“2018: Banking Trojans came out to be the most prominent threat vector for mobile devices, witnessing a growth of 150 percent!”
For years, ransomware has been leading the list of threats in both the consumer and enterprise segments, but in the first half of 2018, Cryptojacking gained the throne.
Ransomware exists and has reappeared in recent months and proved that file encryption malware is going nowhere, and we have to face this danger in the long run. Further, there are a few newer versions of ransomware that update in complexity or are hiding, but fortunately, we cannot expect ransomware to return to those levels previously seen.
However, years ahead of 2019 will no longer be about ransomware, with new threats on the horizon. December is the forward period, and we intend to share our forecasts for next year.
Without further ado, let’s see some latest cybersecurity warns for 2019 (and beyond).
# The New Advent: Cryptojacking
Cryptojacking is a new member added to the family of mobile threats!
What is it?
Cryptojacking is a type of attack in which someone uses a device to extract cryptocurrency without the knowledge of the owner.
The cryptocurrency process uses your company’s devices for the benefit of another person. It relies heavily on its technology to do so – which means that affected phones will likely experience poor battery life, and could even be damaged due to overheating of the components.
Cryptojacking was evident over desktop devices but saw a monumental hike in mobile phones too, reaching the end of 2017. An analysis report of Skybox Security says that unwanted crypto mining accounted for one-third of all attacks in the first half of 2018, with a 70% increase in prominence during that period compared to the previous semester.
October and November of 2017 were exploded with the mobile-specific Cryptojacking attacks, where the proportion of affected devices accounted for 287%, an exponential growth.
Some Implementations to Secure Crucial Data
Despite the constant changes in technology made to strengthen cyberattacks, a few actions can be taken to protect private information.
- “Cryptojacking” attacks can be stopped if “miner-blocks” are used in internet browsers, there are extensions for most of them that can be easily installed.
- The impact of ransomware attacks can be avoided if there is a backup strategy for the files every day.
- Lack of proper education remains the first barrier of protection. Employee education should include examples of attacks that can potentially affect different departments and different roles. (You can run simulations of typical attacks, to measure the effectiveness of education.)
- Mass awareness must be spread via advertising, focusing on the primary threats along with their handy solutions.
- Smart, holistic data protection strategies must be embedded in smart devices that offer encryption, barriers, and backups for all your information, regardless of whether it resides in the cloud (cloud computing attacks), or on your physical servers.
[Prefered Reading: “Ways to Manage Cybersecurity Threats Relating to Cryptocurrency.”]
# IoT: A Boon with Threat Banes
“Data Exchange over the Internet comes with various security issues!
More attacks will target the Internet of Things (IoT) – smart – internet-connected devices, as we expect. As lawmakers around the world push for re-regulation of the area, attackers try to take full advantage of system weaknesses.
Hackers are increasingly skilled at taking power over internet-connected devices, baby monitors, cameras, and other home-based devices. Surprisingly today, even online medical devices are not safe.
Another major trend in IoT is that manufacturers are beginning to roll out mobile connectivity to their devices, with LTE instead of Wi-Fi and soon, 5G and IPv6 instead of IPv4. This opens up a whole new set of problems, as new technologies are largely unexplored from a security point of view.
Top 10 vulnerabilities in IoT 2019
- Use of weak or embedded passwords
- Unsafe network services
- Insecure interfaces in the IoT ecosystem
- Lack of secure update mechanisms
- Use of insecure or outdated components
- Insufficient privacy protection
- Lack of security in data storage and transfer
- Inadequate management of devices
- Default insecure settings
- Lack of physical bastions
# PUA (Potentially Unwanted Applications)
Potentially unwanted applications are not typical threats but are worth paying attention to because they come with the applications you intend to install.
Never Forget: There are infinite ways in which hackers can trick users to get their mobile devices infected, one such way is Rogue Apps; fake apps disguised as legitimate. These are the malicious apps that represent the biggest threat to the business world and enterprise mobility.
Unwanted applications are approaching malware. Given the increase in Android applications that abuse subscriptions and increasingly stealthy and aggressive adware, the report highlights how these and other potentially unwanted applications (PUA), such as browser add-ons, are becoming agents to deliver and run malware and file-less attacks.
Taking into account the YouTube Cryptojacking incident (in which attackers have exploited the computing power of unsuspecting viewers by using hidden mining code in advertising), we can predict the proliferation of web-based mining programs to be developed over many programming languages.
# The Continuity of macOS Attacks
Kaspersky Security Network: “1.8 million malware attacks registered on Macs in the first-half of 2019!”
These prevalent attacks intensify as Apple’s share of the PC market grows, and consequently raise the possibility of malware targeting Macs. The number of attacks targeting Mac users is expected to increase, as can be seen in the internal telemetry data.
According to the data, not only macOS-specific malware is being created, but also system-specific attack designs and tools that help monetize successfully attacked machines. We have previously seen examples of this in Mac-specific APTs.
Macros and Fileless Attacks Microsoft Office macro-based attacks are on the rise, both in number and in their objectives. As the old saying goes, the Office macro is not a bug, but a capability (it’s not a bug, it’s a feature), which is the perfect bait for social engineering attacks – when an attacker persuades a gullible victim to help with an operation. We expect file-free attacks to grow in number, using PowerShell or other programs already installed as a springboard, so they can bypass traditional security solutions.
#Fighting Invisible Dangers: Insecure Wi-Fi Networks
Network-level attacks are in the spotlight today and will continue to be beyond. News of them will spread nicely on social networks, which calls us to be aware of the threats and alerts 24/7 and take a wise action.
Undoubtedly, mobile phones are kept at an arm’s distance, and nobody nowhere gives up a chance to take advantage of free Wi-Fi available in the public zone, which further enhances the chances for easy accessibility of private information.
Newly bought smartphones or mobile phones on rent, smart laptops, or portable tablets, all of them are vulnerable to security threats, where cybercriminals can steal sensitive information from any of these e-devices and may even take full control over the crucial data.
One of the most dangerous ways to steal information is through false access points (evil twins). Cybercriminals make use of the same SSIDs in order to let the user connect to the network without any second thought and then steal the information.
Raising awareness among people about the posing risks of mobile cybersecurity is probably the main protection barrier:
- Do not connect to suspicious Wi-Fi networks.
- Never share or use sensitive information or financial data under Wi-Fi networks in public places.
- Be cautious of the suspicious networks, some networks may seem reputable but act as bait to catch you in.
# SMiShing:A Prevalent Threat
Smishing is popular as a common technique used by cybercriminals to commit fraud. The concept generally combines SMS plus phishing, which is a new way to lure people into divulging their private information or secret credentials channeled via text messages.
Although email is still the biggest threat, attack vectors are not solely confined to emails today. It currently involves attacks perpetrated through SMS (“smishing”) text messages, communications on social media platforms, such as LinkedIn, and even phone calls made by a human partner (“vishing“).
The Verizon 2019 Data Violation Investigation Report reveals that 32% of confirmed data violations were caused by phishing, a technique involved in 78% of cyber-espionage incidents.
We must be very careful today with our smartphones since there are also malicious viruses that will make us have a bad time stealing data, deleting the agenda … etc.
This report offers us very worrying data:
- A 460% increase in the number of malicious applications compared to 2018.
- 1.2 million malicious applications were registered by the first half of the year.
- In the second quarter of 2019, 673,000 malicious programs were detected.
The study reveals that more and more organizations were affected by all kinds of social engineering attacks. In one year, phishing increased from 76% to 83%; spear-phishing increased from 53% to 64%; vishing and/or smishing increased from 45% to 49%; and USB attacks increased to 4%, compared to 3% in 2018.
Ransomware attacks were accounted to be only 10%, confirming that apart from ransomware, there are many others in line which need a closer and a prompt look to avoid worsening the present situation.
‘Cyberattacks challenge cybersecurity every day, posing a great threat to all our data and lives.’
The above-mentioned risks backed by reports and surveys tell us one side of the story. There are infinite risks that we carry along with our e-devices, which need to be fenced around us by some robust defense systems.
Let the cybersecurity experts do their duty; at our end, let’s do the needful by being aware, alert, and proactive.
