Protecting over 230 million PCs, Macs, & Mobiles – more than any other antivirus

Archive

Posts Tagged ‘phishing’
April 7th, 2015

Don’t take the bait: Beware of web attack techniques

Mousetrap with cheese

When it comes to cybercrime, it’s always better to be in the know. Here are a few ways that web attacks can find their way onto your device. Don’t be fooled — most cybercrooks design attacks to  take place where you’d least expect it.

  1. Social engineering preys on human weakness

“A lot of attacks are still using social engineering techniques; phishing emails – ways of convincing the user to give up valuable information,” said Avast CEO Vince Steckler.

In a phishing or spearphishing attack, hackers use email messages to trick people into providing sensitive information, click on links, or download malware. The emails are seemingly sent from organizations or individuals the potential victims would normally get emails from, making them even more deceptive. Last July, Avast took a look at the Tinba Trojan, banking malware that used spearphishing to target its victims.

 usbank

An example of an injected form from Tinba Trojan targeting U.S. Bank customers.

Web attacks also take place through SMS Text Phishing, also known as SMSishing. This method has become one of the most popular ways in which malicious threats are transmitted on Android devices. These text messages include links that contain malware, and upon clicking them, the malicious program is downloaded to the user’s device. These programs often operate as SMS worms capable of sending messages, removing apps and files, and stealing confidential information from the user.

  1. Malicious apps attempt to fool you

Malicious programs can disguise themselves as real programs by hiding within popular apps or games. In February, we examined malicious apps posing as games on Google Play that infected millions of users with adware. In the case of malicious apps, cybercrooks tamper with the app’s code, inserting additional features and malicious programs that infect devices. As a result, the malware can attempt to use SMSishing in order to collect additional data.

Durak-game-GP

The Durak card game app was the most widespread of the malicious apps with 5 – 10 million installations according to Google Play.

  1. Ransomware uses scare tactics that really work

Another name that made headlines was a group of malware dubbed ransomware, such as CryptoLocker, and its variants CryptowallPrison LockerPowerLocker, and Zerolocker. The most widespread is Cryptolocker, which encrypts data on a computer and demands money from the victim in order to provide the decryption key. Avast detects and protects its users from CryptoLocker and GameoverZeus.  

Make sure you back up important files on a regular basis to avoid losing them to ransomware. Ransomware made its way from desktop to Android during the year, and Avast created a Ransomware Removal app to eliminate Android ransomware and unlocks encrypted files for free.

Count on Avast apps to keep mobile malware at bay

To keep your devices protected from other ransomware, make sure to also install Avast Free Mobile Security & Antivirus from the Google Play store. It can detect and remove the malware before it is deployed.

Install Avast Ransomware Removal to find out if your Android devices are infected and to get rid of an infection. Avast Ransomware Removal will tell you if your phone has ransomware on it. If you are infected, it will eliminate the malware. Android users who are clean can use the free app to prevent an infection from happening.Once installed, you can easily launch the app to scan the device, remove the virus, and then decrypt your hijacked files.

December 22nd, 2014

Avast revisits the biggest threats of 2014

2014 has been an active year for cybercrime. Let’s start with the most recent and then take a look at some of the other important security events of the year.

shutterstock_134221643

State-sponsored espionage

We are ending the year with the most publicized and destructive hack of a major global company by another country – now identified as North Korea. The Sony Entertainment attack, still being investigated by the FBI, resulted in the theft of 100 terabytes of confidential employee data, business documents, and unreleased films. It was an attack on privacy due to the theft of a massive amount of personal records, but also essentially blackmail; aiming to silence something that the North Korean government didn’t like – namely the release of The Interview, a movie depicting an assassination attempt on Kim Jong-Un.

Most of the blame for state-sponsored cybercrime in 2014 has been with Russian or Chinese hackers. Whether private or state-sponsored, these hackers have attempted to access secret information from the United States government, military, or large American companies. Recently, Chinese hackers sponsored by the military were indicted for economic espionage by the U.S. Department of Justice.

Home-Depot-ApronLarge data breaches

Along with the Sony breach, other notable companies that suffered from cybercrime include Home Depot, eBay, Michaels, Staples, Sally Beauty Supply, and others. A significant number of these breaches were begun months or years ago, but were revealed or discovered in 2014.

Nearly 110 million records were stolen from Home Depot; the largest ever breach of a U.S retailer. The cyber-heist included 56 million payment card numbers and 53 million email addresses.

JPMorgan Chase’s data breach impacted nearly 80 million households in the U.S., as well as 7 million small- and medium-sized businesses. Cybercriminals were able to gain access after stealing an employee’s password, reminiscent of the Target breach from 2013. This breach is said to be one of the largest breaches of a financial institution. The FBI is still investigating.

Financial and data stealing malware

GameOver Zeus, called the most infamous malware ever created, infected millions of Internet users around the world and has stolen millions of dollars by retrieving online banking credentials from the infected systems.

Tinba Trojan banking malware uses a social engineering technique called spearfishing to target its victims. The spam campaign targeted Bank of America, ING Direct, and HSBC customers using scare tactics to get customers to download a Trojan which gathered personal information.

Chinese hackers were at it again, and again, targeting South Korean banking customers with banking malware using a VPN connection. The customers were sent to a look-alike webpage where they were unknowingly handing cybercrooks their banking passwords and login information.

Software vulnerabilities

Many of the breaches that occurred in 2014 were because of unpatched security holes in software that hackers took advantage of. The names we heard most often were Adobe Flash Player/Plugin, Apple Quicktime, Oracle Java Runtime, and Adobe Acrobat Reader.

Avast’s selection of security products have a feature called Software Updater which shows you an overview of all your outdated software applications, so you can keep them up to date and eliminate any security vulnerabilities.

Read more…

December 17th, 2014

South Korea hit with banking malware using VPN connection

South Korean banks have been attacked by hackers again!

This is not the first time we reported malware which targets Korean banking customers. In the past, we wrote about Chinese threats against Korean Windows users and last year we published a series of blogposts, Fake Korean bank applications for Android (part 1, part 2, part 3), about malware targeting mobile platforms.

The Korean banking malware is based on the same principle previously used. The customer executes the infected binary, which modifies Windows hosts file. This file contains a list of domains with assigned IP addresses.  Malware, however, may modify this file. When a customer wants to visit his online bank website, he is redirected to the IP address specified in the hosts file, not to the original bank website!

XP Debugging2

The piece of malware we will discuss in this blog post performs the above mentioned modification of system settings. However, when we looked into the modified hosts file, we noticed something unusual.

Read more…

Comments off
December 5th, 2014

Fake confirmation emails from Walmart, Home Depot, others in circulation

Cybercrooks target busy holiday shoppers with phishing scheme.

After all that shopping on Black Friday and Cyber Monday, consumers are reporting a bunch of phishing emails that look like authentic communications from poular stores. Malware-infected emails are reportedly coming from Walmart, Home Depot, Target, and Costco. The catch is these are not from the authentic merchants, but rather cybercrooks are using a phishing scheme to send fake emails with the intent to gather personal information from harried shoppers.

Walmart scam email

Millions of these emails are being sent each day, originating from more than 600 hacked websites that act as intermediaries, according to security analysts from Malcovery monitoring the attacks. This method prevented detection by causing the spammed links to point to websites that had been safe until the morning of the attack.

The messages have subject lines like this:

  • Thank you for your order
  • Order Confirmation
  • Thank you for buying from Best Buy
  • Acknowledgment of Order
  • Order Status

If you receive one of these emails, don’t click on any links. Instead, visit the merchant’s website or call their customer service. Don’t give any personal information out unless you know for sure with whom you are speaking.

Home Depot scam email

costco scam email

 

Signs of a fake email

Unfortunately, cybercrooks are becoming more professional with their scams, but here are a few things you can look for to tell a fake email from an authentic one.

  • Poor grammar usage
  • The Sender (the “from” line) may not match the merchant name
  • Links in the email do not go to the real website
  • There is no order confirmation number or details about the order. A real order confirmation email contains the details of your order without clicking on any links, as well as where it is being shipped and the payment method.

target scam email

How to protect yourself

Walmart acknowledged that the fraudulent emails were in circulation and suggested these steps if you receive a suspicious email.

  • If you actually placed an order and are suspicious about the email you received, log onto your Walmart.com order to check your order status.
  • Keep your virus software updated on all your computers.

If you were a victim of fraud via the Internet, you should file a report with your local law enforcement agency along with the Internet Crime Complaint Center (ICCC). The ICCC is a partnership between the FBI and the National White Collar Crime Center. You can make a report with the ICCC.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on FacebookTwitter and Google+.

 

Categories: General Tags: , ,
Comments off
December 2nd, 2014

Donate generously on Giving Tuesday, but watch out for scams

#GivingTuesday is a day dedicated to give from the bounty we have received.

GivingTuesday2014

After the shopping free-for-all of Black Friday, the local discoveries of Small Business Saturday, and the online click frenzy of Cyber Monday, people the world over have a day for giving thanks.

On Tuesday, December 2, 2014, charities, families, businesses, community centers, and students around the world will come together for one common purpose: to celebrate generosity and to give. ~www.givingtuesday.org

From supporting women’s microfranchises selling solar products in Nicaragua to supplying feed and services to a ranch in Arizona that helps save horses from abuse and neglect to constructing toilets in a school in West Bengal, there are a myriad of opportunities to spread your goodwill and your cash. It’s also an opportunity for cybercrooks to scam those with a generous heart.

What you need to know about charity scams

Charities and fundraising groups use all methods to solicit funds, so you could receive a phone call, a knock at your door, an email, a message via social networking sites, and even a text message on your mobile phone. Before giving your donation, carefully review a charity and ensure it is a trustworthy organization.

The Better Business Bureau (BBB) and the Federal Trade Commission (FTC) offers some valuable tips.

    • Watch out for copycats. There may be hundreds of charities seeking support in the same category, and some may use a name that is similar to a better-known, reputable organization. Don’t fall for a case of mistaken identity.
    • Avoid being pressured. Don’t succumb to high-pressure tactics that try to get you to donate immediately. Responsible organizations will welcome your gift tomorrow just as much as today.
    • Give through a reputable, secure service. If a charity asks for donations in cash, by money wire, or offers to send a courier or overnight delivery service to collect the donation immediately, then beware. A genuine charity will give you time and a secure method to make your donation.
    • When in doubt, check them out. The results of a Google or Yahoo search have been known to include bogus phishing sites designed to look like a legitimate charity’s website. Just look up scams around Hurricane Katrina, and you’ll see what I mean. Charity Navigator says,
      • Carefully examine the web address. Most non-profit web addresses end with .org and not .com. Avoid web addresses that end in a series of numbers.
      • Bogus sites often ask for detailed personal information such as your social security number, date of birth, or your bank account and pin information. Be extremely skeptical of these sites as providing this information makes it easy for them to steal your identity.

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on FacebookTwitter and Google+.

 

 

Comments off
November 7th, 2014

Home Depot discloses that 53 million customer email addresses were stolen

Home-Depot-ApronThe Home Depot security breach last spring has gotten worse. In addition to the 56 million credit-card accounts that were compromised, around 53 million customer email addresses were also taken, according to a statement from Home Depot about the breach investigation. Home Depot assures its customers that no passwords, payment card information like debit card PIN numbers, or other “sensitive” information was stolen.

The breach occurred when cybercrooks stole a third-party vendor’s user name and password to enter their network in April 2014. The hackers then deployed unique, custom-built malware on Home Depot’s self-checkout registers in the United States and Canada.

The company said that as of September 18, the malware had been eliminated from the network.

Request your free identity protection

The Home Depot is notifying affected customers and still offering free identity protection services, including credit monitoring, to any customer who used a credit or debit card at one of its 2,266 retail stores beginning in April. Customers who wish to take advantage of these services should visit homedepot.allclearid.com or call 1-800-HOMEDEPOT (466-3337).

The Fallout

Home Depot said that customers should be on guard against phishing scams, which are designed to trick customers into providing personal information in response to phony emails.

  • Review your credit card statements carefully and call your bank if you see any suspicious transactions.
  • Be aware of phone calls or emails that appear to offer you identity theft protection but are truly phishing schemes designed to steal your information. Always go directly to The Home Depot’s website or to the AllClear ID website, or call Equifax for information rather than clicking on links in emails.

Get more information from Home Depot’s Facebook page.

 

Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on FacebookTwitter and Google+.

 

October 17th, 2014

Ebola scams spread faster than actual disease in panic-striken U.S.

shutterstock_204144223 (2)

Cybercrooks use popular stories in the news to deceive people into giving up confidential information.

The dreaded disease Ebola that is spreading rapidly throughout West Africa made landfall in the US recently, and since then many news agencies have sensationalized the “outbreak” with constant coverage. Panic has grown as politicians raise the public’s fears and medical experts are confusing people with contradictory information. These things all combine to create the perfect atmosphere for scammers.

It’s quite common for cybercrooks to use social engineering techniques to fool people during a big news event, and we have seen an increase in phishing attempts. The United States Computer Emergency Readiness Team (US-CERT) issued an alert today to remind users to protect against email scams and cyber campaigns using the Ebola virus disease as a theme.

“Phishing emails may contain links that direct users to websites which collect personal information such as login credentials, or contain malicious attachments that can infect a system, “ says the advisory.

Users are encouraged to use caution when encountering these types of email messages and take the following preventative measures to protect themselves:

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on FacebookTwitter and Google+. Business owners – check out our business products.

 

Categories: General Tags: , , ,
July 31st, 2014

Security basics: Internet scams and your identity

If you’re afraid “to do something wrong” when you sit behind your computer, this new series is for you.

AVAST has expertise in developing security products and we want to bring you a complete series about internet danger, with good practices to avoid scams, loss of money, and identity theft. You’re just about to join a tutorial that will help you avoid such threats in the virtual world.

Privacy July 2014 B (2)

First, being afraid to do something wrong is healthy because it will slow you down, which can be a good thing since most mistakes are made due to rushing through something. Computers, smartphones and tablets are advanced tech devices. Those of us who did not have the opportunity to learn and gather knowledge and experience on using these devices when we were young, can be a little shy with them. Searching for information about how to do something with your device is not always easy because people tend to use complicated language. Making it simple and easy-to-understand is a task that we assume with pleasure.

The Basics

The internet is a space for sharing and dialog. However, alongside this encouraging environment you will face some areas where you need to exercise caution: Inappropriate content for children like adult sites; sites which promote hateful content such as racism and intolerance; and cybercriminals who use different methods to steal your personal, banking, and credit card data.

You may be tempted to think that no one will be interested in your computer, or that your computer cannot be found in the internet jungle. That would be a mistake.

Cybercriminals hide in the jungle and misuse your computer as a base to attack others, and spread viruses (malware) or spam. Think of it this way – the banking systems and e-commerce sites have, in general, a much bigger and more sophisticated security arsenal than your own computer (smartphone or tablet), and yours is the weakest point in this chain.

So let’s start from the same place.

Here’s The Rule: All safety measures you take in real life should be applied when you use the internet: Visit only trustworthy sites and stores, do not share your personal data with anyone, lock the doors, and put an alarm. AVAST believes security implies prevention: Be prepared before something bad surprises you.

Your identity is up for grabs

Your personal data or your credentials for a particular site (username and password) are quite valuable to cybercrooks. With this data, scammers act on your behalf; sending emails (like the phishing ones we’ve written about lately), shopping with your credit card, and doing things that can cause harm to you, not only financially but also for your reputation. They could share false information about you, photos and personal data. This could led to problems when, for instance, you are looking for a new job, but also in your personal and family life.

Create strong passwords to protect your online accountsTaking care of your passwords is essential. Use different passwords for each service or internet site. You should create the so-called strong passwords: CAPS letters, symbols, and numbers. AVAST offers an automated solution for your passwords called avast! EasyPass. This way, using different and secure passwords, cybercriminals can’t easy guess your credentials, enter in sites, or shop in your behalf.

Do not answer unsolicited emails or sales promotions that promise you a financial return after you make a small payment. Never help or join into the financial operations of a third party, close to you or not. Do not trust in NGOs that ask for donations, rather look for the official sites to contribute. Never giveaway your banking data for “personal credit and rewards” announcements, for example, bogus companies offering jobs that ask for a preliminary payment. Scams that prey on your emotions are prevalent. Dating scams in-the-wild ask for money to make a trip to meet your  love interest personally. In fact, after you pay, you’ll never see your love again. Beware of these types of scenarios.

How can we avoid these scams? Generally, they ask for a quick and secret decision and, often they have spelling and grammar errors because many still originate from foreign locales and rely on online translation software to spread the scams all over the world.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on Facebook, Twitter, Google+ and Instagram. Business owners – check out our business products.

July 28th, 2014

Phishing scam steals Finnish bank passwords, earns big money

Earlier this month, we told you about a spear phishing campaign specifically targeting banking customers in Czech Republic, and now a similar scam is targeting bank customers in Finland.

Finnish banks warn their customers of phishing scheme.

Finnish banks warn their customers of phishing scheme.

This weekend, Aktia, Nordea, and Nooa Säästöpankki customers received text messages and emails informing them that their online banking services were being discontinued because of a payment in default. The message said the payment had to be made immediately to avoid this. The victims were then instructed to follow a link in the email where they could enter their ID and bank access codes including PIN. The victim was promised that a representative of online banking services would call to confirm after the payment was received.

So far, 500,000 euros has been stolen. Of course, there is no default payment and the whole thing is a hoax to earn cybercriminals money. Within the last month, 95 percent of the victims have been women, said Detective Superintendent Jukkapekka Risu from Helsinki Police to the Helsinki Times.

What you need to know to protect yourself

Do not click on links, download files, or open attachments in emails from unknown senders. Phishing websites often copy legitimate websites so they appear authentic. To be safe, call the bank to find out if they really sent that email to you.

Do not call the number in the email. It can easily be faked. Look up the real number of your bank and call using that.

Banks will not ask for customer names or IDs by email, text message, or phone. If you have fallen victim to the scam message and have volunteered information, please contact your bank immediately.

Protect your computer with a firewall, spam filters, antivirus and anti-spyware software. Both avast! Internet Security and avast! Premier have these important features. SafeZone is an additional security feature in avast! Pro Antivirus, avast! Internet Security and avast! Premier, which allows you to browse the web in a private, secure environment, invisible to the rest of your system. For example, if you do your banking online, you can be sure that your personal data cannot be monitored by spyware or key-logging software.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on Facebook, Twitter, Google+ and Instagram. Business owners – check out our business products.

 

July 18th, 2014

Spearphishing scams hope you’ll take the bait

avast! Internet Security protects you from phishing and email scamsYesterday on our blog, avast! Virus Lab researcher Jaromir Horejsi, explained a banking Trojan called Tinba. Also this week, we told you about an email that Avast evangelist, Bob G. received claiming that he won money in a World Cup lottery. The cybercrooks behind that scam cast a wide net, hoping to catch a few people then ask them to provide banking information so they could deliver the prize.

The cybercrooks behind Tinba and Bob’s lottery email use a social engineering technique called spearfishing to target its victims. Spearphishing is similar to the classic technique called phishing which uses authentic-looking emails to lure the victims to fake websites, then trick them into revealing personal information.

Cybercrooks use emotional hooks to lure you in

Other high profile phishing attempts, like the DHL email scam that ran last Christmas, preyed on the anxiety of the holidays. An email that looks like the real thing from DHL was sent, offering all sorts of urgent and legitimate-sounding explanations as to why they need your personal data. It’s not hard to understand why busy people can be fooled.

Spearphishing is similar in every way to phishing except that the net is drawn in much tighter. The FBI says that cybercrooks target select groups of people with something in common—they work at the same company, bank at the same financial institution, attend the same college, order merchandise from the same website, etc. The emails are seemingly sent from organizations or individuals the potential victims would normally get emails from, making them even more deceptive. This is what is happening with the Tinba Trojan right now in Czech Republic.

In both social engineering schemes, once the victim clicks, they are led to a phony but realistic-looking website, where they are asked to provide passwords, account numbers, user IDs, access codes, PINs, etc.

How to avoid becoming a spear phishing victim

  • Most companies, banks, agencies, etc., don’t request personal information via e-mail. If in doubt, give them a call (but don’t use the phone number contained in the e-mail—that’s usually phony as well).
  • Use a phishing filter. Both avast! Internet Security and avast! Premier include anti-spam filters to detect phishing and scam emails.
  • Never follow a link to a secure site from an email; always enter the URL manually.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on FacebookTwitter and Google+. Business owners – check out our business products.