Paris Wi-Fi Security Study | Kaspersky official blog

/in

The upcoming Paris Olympics — the world’s biggest sporting event since pandemic restrictions were lifted — are expected to attract over 15 million tourists to Paris — which is something scammers are already actively preparing for. Almost certainly, each of these tourists/spectators will need access to the internet, and this is where public Wi-Fi hotspots come to the rescue. However, this approach has its risks: cybercriminals may use public access points to intercept your data.

On the eve of the Olympics, our researchers have mapped and assessed the security of the open Wi-Fi networks that visitors might use. We’ve analyzed around 25,000 public Wi-Fi hotspots in Paris, and found that every fourth one is unsafe — making their users vulnerable to personal and banking data theft. For how to safely use Wi-Fi during the Paris Olympics — read on…

Heat map of all the examined public access points in Paris. Red indicates a high concentration of hotspots; green — a low concentration

What we found out

In total, we recorded 47,891 signal records from 24,766 unique Wi-Fi access points across popular locations and Olympic venues in Paris. Around 25% (6083) of the examined Wi-Fi hotspots turned out to have serious security weaknesses — such as weak or nonexistent encryption, use of outdated devices and protocols, or misconfiguration — making them vulnerable to interception, decryption, or cracking attacks.

Not all of these hotspots are accessible to all passersby; to connect to some, you need to enter a password or PIN. However, in general, we classified as unsafe both completely open networks without any protection (we found 3176 of them), as well as those that are either misconfigured or use compromised protocols and are easily hacked using widely-known algorithms.

This means that when using such access points, users are at great risk: without reliable protection, cybercriminals can steal passwords, banking data and other personal information of users.

How many Wi-Fi points use WPS and WPA3?

Approximately 20% (4864) of the public Wi-Fi access points we investigated in Paris use the notoriously vulnerable WPS protocol, which is outdated and easily compromised. This makes them susceptible to WPS attacks, which can lead to data loss.

And below just 6% (1373) of all the hotspots are protected by the modern WPA3 security protocol, which has built-in protection against brute-force attacks, individual data encryption, and other features that make Wi-Fi access points secured by this protocol safe.

This result is disappointing. The main problems we found are either the incorrect configuration of access points (making them vulnerable to attacks), or the use of outdated equipment that doesn’t support modern security standards and protocols.

How we researched

Experts from Kaspersky’s GReAT (Global Research and Analysis Team) swapped their office chairs for benches, cafes, parks, and other public spaces in Paris for several days — all to study the most popular places in the city that Olympic spectators are likely to visit:

Arc de Triomphe
Champs-Élysées
The Louvre
The Eiffel Tower
Notre-Dame
The Seine River embankments
The Trocadéro
Stade de France

Heat map showing the distribution of both safe and unsafe public access points in Paris. Red indicates a high concentration of unsafe hotspots; green — safe ones

From a Wi-Fi security standpoint, leading the way are the embankments along the Seine. However, in and around the Trocadéro, it’s better to walk around without connecting to public Wi-Fi. The same goes for the Champs-Élysées and the Arc de Triomphe, where there are usually a great many folks milling about — even without the Olympics being on — so it’s worth keeping an eye on both your digital and physical safety (for the latter — e.g., against pickpocketing). We, of course, will help maintain the confidentiality of your digital identity, but we can do nothing if someone tries to steal your smartphone. Although with the help of Kaspersky: Antivirus & VPN it’s easy to find a lost Android smartphone.

The Olympics will start at the Stade de France, where there are also many unsafe Wi-Fi access points. There are unprotected networks both right next to the stadium and in the surrounding area, so be careful whenever you want to post something directly from the stadium.

Connecting to Wi-Fi near the stadium is likely unsafe

What’s the result

Thus, 25% of (central) Parisian Wi-Fi access points are unsafe — including both open ones and those that require a password or PIN to connect. Moving around the city, you’ll be constantly switching between available hotspots. So how can you use public Wi-Fi and not worry about your digital security?

It’s difficult to determine on your own how dangerous a particular Wi-Fi access point is — of course, except for open hotspots without any protection, connecting to which is definitely unsafe. Therefore, when using any public access point, it’s necessary to protect your Wi-Fi connection with a VPN.

If you’re in dire need of a VPN service to protect your connection but don’t want to pay for one, consider using the free version of Kaspersky VPN Secure Connection. Free mode won’t allow you to select a server, plus there’s a traffic limit of 300 MB per day, but both your traffic and your device are fully secure.

The better option of course is to buy a subscription; after all, a reliable VPN is a must-have app for absolutely everyone — and has been for some time. Premium access to Kaspersky VPN Secure Connection — available as a standalone purchase or as part of our Kaspersky Plus and Kaspersky Premium subscriptions — grants you access to one of the fastest VPNs in the world across all your devices, along with top-rated protection against phishing and other threats, as verified by independent researchers.

Best of all, you can enjoy a 30-day free trial of these subscriptions and experience the full functionality of our protection and VPN for free during the Olympics. Of course, it’s better to download the applications in advance over a secure connection.

If your device doesn’t have a VPN installed and you’re forced to connect to public Wi-Fi in Paris (or any other city), follow these rules:

Do not pay for purchases online: your banking data can be intercepted
Do not transmit any important information without a secure connection
Do not log into personal accounts that aren’t protected by two-factor authentication (2FA)
Use only strong passwords and store them securely
Disable file sharing and AirDrop (if you have it) on your devices to prevent unauthorized access to your files
Enable the firewall on your laptop
Regularly update the operating system and applications on all your devices to patch new vulnerabilities

But it’s much easier to use maximum protection on all your devices, which will keep your digital identity safe even in another country. And don’t forget to subscribe to our blog and/or Telegram channel: take care of your digital safety today!

Kaspersky official blog – ​Read More

Impact of Microsoft Copilot+ Recall on corporate cybersecurity

/in

Throughout May and June, the IT world watched the unfolding drama of Copilot+ Recall. First came Microsoft’s announcement of the “memory” feature named Recall that takes screenshots of everything happening on a computer every few seconds and extracting all useful information into a shared database. Then, cybersecurity researchers criticized Recall’s implementation by exposing security flaws and demonstrating the potential for data exfiltration — including of the remote kind. This forced Microsoft to backpedal: first stating the feature wouldn’t be enabled by default and promising improved encryption, and then delaying the mass rollout of Recall entirely — opting to first test it in the Windows Insider Program beta. Despite this setback, Redmond remains committed to the project and plans to launch it on a broad range of computers — including those with AMD and Intel CPUs.

Within the context of devices in the workplace — especially if a company allows BYOD — Recall clearly violates corporate data retention policies and significantly amplifies potential damage if a network is compromised by infostealers or ransomware. What’s more concerning is the clear intention of Microsoft’s competitors to follow this trend. The recently announced Apple Intelligence is still shrouded in marketing language, but the company claims that Siri will have “onscreen awareness” when processing requests, and text-handling tools available across all apps will be capable of both local or ChatGPT-powered processing. While Google’s equivalent features remain under wraps, the company has confirmed that Project Astra — the visual assistant announced at Google I/O —  will eventually find its way onto Chromebooks, utilizing screenshots as the input data stream. How should IT and cybersecurity teams prepare for this deluge of AI-powered features?

Risks of visual assistants

We previously discussed how to mitigate the risks of unchecked ChatGPT and other AI assistants’ usage by employees in this article. However, there we focused on the deliberate adoption of additional apps and services by employees themselves — a new and troublesome breed of shadow IT. OS-level assistants present a more complex challenge:

The assistant can take screenshots, recognize text on them, and store any information displayed on an employee’s screen — either locally or in a public cloud. This occurs regardless of the information’s sensitivity, current authentication status, or work context. For instance, an AI assistant could create a local, or even cloud-based, copy of an encrypted email requiring a password.
Captured data might not adhere to corporate data-retention policies; data requiring encryption might be stored without it; data scheduled for deletion might persist in an unaccounted copy; data meant to remain inside the company’s perimeter might end up in a cloud — potentially under an unknown jurisdiction.
The problem of unauthorized access is exacerbated since AI assistants might bypass additional authentication measures implemented for sensitive services within an organization. (Roughly speaking, if you need to view financial transaction data, even after being authorized in the system you need to enable RDP, raise a certificate, log in to the remote system, and enter the password again — or you could simply view it through an AI assistant such as Recall.)
Control over the AI assistant by the user and even IT administrators is limited. Accidental or deliberate activation of additional OS functions at the manufacturer’s command is a known issue. Essentially, Recall, or a similar feature, could appear on a computer unexpectedly and without warning as part of an update.

Although all the tech giants are claiming to be paying close attention to AI security, the practical implementation of security measures must stand the test of reality. Microsoft’s initial claims about data being processed locally and stored in encrypted form proved inaccurate, as the encryption in question was in fact a simple BitLocker, which effectively only protects data when the computer is turned off. Now we have to wait for cybersecurity professionals to assess Microsoft’s updated encryption and whatever Apple eventually releases. Apple claims that some information is processed locally, some within their own cloud using secure computing principles without storing data post-processing, and some — transmitted to OpenAI in anonymized form. While Google’s approach remains to be seen, the company’s track record speaks for itself.

AI assistant implementation policies

Considering the substantial risks and overall lack of maturity in this domain, a conservative strategy is recommended for deploying visual AI assistants:

Collaboratively determine (involving IT, cybersecurity, and business teams) which employee workflows would benefit significantly from visual AI assistants to justify the introduction of additional risks.
Establish a company policy and inform employees that the use of system-level visual AI assistants is prohibited. Grant exceptions on a case-by-case basis for specific uses.
Take measures to block the spontaneous activation of visual AI. Utilize Microsoft group policies and block the execution of AI applications at the EDR or EMM/UEM level. Keep in mind that older computers might not be able to run AI components due to technical limitations, but manufacturers are working to expand their reach to previous system versions.
Ensure that security policies and tools are applied to all devices used by employees for work — including personal computers.
If the first-stage discussion identifies a group of employees that could significantly benefit from visual AI, launch a pilot program with just a few of these employees. IT and cybersecurity teams should develop recommended visual assistant settings tailored to employee roles and company policies. In addition to configuring the assistant, implement enhanced security measures (such as strict user authentication policies and more stringent SIEM and EDR monitoring settings) to prevent data leaks and protect the pilot computers from unwanted/malicious software. Ensure that the available AI assistant is activated by an administrator using these specific settings.
Regularly and thoroughly analyze the pilot program’s group performance compared to a control group, along with the behavior of company computers with the AI assistant activated. Based on this analysis, decide whether to expand or discontinue the pilot program.
Appoint a dedicated resource to monitor cybersecurity research and threat intelligence regarding attacks targeting visual AI assistants and their stored data. This will allow for timely policy adjustments as this technology evolves.

Kaspersky official blog – ​Read More

Scams at the Paris Olympics | Kaspersky official blog

/in

For athletes, the Olympics are the pinnacle of a lifetime’s work. Many train for decades to one day perform under their nation’s flag and sing its anthem far from home. For scammers, it’s much simpler: the Olympics are just another opportunity to cash in on unsuspecting individuals.

Today we tell you how scammers have prepared for the Paris Olympics, how they plan to steal money and personal data from sports fans, and what you need to know to follow your favorite athletes safely.

Olympic-sized data plan

The Paris Olympics kick off on July 26, and French media predict a temporary population explosion with 15.3 million visitors. Naturally, tourists from other countries always want to stay connected, and… who comes to their “aid”? Scammers, of course, armed with a too-good-to-be-true offer — 48GB of supposedly free internet, regardless of your carrier.

48GB of free cheese

Let’s do the math: a standard mobile plan with 40GB of internet and unlimited calls in France costs around €11 (roughly $12USD). Given the number of expected tourists, the cost of providing free internet to all would exceed €168 million (approximately $184 million USD). No telecom company is giving away that much data allowance — after all, many of these visitors will never return to France.

But who’s got the time to think about that when the offer is so tempting, and the Parisian atmosphere is so intoxicating? Alas, after registering and filling out all the forms, the tourist won’t get a single free megabyte, and they may only realize this too late when their phone account runs out of money. At the same time, they’ll have given the scammers their phone number, personal and banking details, and confirmation that they’ll be far from home, watching the Olympics in Paris — and therefore probably won’t be closely monitoring their banking transactions.

Don’t forget your ticket… and scarf!

What are the first things Olympic spectators want? Tickets to the Games, of course. Just in time for the Paris Olympics, scammers have built a network of fake ticket-sales websites. Archery? You bet! Soccer? Naturally. Badminton? Don’t even ask! They’ve got it all covered! To appear legitimate, the scammers have even added pop-ups requesting consent to collect personal data and use web tracking, complete with links to their own “privacy policies” — so the unsuspecting victim also agrees to sharing their data with the scammers!

This fraudulent site “selling” tickets to Olympic events even asks for permission to collect personal data, and has its own privacy policy

The platform offers not only to buy tickets, but also to sell them — just in case you decide to watch rhythmic gymnastics instead of soccer. This way, the scammers can extend their reach to those who’ve bought tickets in advance but changed their plans.

But at least you can safely buy Olympic merch, right? Nope, another trap awaits there too: for fans of cheap merch, scammers have a special gift — phishing websites. Keychains, commemorative coins, magnets, and scarves — scammers offer it all, and at great prices.

Fake store website saying you can return any item you don’t like within 90 days — you just need to receive it first; good luck with that!

Of course, no actual merch — neither official nor even counterfeit — is ever shipped. Buyers are left with nothing but empty wallets and compromised data.

Don’t let scammers win the gold

The best way to protect yourself is a combination: Kaspersky Premium will protect you from phishing links and other online threats, while your own attentiveness, awareness of common scams, and knowledge of how to avoid them will tackle the rest.

Don’t buy tickets from unofficial sources. Stick to the official Olympics website.
Use a virtual card with a spending limit for any online purchases — especially if you’re not 100% sure of the site’s legitimacy.
Turn on two-factor authentication wherever possible. This helps keep your accounts and money safe — particularly if you’re worried you might have entered your details on a phishing site. By the way, you can store 2FA tokens in Kaspersky Password Manager.
Be wary of gifts from strangers. Getting 48GB of free internet sounds great but it really is too good to be true.
Follow our Telegram channel to stay up to date on the latest cybersecurity news.

Kaspersky official blog – ​Read More

Global outage of Microsoft clients due to CrowdStrike update | Kaspersky official blog

/in

Ever heard the unspoken rule: “Never release on Friday”? We have, but CrowdStrike hasn’t. They released a tiny driver on an ordinary Friday morning, which became the cause of a huge outage all over the world.

An incorrect update for CrowdStrike’s EDR (Endpoint Detection and Response) solution has affected Windows devices around the world — giving corporate users the Blue Screen of Death (BSOD). The failure has affected, for example, airport information systems in the US, Spain, Germany, the Netherlands and other countries.

Who else was affected by CrowdStrike’s Friday release and how to roll back bricked computers — all in this post…

What happened

It all started early Friday morning with corporate users around the world reporting problems with Windows. At first, a glitch in Microsoft Azure was blamed, but later CrowdStrike confirmed that the root cause was in the csagent.sys or C-00000291*.sys driver for its CrowdStrike EDR. And it was this driver that caused an abundance of silly office photos showing off the (dreaded) blue screens.

Blue screen of death on all computers = a day off for airport linemen

If we wanted to list everyone affected by this outage, such a list sure wouldn’t fit into this post – or dozens of them. So instead we’ll briefly cover the main victims of CrowdStrike’s negligence. Airline companies, airports, and people who want to either go home or go off on a long-awaited vacation were the most affected:

London’s Heathrow Airport, like many others, announced flight delays due to a technology glitch;
Scandinavian Airlines posted a notice on its website saying, “Some customers may experience difficulties with their bookings due to an IT issue affecting several countries. SAS is fully operational but delays are expected”;
In New Zealand, banking, communications and transportation systems are experiencing problems.

Various medical centers, chain stores, the New York subway, the largest bank in South Africa and many other organizations that make lives more comfortable and convenient on a daily basis were affected. The fullest list of those affected by the outage we can find is here — and it’s growing by the minute.

How to fix it

At this stage, it’s rather problematic estimating how long it’ll take to fully restore the affected computers around the world. Things are complicated by the fact that users need to manually reboot their computers in Safe Mode. And in large corporations, this is usually impossible to do on your own without the help of a system administrator.

Nevertheless, here are the instructions for how to get rid of the blue screen of death caused by the CrowdStrike driver update:

Boot your computer in Safe Mode;
Go to C:WindowsSystem32driversCrowdStrike;
Locate and delete the csagent.sys or C-00000291*.sys file;
Restart your computer in normal mode.

And while your sysadmins are doing this, you could use a hack that’s come out of India today: employees of one of the country’s airports have started filling out boarding passes… manually.

India isn’t too worried about the global disruption. Source

How the failure could have been avoided

Avoiding this situation should have been straightforward. First, the update shouldn’t have been released on a Friday. This is as per a rule that’s been known to all in the industry since the year dot: if an error occurs, there’s too little time to fix it before the weekend, so the system administrators at all companies affected need to work over the weekend to fix things.

It’s important to be as responsible as possible about the quality of updates released. We at Kaspersky launched a program back in 2009 to prevent mass failures such as this one at our customers, and passed an SOC 2 audit, which confirms the security of our internal processes. For 15 years now, every update has been subjected to multi-level performance testing on various configurations and operating system versions. This allows us to identify potential problems in advance and resolve them on the spot.

The principle of granular releases should be followed. Updates should be distributed gradually, not all at once to all customers. This approach allows us to react instantly and stop an update if necessary. If our users have a problem, we register it, and its solution becomes a priority at all levels of the company.

As with cybersecurity incidents, in addition to fixing the visible damage, you need to find the root cause to prevent these types of problems repeating in the future. It’s necessary to check software updates on test infrastructure for operability and errors before rolling them out to the company’s “combat” infrastructure, and to implement changes gradually — continually monitoring for possible failures.

Incident handling should be based on an integrated approach to building protection from a trusted supplier with the strictest internal requirements for the security, quality and availability of its services. The basis for this work can be the Kaspersky Next line of solutions. This will help your company not only stay afloat — but also increase the efficiency of your information security system. This can be done either gradually — increasing protection step by step — or all in one go. Protect your infrastructure today with us so that the next global outage doesn’t affect your customers.

And we, for our part, can help you make this decision: switch to Kaspersky and unlock two years of Kaspersky Next EDR Optimum for the price of one. Experience the pinnacle of robust, reliable cybersecurity protection!

Kaspersky official blog – ​Read More

Transatlantic Cable podcast episode 356 | Kaspersky official blog

/in

Episode 356 of the Transatlantic Cable Podcast kicks off with news around the AT&T ‘mega-breach’. From there the team discuss two stories related to AI – the first looks at how AI is being used to help doctors detect early-onset Alzheimer’s; the team then talk about how K-Pop are looking to use artificial intelligence to write songs and create artwork.

The final story discusses how legendary artist Bob Dylan has banned smart-phones in his upcoming gigs – just how that will pan out is anybody’s guess.

If you liked what you heard, please consider subscribing.

AT&T says hackers stole records of nearly all cellular customers’ calls and texts
New AI tool could be game-changer in battle against Alzheimer’s
Will K-pop’s AI experiment pay off?
Bob Dylan to bring ‘phone-free’ tour to Edinburgh

Kaspersky official blog – ​Read More

Intimate image abuse – Kaspersky new survey indicates alarming trends | Kaspersky official blog

/in

In today’s digital age, our social and romantic interactions are increasingly online, and the normalization of both storing and sharing intimate images has reached concerning levels. Our recent global study – one of the largest polls ever conducted on this matter – reveals some alarming trends, and highlights the urgent need for both awareness and education on intimate image abuse, commonly known as “revenge porn”.

The digital age of intimacy

Nearly a quarter of the people surveyed in our poll have explicit images saved on their devices – with the highest rates among younger age groups. Specifically, 34% of 16–24-year-olds and 25–34-year-olds admitted storing such images. Additionally, 25% of respondents have shared intimate images with people they’re dating or chatting with online – with this figure rising to 39% among 25–34-year-olds.

Despite the widespread sharing of intimate images, only 21% of those who’ve shared an image requested its deletion from the recipient’s device. This statistic highlights a troubling lack of awareness about the long-term consequences of sharing intimate images.

The dark side of image sharing

The study also exposes a darker side of intimate image sharing. Shockingly, 8% of those who’ve shared nude or explicit material admitted to doing so for revenge, and 9% – to frighten others. Nearly half of all respondents reported that they’ve either experienced intimate image abuse themselves, or know someone who has. This issue is particularly pronounced among younger generations, with 69% of 16–24-year-olds and 64% of 25–34-year-olds reporting such experiences.

Aaliyah’s story is a stark reminder of this reality; her ex-partner maliciously shared her intimate images online, causing severe emotional and psychological impacts.

Victim blaming: a harmful misconception

One of the most disturbing findings of our study is the prevalence of victim blaming. Precisely half of the respondents believe that if you share an intimate image of yourself, it remains your fault if it ends up in the wrong hands. This harmful misconception contributes to the stigma and isolation victims feel, making it harder for them to seek help and support.

We need to emphasize this: if someone shares your intimate images without your consent, it’s not your fault. The blame lies solely with those who misuse and exploit these images and, by definition – your trust. Alice’s story illustrates this perfectly. After her partner’s death, she found intimate images of herself online — images that were secretly taken while she was sleeping, highlighting that the real culprit is the one who takes and shares these images without explicit permission.

No one should have to suffer the emotional and psychological harm caused by intimate image abuse, and it’s crucial that we all work to change the narrative around this issue.

Protect yourself online

To protect yourself from intimate image abuse, consider the following tips:

Think before you post: be mindful of who you share your data with, and consider the potential risks;
Use secure messengers: opt for messaging services with end-to-end encryption;
Report abuse: if you believe you’re a victim of intimate image abuse, keep evidence and report it to the police and the respective platforms;
Check permissions: regularly review the permission settings on your apps to control data sharing;
Use strong passwords: employ a reliable security solution to create and manage unique passwords for each account;
Utilize resources: take advantage of tools like StopNCII.org to help prevent intimate images being shared online without your consent;
Find an organization in your country to provide you with further support.

The findings from our study make it clear that, while technology has made intimate image sharing easier, it has also increased the risk of abuse. Awareness and education are crucial in mitigating these risks and protecting individuals from the emotional and reputational harm associated with intimate image abuse.

For more information and resources, subscribe to our Telegram channel, and visit our blog and the revenge porn helpline in your country.

Kaspersky official blog – ​Read More

Hidden dangers of free VPN services | Kaspersky official blog

/in

Regarding VPNs, a popular refrain these days goes something like: “Why bother paying for a VPN when there are tons of free ones out there?” But are free VPN services truly free? This post explains why thinking they are is misguided, and offers the optimal solution: one of the fastest and most secure VPN apps on the planet.

First there was: “There’s no such thing as a free lunch” — dating back to the 1930s. In this century, that old adage was updated and adapted for the digital age: “If you’re not paying for the product, you are the product”. Today this new axiom applies to many internet services — but especially to VPNs. After all, maintaining a network of servers across the globe, and handling encrypted traffic for thousands, if not millions of users comes at a significant cost. And if the user isn’t explicitly asked to pay for such services, there’s bound to be a catch somewhere. And that “somewhere” was recently vividly demonstrated by a couple of major incidents…

Freebie VPN and a botnet of 19 million IP addresses

In May 2024, the FBI, together with law enforcement partners, dismantled a botnet known as 911 S5. This malicious network spanned 19 million unique IP addresses across over 190 countries worldwide, making it possibly the largest botnet ever created.

But what does a gargantuan botnet have to do with free VPNs? Quite a lot actually, since the creators of 911 S5 used several free VPN services to build their brainchild; namely: MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN. Users who installed these apps had their devices transformed into proxy servers channeling someone else’s traffic.

In turn, these proxy servers were used for various illicit activities by the real clients of the botnet — cybercriminals who paid the organizers of 911 S5 for access to it. As a result, users of these free VPN services became unwitting accomplices in a whole host of crimes — cyberattacks, money laundering, mass fraud, and much more — because their devices were sucked into the botnet without their knowledge.

911 S5 botnet proxy rental prices Source

The 911 S5 botnet began its nefarious operations way back in May 2014. Disturbingly, the free VPN apps it was built upon had been circulating since 2011. In 2022, law enforcers managed to take it down for a while, but it resurfaced a mere few months later under a new alias: CloudRouter.

Finally, in May 2024, the FBI succeeded in not only dismantling the botnet infrastructure but also apprehending the masterminds, on which note the 911 S5 saga will likely end. During its operation, the botnet is estimated to have earned its creators a cool $99 million. As for the losses to victims — at least, just the confirmed ones — they amount to several billion dollars.

The FBI seized the website of PaladinVPN —one of the free VPN apps used to build the 911 S5 botnet

Infected VPN apps on Google Play

While the 911 S5 case is undoubtedly one of the largest botnet, it’s far from an isolated incident. Literally a couple of months before, in March 2024, a similar scheme was uncovered involving several dozen apps published on Google Play.

Though among them there were other apps too (such as alternative keyboards and launchers), free VPNs constituted the bulk of the infected ones. Here’s the full list:

Lite VPN
Byte Blade VPN
BlazeStride
FastFly VPN
FastFox VPN
FastLine VPN
Oko VPN
Quick Flow VPN
Sample VPN
Secure Thunder
ShineSecure VPN
SpeedSurf
SwiftShield VPN
TurboTrack VPN
TurboTunnel VPN
YellowFlash VPN
VPN Ultra
Run VPN

Oko VPN and Run VPN before being removed from Google Play Source

There were two modes of infection. Earlier versions of the apps utilized the ProxyLib library to transform devices on which the infected apps were installed into proxy servers. More recent versions employed an SDK called LumiApps, offering developers monetization by showing hidden pages on the device, but in reality doing the exact same thing — turning devices into proxy servers.

Just like in the previous case, the organizers of this malicious campaign sold access to proxy servers installed on user devices with the infected apps to other cybercriminals.

After the report was published, the infected VPN apps were, of course, removed from Google Play. However, they continue to circulate in other places; for example, they’re sometimes published in several different incarnations under different developer names in the popular alternative app store APKPure (which was infected with a Trojan a few years ago).

Oko VPN, one of the infected VPN apps booted out of Google Play, exists in multiple versions on the alternative platform

What to do if you really need a VPN

If you’re in dire need of a VPN service to protect your connection but don’t want to pay for one, consider using the free version of [placeholder ksec]. Free mode won’t allow you to select a server, plus there’s a traffic limit of 300 MB per day, but both your traffic and your device are fully secure.

The better option of course is to buy a subscription; after all a reliable VPN is a must-have app for absolutely everyone — and has been for some time. Premium access to Kaspersky VPN Secure Connection, available as a standalone purchase or as part of our Kaspersky Plus and Kaspersky Premium subscriptions, grants you access to one of the fastest VPNs in the world across all your devices, along with top-rated protection against phishing and other threats, as verified by independent researchers.

Best of all, you can enjoy a 30-day free trial of these subscriptions and experience the full functionality of our protection and VPN; that way, you can see for yourself how our VPN is one of the world’s speediest.

Kaspersky official blog – ​Read More

Zero-day vulnerability in Internet Explorer | Kaspersky official blog

/in

As part of its latest Patch Tuesday, Microsoft has released patches for 142 vulnerabilities. Among them were four zero-day vulnerabilities. While two of them were already publicly known, the other two had been actively exploited by malicious actors.

Interestingly, one of these zero-days, which supposedly had been used to steal passwords for the past 18 months, was found in Internet Explorer. Yes — that same browser that Microsoft stopped developing back in 2015 and promised to definitively, absolutely, for-sure bury in February 2023. Unfortunately, the patient proved to be stubborn — resisting its own funeral.

Why Internet Explorer isn’t nearly as dead as we would all like

Last year, I wrote about what the latest attempt to kill off Internet Explorer actually entailed. I’ll just give a brief version here; you can find the full story at the link. With the “farewell” update, Microsoft didn’t remove the browser from the system but merely disabled it (and even then, not in all versions of Windows).

In practice, this means that Internet Explorer is still lurking within the system; users just can’t launch it as a standalone browser. Therefore, any new vulnerabilities found in this supposedly defunct browser can still pose a threat to Windows users — even those who haven’t touched Internet Explorer in years.

CVE-2024-38112: vulnerability in Windows MSHTML

Now let’s talk about the discovered vulnerability CVE-2024-38112. This is a flaw in the MSHTML browser engine, which powers Internet Explorer. The vulnerability has a rating of 7.5 out of 10 on the CVSS 3 scale, and a “high” severity level.

To exploit the vulnerability, attackers need to create a malicious file in an innocent-looking internet shortcut format (.url, Windows Internet Shortcut File), containing a link with the mhtml prefix. When a user opens this file, Internet Explorer — whose security mechanisms aren’t very good — is launched instead of the default browser.

How attackers exploited CVE-2024-38112

To better understand how this vulnerability works, let’s look at the attack in which it was discovered. It all starts with the user being sent an .url file with the icon used for PDFs and the double extension .pdf.url.

Inside the malicious .url file, you can see a link with the “vulnerable” mhtml prefix. The last two lines are responsible for changing the icon to the one used for PDFs. Source

Thus, to the user, this file looks like a shortcut to a PDF — something seemingly harmless. If the user clicks on the file, the CVE-2024-38112 vulnerability is exploited. Due to the mhtml prefix in the .url file, it opens in Internet Explorer rather than the system’s default browser.

Attempting to open the malicious file launches Internet Explorer. Source

The problem is that in the corresponding dialog box, Internet Explorer shows the name of the same .url file pretending to be a PDF shortcut. So it’s logical to assume that after clicking “Open”, a PDF will be displayed. However, in reality, the shortcut opens a link that downloads and launches an HTA file.

This is an HTML application, a program in one of the scripting languages invented by Microsoft. Unlike ordinary HTML web pages, such scripts run as full-fledged applications and can do a lot of things — for example, edit files or the Windows registry. In short, they’re very dangerous.

When this file is launched, Internet Explorer displays a not-so-informative warning in a format familiar to Windows users, which many will simply dismiss.

Instead of opening a PDF file, a malicious HTA (HTML Application) is launched, accompanied by an uninformative Internet Explorer warning. Source

When the user clicks “Allow”, infostealer malware is launched on the user’s computer, collecting passwords, cookies, browsing history, crypto wallet keys, and other valuable information stored in the browser, and sending them to the attackers’ server.

How to protect against CVE-2024-38112

Microsoft has already patched this vulnerability. Installing the update ensures that the trick with mhtml in .url files will no longer work, and such files will henceforth open in the more secure Edge browser.

Nevertheless, this incident once again reminds us that the “deceased” browser will continue to haunt Windows users for the foreseeable future. In that regard, it’s advisable to promptly install all updates related to Internet Explorer and the MSHTML engine. As well as to use reliable security solutions on all Windows devices.

Kaspersky official blog – ​Read More

Kaspersky Premium takes top spot in anti-phishing tests | Kaspersky official blog

/in

We write a lot about phishing, and always recommend our products as the best line of defense. And for good reason — Kaspersky Premium for Windows outperformed 14 other solutions in AV-Comparatives’ 2024 Anti-Phishing Test — beating global vendors like Bitdefender, McAfee, Avast, and others.

The AV-Comparatives Approved Anti-Phishing certificate — a mark of quality in protecting users from phishing

Because Kaspersky products utilize a unified stack of security technologies, which was rigorously tested by researchers, this award equally applies to our other products and solutions — both for home users (Kaspersky Standard, Kaspersky Plus, and Kaspersky Premium) and for business (such as Kaspersky Endpoint Security for Business and Kaspersky Small Office Security).

About the test

The independent Austrian organization AV-Comparatives has a 25-year track of record of evaluating the effectiveness of cybersecurity products and solutions. This latest test assessed how well popular cybersecurity solutions protect users from phishing threats while browsing the web and using email.

The test ran from May 17 to 28, 2024, using a selection of 275 fresh and active phishing links. The phishing URLs included sites designed to steal data from bank cards, PayPal and online banking accounts, Dropbox and eBay, social media and email accounts, online games, and other online services. To test for false positives, 250 links to legitimate online banking services worldwide were also included.

To achieve certification, security solutions had to block at least 85% of phishing addresses and avoid any false positives on legitimate websites. Kaspersky Premium for Windows blocked the highest number of phishing links among all the test’s participants — 93% — without a single false positive, securing first place. Only seven of the 15 tested solutions from other vendors met the certification criteria — albeit with lower scores: McAfee (92%), Avast (91%), Trend Micro (89%), Fortinet (89%), Bitdefender (89%), ESET (87%), and NordVPN (85%).

Comparison of AV-Comparatives’ anti-phishing test results for eight certified protection solutions

AV-Comparatives has been conducting its anti-phishing test — whose list of threats and legitimate websites is updated annually — since 2011, and our products have excelled consistently year after year. The test is performed on computers with identical hardware configurations, operating systems, and browsers, simultaneously for all security solutions put to the test. All other phishing protection mechanisms in the operating system or browser are disabled. Each tested product is configured to default settings and has unlimited internet access and the ability to update throughout the test. A visit to a phishing site is only considered as detected if the security solution warns the user that the site is unsafe.

A legacy of success

In 2023 alone, our products participated in 100 independent studies and emerged victorious 93 times. Since 2013, our products have undergone rigorous testing by independent researchers 927 times, achieving 680 first-place finishes, and placing in the top-three 779 times. This is an absolute record among all security solution vendors — both in terms of tests conducted and victories secured.

Here’s a rundown of some of our most notable recent wins:

Kaspersky Standard for Windows was recognized by AV-Comparatives as Product of the Year in 2023 based on the results of seven tests conducted over 13 months — surpassing Bitdefender, Avast, McAfee, and 12 other security solutions. Concurrently, AV-Test awarded our home user protection its annual Best Advanced Protection 2023 award based on six tests. We dedicated a separate blog post to this achievement.

Kaspersky Plus for Windows achieved a perfect score in the Total Accuracy Rating category in all of SE Labs’ Endpoint Security: Home tests conducted in 2023 and 2024 — earning the AAA rating.

Kaspersky Plus for Mac was recognized as the best security solution for macOS users by AV-Test in 2023, achieving top scores and quality certifications in all four tests conducted that year. In March 2024, the product received further acclaim from AV-Test — again earning a perfect score.
Kaspersky Plus for Android received a five-star rating in all six of Testing Ground Labs’ tests conducted in 2023, and two tests in 2024. Consistency is a sign of success!
Kaspersky Safe Kids stood out as the only product among five participants in the test of parental control and child protection solutions to receive the Approved Parental Control certification from AV-Comparatives in 2024. This recognition comes as a result of the product blocking over 98% of websites distributing pornographic content — all without any false positives.

You can check out our other awards in the TOP-3 section on our website.

Kaspersky official blog – ​Read More

SIEM benefits for medium-sized business | Kaspersky official blog

/in

A medium-sized company is an attractive target for cybercriminals. It operates on a scale that’s large enough for the company to pay a substantial ransom if its data is taken hostage. Meanwhile, its approach to information security is often an inheritance from the time when it was much smaller. Hackers can come up with a tactic to bypass the company’s basic protection and compromise the network with little to no resistance. The damage done by such incidents averages around $100,000. The regulatory side of things also cannot be ignored: cybersecurity rules and regulations have been proliferating around the world, and so have the fines for non-compliance.

Businesses are often cognizant of these threats and willing to allocate more resources to their infosec teams. How do you take your corporate security to the next level without excessive outlay? Here’s a little spoiler: deploying a SIEM (Security Information and Event Management) system is key.

Layered protection

A company’s long-term goal should be to build layered defenses in which different tools and controls complement one another to significantly complicate attacks on the company and limit the attackers’ options. A company with 500 to 3000 employees is almost certain to have the basic tools and the initial protective layer: access control through authentication and authorization, endpoint protection (popularly known as “antivirus”), server protection including email servers, and a firewall.

The next thing to do is supplement, rather than replace, this arsenal with more advanced cybersecurity tools, such as:

A system for comprehensive monitoring and correlation of security events from a variety of data sources (computers, servers, and applications) in real time across the entire infrastructure
Tools for obtaining enhanced information about possible incidents or just suspicious activity and anomalies
Incident response tools: from investigations in accordance with regulatory requirements, to isolation of compromised hosts and accounts, vulnerability elimination, and so on
Advanced identity management tools: from centralized user management and role-based access control, to a single authentication portal with MFA
Tools for improving visibility and manageability of IT assets, attack surface management, and patch management

Having all of these at the same time is out of the question, so implementing these measures will need to be prioritized and broken down into phases. That said, comprehensive monitoring forms the basis for many other information security tools, and therefore, SIEM implementation should be close to the top of the list.

This equips defenders with brand new capabilities: detecting attackers’ malware-free activities, spotting both suspicious objects and suspicious behavior, and visualizing and prioritizing infrastructure events. Proper use of SIEM can relieve the workload on the infosec team, as it spares them the need to spend time handling isolated events, logs, and other artifacts manually.

What a SIEM system is and why a medium-sized company needs one

SIEM solutions have been used for comprehensive IT monitoring in corporate infrastructures for two decades now. These solutions are composed of a number of components that collect, store, organize, and analyze telemetry, and allow responding to incoming events. Thanks to SIEM, an infosec employee can receive most alerts in a single console, easily link different aspects of an event (such as file creation, network activity, and account login) into a single entity without having to dig through five different data sources, and respond promptly to these events. The high degree of automation saves the infosec team a great deal of time. What you used to do manually just by walking over to a coworker’s computer becomes too much effort as the company grows in size.

Key SIEM components for medium-sized businesses

The architecture may differ between SIEM systems, but the key elements are always the same:

Event sources: these aren’t part of the SIEM, but they serve as providers of information. Anything that generates logs as it runs – whether it’s an operating system, EDR agent, business application, or network device – can be a source.

Collector: this is typically a separate service that receives logs from telemetry sources for processing in the SIEM.

Log normalizer and storage: these are elements of the SIEM platform core. The normalizer transforms and adapts the logs it receives from a collector to make them suitable for use, search, and analysis. Centralized data storage significantly simplifies detection and investigation of incidents, as well as the provision of incident information to regulators.

Event correlation is the heart of SIEM systems. This is the key step where disjointed events contained in different logs are correlated, merged if found to be associated with the same activity or different stages of a single activity, and prioritized. Prioritization is driven by threat intelligence available to the defenders. This is what can serve as the basis for writing a rule that won’t ping the infosec team every time a PowerShell script runs, but will raise an alert if a script runs with command-line options characteristic of a targeted attack.

Dashboards and alerts are a purely visual but important part of the system that helps make sense of heaps of data, easily find what you’re looking for, quickly drill down into an incident, and learn about issues or suspicious events in time.

A steep price used to be a real barrier to SIEM adoption by medium-sized businesses, as the products were aimed at larger companies exclusively. This has now changed with the advent of new solutions that no longer target just the enterprise segment of the market, such as our Kaspersky Unified Monitoring and Analysis platform.

Kaspersky official blog – ​Read More