The plot of HBO’s "Homeland," in which terrorists try to hack into a world leader’s pacemaker, may not be so far-fetched, a report by CNN Health indicated. The report revealed that the U.S. Food and Drug Administration discovered 11 security vulnerabilities in operating systems that use a third-party software known as IPnet. Many medical devices use IPnet, which helps computer systems communicate with each other. If any of the IPnet flaws are exploited, the FDA warned, a hacker might be able to take control of devices such as pacemakers and infusion pumps. The hack could even infiltrate the entire hospital network.

“This is a very serious threat,” said Avast Security Evangelist Luis Corrons. “Especially when we know that hospitals and health organizations do not have the best record for keeping their networks safe. On top of that, a lot of hospital machinery uses outdated software, which greatly increases the risk of being compromised.” If attackers were to hack a device, they could potentially change its function, cause a denial of service, or trigger logical flaws that prevent it from functioning properly. 

This week’s stat 

On average, 22% of saved photos on Android phones are either low-quality or duplicates, Avast research of 3 billion photos from 6 million users showed.

Disinformation as a service

Cybersecurity experts found a number of cybercriminal groups on the dark web that offer disinformation campaigns as a service. ZDNet reported that to test the extent of the service, researchers created a fictitious company and then hired two disinformation services, one to boost the company with a positive campaign and one to smear it with a negative campaign. In total the researchers spent $6,500 for which they got highly customized campaigns that relied heavily on bots and phony accounts on social media for influence. The malicious services also provided dishonest and deceitful articles as part of the campaigns, and the researchers reported that at least two of the articles were published as real news on media sources. Experts worry that this new shadow industry – once focused only on political causes but now hitting the private sector – could trigger significant consequences such as affecting the stock market. 

This week’s quote

“Alexander, really, if we started together we need to finish it. Because for now this is working and we can earn money.” – Developer working on botnet robbing banks in Russia. Go inside a criminal botnet in this post about recent Avast research.  

Fake browser updates infect enterprises with malware

Researchers have identified a wave of attacks over the past six months in which employees receive fraudulent browser update prompts that if clicked infect their company’s system with banking Trojans and in some cases ransomware, according to a report by Bleeping Computer. Using hacked websites, the attackers pop up phony notices to users claiming their browsers need to be updated for smooth performance. But when users click the offered update button, they actually download a malicious program that communicates with the attacker’s server. The attacker then gains information about the system and launches banking Trojans at it, which mine the local files for credentials and burrow deeper, collecting login credentials from other computers on the same network. In some instances, once the banking Trojans complete their sweep, the attackers then lock up the system with ransomware, demanding high ransoms in exchange for a decryption key. 

Avast Researcher Corrons emphasized the need for continual internal communication within  organizations. “We must keep our employees informed of the new threats they might be facing. Most attacks use social engineering techniques to fool people into infecting themselves. That’s why security teams within enterprises should have some kind of bulletin board or communication channel to inform users of the latest attacks, show them how to identify them, and instruct them what to do if they become a target.”

Ex-Yahoo engineer pleads guilty to hacking emails

This week a former Yahoo engineer pleaded guilty in a San Jose courtroom to computer intrusion, admitting he hacked into approximately 6,000 Yahoo email accounts using his internal access to the Yahoo network. NBC News reported that the prosecuting attorney in the case claims that Reyes Daniel Ruiz, 34, targeted the accounts of younger women, including friends and colleagues, in which he would search for sexual images and videos. Prosecutors allege that once he cracked the email account passwords, Ruiz applied those credentials to the user’s Facebook, Gmail, iCloud, and other online accounts, continuing his search for erotic media in those channels. Ruiz could face up to five years in prison and a fine of $250,000. 

This week’s ‘must-read’ on The Avast Blog

Quick, what age group has the most photos on their Android phones? If you guessed Millennials, you’re not just wrong but way off. Find out who has the phone-busting photo albums and who travels light in this new research by Avast. 

Avast is a global leader in cybersecurity, protecting hundreds of millions of users around the world. Protect all of your devices with our award-winning free antivirus. Safeguard your privacy and encrypt your online connection with SecureLine VPN.