, antivirus software system, NOD32, provides real-time protection from known and unknown viruses, spyware, rootkits and other malware. ESET NOD32 offers the smallest, fastest and most advanced protection available, with more Virus Bulletin 100 Awards than any other antivirus product. ESET was named to Deloitte’s Technology Fast 500 five years running, and has an extensive partner network, including corporations like Canon, Dell and Microsoft. ESET has offices in Bratislava, SK; Bristol, U.K.; Buenos Aires, AR; Prague, CZ; San Diego, USA; and is represented worldwide in more than 100 countries. 

免費防毒軟體的三大威脅

這幾年全球重大資安事件頻傳，世界容易遭受駭客病毒攻擊國家，香港、台灣一直也名列前茅，資安意識雖逐年抬頭，但心存僥倖的仍不少，這也是為什麼每次香港、台灣也都會無法幸免於難的主因，在與大家討論到底要使用免費防毒軟體還是付費防毒軟體前，想先問各位兩個簡單的問題，

您(公司)是否願意用很低的金額或無償交換您(公司)的隱私或財產，如個資及重要文件檔案等…，卻只能獲得基本的病毒防護？！

或

您(公司)會使用一個免費的鎖在您家的大門上，讓提供免費鎖的公司有鑰匙進入您的房子，還是您願意花小錢購買了全功能的鎖而只有您有鑰匙可以進入家門呢？！

我想答案已很清楚了，接下來跟大家分析使用免費防毒軟體及付費防毒軟體的差別，

1. 隱私/財產全都露

天下沒有白吃的午餐，這個道理人人都懂，絕大多數的防毒軟體都是由專業的資安公司所推出，它具有一定的開發以及維護成本，例如研發人員需要撰寫防毒軟體的程式，並且隨時收集最新的病毒資訊，還要發佈更新檔，以提升防毒軟體的防護能力。然而如果消費者選擇的是免費的防毒軟體，那麼這些成本是要如何回收呢？大家可以好好的思考一下….

之前時有所聞，免費的防毒軟體更改使用者條款，放寬使用者個人資料的使用限制，讓廠商可能可以將使用者的瀏覽器歷史記錄、搜尋記錄、GPS定位記錄等無法辨識個人身份的資料，出售給廣告商，用來作為廣告投放的參考依據。請問您在下載或使用這些軟體之前，是否都有仔細的閱讀這些相關的條約內容，還是想快點把軟體程式安裝完，就只是按「Yes」或「同意」；又如果軟體沒有繁體中文的說明，您是否也有耐下心來逐一閱讀呢。如果以上情況您都有的話，那麼”恭喜”您，您己經將您的隱私曝光在陽光下了。

結論：花小錢_即可確保你的隱私安全

2. 當災難發生時，只能坐以待斃

若您不幸遭受資安威脅侵害時，使用免費防毒軟體，則求救無門，只能花錢了事，以2017年讓人聞之色變的勒索病毒為例，通常會向受害者勒索價值 50 至 500 美金不等的贖金，並要求以比特幣付款，如果以美金 50 元來計算的話，大約等於港幣 400 元，已經比一般防毒軟體一年授權的費用還要高了，再加上您不幸被勒索的金額是美金 500 元的話，就等於需要支付港幣 4,000 元；好一點的是您付了錢，勒索者會提供解密金鑰，讓您拿回檔案，算是花錢消災。慘一點的，付了錢，檔案還是付之一炬。請問您是要省一時的小錢保護您的重要檔案資料，還是要花您無法預測且一定得支付的大錢呢? 建議您好好思考這個問題….

反觀，使用付費防毒軟體時，完整的防護功能或機制，除了協助您即時抵禦資安之威脅外，您還也可以跟在地團隊透過客服電話或請他們派專人至公司享受專業的資安服務，讓您或公司的損失可以降至最低。

結論：花小錢_即可享”網路安全”大效益，還能保護重要資料及享有在地且專業的資安團隊服務

3. 軟體或系統的漏洞的潛在資安威脅

天下沒有完美的事物，軟體會有Bug，就跟一般人會說錯話、寫錯字一樣，在所難免。不論是硬體或硬體的因素，系統只要出一次包，就可能影響成千上萬使用者。但其中執行的程式一旦有功能性的失誤，甚至有安全性漏洞，想要修正就沒那麼簡單，來來回回之間，往往耗費許多時間和人力進行。對許多IT人員來說，持續關注系統資安弱點資訊、定期執行漏洞修補，已經成為例行公事之一。從2001到2003年之間，開始有許多惡意程式利用Windows、IE、Outlook Express、Outlook的安全性弱點發動攻擊，肆虐全球個人電腦與伺服器，像是Code Red、Nimda、Blaster、Sasser等蠕蟲。

除了微軟，在個人電腦使用率相當高的數位內容格式Adobe PDF和Flash在2009年之後，也因為漏洞而頻頻遭到攻擊，到了2012年、2013年，Java成為新的苦主，再舉2017年「WanaCrypt0r 2.0」的勒索軟體攻擊感染，近乎所有 Windows 系統及其伺服器版本均受威脅，而這都在在證明知名及很多人在使用的軟體，是駭害的最愛，因為每次出手皆有斬獲，這真的不是危言聳聽。

以上所述，也都不是只具簡單及基本防護功能的免費防毒軟體所能解決的，因此對抗無法預期的軟體或系統漏洞所產生的已知或未知的資安威脅，選擇專業且知名的資安品牌或解決方案來做防護或抵禦是很重要的。

結論：花小錢_買專業知名的資安產品或解決方案，方能高枕無憂

 

 

關於Version 2 Limited

Version 2 Limited是亞洲最有活力的IT公司之一，公司發展及代理各種不同的互聯網、資訊科技、多媒體產品，其中包括通訊系統、安全、網絡、多媒體及消費市場產品。透過公司龐大的網絡、銷售點、分銷商及合作夥伴，Version 2 Limited 提供廣被市場讚賞的產品及服務。Version 2 Limited 的銷售網絡包括中國大陸、香港、澳門、台灣、新加坡等地區，客戶來自各行各業，包括全球1000大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

 

關於ESET

ESET成立於1992年，是一家面向企業與個人用戶的全球性的電腦安全軟件提供商，其獲獎產品 — NOD32防病毒軟件系統，能夠針對各種已知或未知病毒、間諜軟件 （spyware）、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少，偵測速度最快，可以提供最有效的保護，並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”（Deloitte’s Technology Fast 500）公司，擁有廣泛的合作夥伴網絡，包括佳能、戴爾、微軟等國際知名公司，在布拉迪斯拉發（斯洛伐克）、布里斯托爾（英國 ）、布宜諾斯艾利斯（阿根廷）、布拉格（捷克）、聖地亞哥（美國）等地均設有辦事處，代理機構覆蓋全球超過100個國家。 

ESET boosts value proposition for MSPs via new direct plug-in with ConnectWise

ESET today announced the launch of ESET Direct Endpoint Management with ConnectWise, a company that transforms how technology solution providers build, manage, and grow their businesses. The new Remote Management and Monitoring (RMM) plug-in for ConnectWise Automate speeds up and improves installation processes of ESET endpoints for the company’s Managed Service Providers (MSPs).

ESET Direct Endpoint Management establishes a direct connection between ESET endpoints and the ConnectWise Automate console. Built with the ConnectWise equipped partner in mind, the plug-in leverages the existing ConnectWise Agent to simplify deployment and management without sacrificing on performance or functionality.

While ESET currently offers a plug-in that connects ESET Remote Administrator (ERA) and ConnectWise Automate, this new version does not require MSPs to install ERA at all, meaning there are no additional servers or intermediate console to manage.  MSPs can get up and running faster, and stay running with fewer issues caused by complex integration. 

“We’ve had a strong relationship with ESET for many years, and from working with them, we know that we are partnering with a proven and reliable technology company,” said Travis Vigneau, director of channel sales and alliances for ConnectWise. “This new direct plug-in demonstrates ESET’s commitment to constantly improving what they offer to the entire ecosystem.”

“We understand how important our MSPs are and we want to help them overcome any challenges they may face,” said Jeronimo Varela, Director of Global Sales at ESET. “That’s why we’ve focused on developing the very best tools, with world-class protection solutions, to not only ensure our MSPs can deliver top-quality service efficiently, but also so that they can become trusted advisors to their customers.”

To find out more about ESET’s MSP program, please click here.

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET

Founded in 1992, ESET is a global provider of security software for enterprises and consumers. ESET’s award-winning, antivirus software system, NOD32, provides real-time protection from known and unknown viruses, spyware, rootkits and other malware. ESET NOD32 offers the smallest, fastest and most advanced protection available, with more Virus Bulletin 100 Awards than any other antivirus product. ESET was named to Deloitte’s Technology Fast 500 five years running, and has an extensive partner network, including corporations like Canon, Dell and Microsoft. ESET has offices in Bratislava, SK; Bristol, U.K.; Buenos Aires, AR; Prague, CZ; San Diego, USA; and is represented worldwide in more than 100 countries. 

About ConnectWise

ConnectWise transforms how technology solution providers successfully build, manage and grow their businesses. Our award-winning set of software solutions provides a fully integrated, seamless experience to companies in more than 50 countries, giving them the ability to increase their productivity, efficiency and profitability. When combined with our relentless commitment to innovation, powerful network of ideas and experts, unparalleled passion for our users, and more than 35 years of experience, ConnectWise software solutions deliver the support companies want at each step of their business journey. For more information, visit www.ConnectWise.com.