ESET to Showcase Mobile Security, Secure Authentication @ Mobile World Congress

mobile1

ESET will be showcasing a variety of its products for the mobile IT environment at this year’s Mobile World Congress. The congress takes place March 2-5, 2015 in Barcelona, Spain, with the ESET booth, B05, located in Hall 5. The highlighted products in 2015 will be a new version of our flagship product for Android, ESET Mobile Security, our state-of-the-art authentication solution ESET Secure Authentication, and the next generation of our ESET Endpoint Security and ESET Remote Administrator business products.

At the congress, ESET experts will be conducting daily presentations on IT security topics connected to our product portfolio: mobile security on the go for Android, two-factor authentication for businesses, the latest on cyber threats, and hands-on experience of our just-launched, next-generation ESET business products. ESET experts and managers will be available at the booth to meet with cloud, ISP and MSP providers, as well as with device manufacturers.

We are looking forward to meeting with attendees at the Mobile World Congress in Barcelona, where we have been exhibitors for several years now. Mobile devices are no longer just an accessory, they have become an integral part of our daily lives. We use them on every occasion, at every moment and everywhere. At ESET we offer businesses the next generation of cyber protection and the Mobile World Congress is the best place to showcase it,” says ESET EMEA Sales and Marketing Director Miro Mikus, who is attending the expo. For more on ESET experience @ Mobile World Congress, watch our preview video on YouTube and read ESET blog.

ESET Mobile Security for Android: The application contains a powerful mix of security functionalities to protect sensitive data stored on smartphones or tablets against loss or abuse. In addition to integration with the Anti-Theft portal for remote management, the application supports a wide range of customization options, making it ideal for Telco and ISP operators. The application also comes with “Security Audit” function, keeping the user informed of possible risks, based on the current system settings and offers suggestions to ensure maximum protection.

ESET Secure Authentication:  With the addition of support for Microsoft Remote Desktop Protocol and by widening available authentication methods utilizing mobile phone with the possibility to use also hardware tokens, this latest edition is fast becoming the most compelling 2FA solution on the market. It combines ultra-secure remote access to your company data through VPN or Microsoft web applications, while introducing even greater ease of installation and top-notch support. The integration flexibility provided by Software Development Kit (SDK) and Application Programming Interface (API) extends protection to an even wider range of applications and data.

ESET’s next-generation business portfolio, ESET Remote Administrator: ESET has just announced the global availability of its new suite of security products for business customers. Supporting Mac, Windows and Android, the all-new ESET endpoint solutions provide comprehensive security to any size of company. At the core of this new product range is ESET’s all-new remote management console, ESET Remote Administrator. With a strong focus on enhanced user experience, security administrators can easily configure, monitor and adjust security policies within their network and solve problems conveniently via visually appealing and fully interactive web-console with full drill down capability allowing for rapid remediation.

Coinciding with the Mobile World Congress, ESET is offering 50% savings on ESET Mobile Security for Android with premium features for users around the globe. From March 2 until March 8, 2015 you can buy the license for all devices associated with your Google Play account at this great price. On Google Play just download the free version and then opt for premium features. For more information follow #mobileweek on social networks.

Europol shuts down Ramnit botnet used to steal bank details

The Ramnit botnet that is said to have affected 3.2 million computers has been shut down by European police, reports The BBC.

The botnet was used to spread malware through phishing emails and innocuous links posted on social networks, giving cybercriminals access to the bank accounts of users running Windows operating systems.

Having been alerted to Ramnit by Microsoft, Europol’s European Cybercrime Centre (ECC) teamed up with investigators and technology companies across the continent to tackle the botnet, including authorities in Britain, Germany, Italy and the Netherlands. The combined forces managed to shut down seven servers used by the cybercriminals overnight.

“We worked together to shut down the command-and-control servers for the network in various countries across the European Union,” said Paul Gillen, head of operations at the ECC. “The criminals have lost control of the infrastructure they were using.”

Meanwhile Wil Van Gemert, Europol’s deputy director of operations, said the operation highlighted how law enforcement agencies and the private sector can work together to bring down cybercriminals.

Quoted in The Guardian, he said: “We will continue our efforts in taking down botnets and disrupting the core infrastructures used by criminals to conduct a variety of cybercrimes … our aim is to protect people around the world against these criminal activities.”

To learn more about botnets and how they spread, watch our video below.

https://www.youtube.com/watch?v=s0sgiY93w9c

Image: Robert Paul Van Beets / Shutterstock

by Kyle Ellison, ESET

Security terms explained: What does Zero Day mean?

If you’re not one to spend hours of your day reading articles about computer security, certain unintuitive terms may make you scratch your head. One of the terms I’m most often asked to explain is what does zero day mean; let’s look at what that phrase entails.

At ESET, we define a Zero-day as

A new, unpatched vulnerability which is used to perform an attack. The name “zero-day” comes from the fact that no patch yet exists to mitigate the vulnerability being exploited. Zero-days are sometimes used in trojan horses, rootkits, viruses, worms and other kinds of malware to help them spread to and infect additional computers. Also spelled as “zeroday”, “0day” and “0-day.” (source:  ESET Virus Radar Glossary)

But what exactly does that mean?  Before we delve into the “zero day” modifier, let’s start by examining exactly what it means when we talk about vulnerabilities and exploits.

What a tangled web we weave

You can think of computer software as being structured like a screen door: it’s comprised of millions of lines of code, woven together. Except that in the case of software the interlocking of those threads is usually quite complicated; instead of a simple weave, it can look more like a plate of spaghetti. This can naturally make it more difficult for people to search for weak spots within the code. Even automated checking tools sometimes have trouble analyzing it.

Simply put, software is written by humans. Humans are fallible and sometimes fail to check every possible permutation of the ways in which people might use their code. Sometimes, through either thorough research or accidental misuse, one of those weak spots in the weave may be discovered. Those weak spots are what we call a ”vulnerability” in the software.

When a vulnerability occurs, the weak spot it creates can create strange behavior in programs. When someone discovers the presence of a vulnerability, that strange behavior can be used to make a hole that attackers could use to get into to run their own, malicious code on your machine. Sometimes that strange behavior may just cause the program to crash. There are a variety of possible outcomes, depending on the particular error. The code they use to create that hole or cause the crash is meant to exploit the vulnerable area in the software. This is why it is called exploit code, or an “exploit” for short.

How many days?

So, now that you know what vulnerabilities and exploits are, what is the “zero day” part about? How do you count zero days? Until a software vendor releases a patch that fixes a vulnerability, it is considered a “zero day” vulnerability. If there is exploit code available for that vulnerability, it’s a “zero day” exploit. “Zero”, in this case, counts the number of days since a patch has been available to the public.

Ideally it would be a researcher, with the public’s best interest at heart, who is disclosing the vulnerability to the software vendor and problems would be fixed before anyone got hurt. In the real world, sometimes it’s a malware author that discovers the problem, and the results are naturally more problematic for those of us who use that vulnerable software, not least because malware authors are not usually considerate enough to share information about the vulnerability with the software vendor. In this case, the vendor is usually notified about the problem after a malware researcher receives a sample of a threat exploiting that vulnerability. This was the case with the three recent Adobe vulnerabilities, when malware authors took advantage of the vulnerabilities to attack people’s machines.

It is also worth noting that a vendor releasing a patch does not mean the end of malware authors’ activity for that vulnerability. Because they know that people often postpone updating for days, weeks, or even years, they may even increase their use of known, patched vulnerabilities. As long as the exploit continues to give a good return on investment, they will continue to use it.

In short, “zero-day” means a problem that has not yet been fixed. This is part of why we recommend a layered defense strategy. One never knows when a problem like this will occur, but if you have an overall security strategy that does not rely entirely on any one piece of software or type of technology, you will be more likely to weather the inevitable storm without serious harm. And the sooner you apply patches and updates from your software vendor’s website or a reputable app store, the more you decrease your risk of being affected by vulnerabilities.

by Lysa Myers, ESET

No, Bank of Ireland isn’t running a routine security check on your account

ForgedBOI

ESET Ireland warns that Irish computers are being targeted by an email scam involving the name of the Bank of Ireland and redirecting to a fraudulent Polish address.

ESET Ireland is regularly monitoring email scams targeting Irish mailboxes. In the past few days we have seen an increased frequency of the following message:

Subject:      Security Measures * 806600
Date: 17 Feb 2015 10:57:57 +0200
From: Bank.of.Ireland [365]

Dear Account Owner,

365 Bank.of.Ireland apologizes for the inconvenience but you have been chosen randomly by our security system for routine checks of your account.

To continue to use your account for online payments and other methods of purchase, please follow the steps:

http://www1.bank.of.ireland365.online.com

However, the link which appears to be a “Bank of Ireland” one actually redirects to wzgorzetoskanii.pl, which is a Polish web address, and from there to another with an Australian domain name, which displays a forged Bank of Ireland website, which requests the user to “sign in” with their online banking details, therefore handing them over to the cybercriminals for further abuse.

ESET Ireland warns Irish users to ignore such email and to ring their bank if they’re unsure about any such emails or text messages received.

by Urban Schrott, ESET Ireland

 

Is your valentine for real? Six signs you might be falling for an online dating scam

With Valentine’s Day nearly upon us, millions will be looking for love online. Whether it’s Tinder, OkCupid or Match.com, the sad but true reality is that online dating is a hotbed of tricks, lies and scams. They say that love is blind, but if your eyes are open to these common warning signs, there’s a better chance your love’s labors won’t be lost.

Here’s six online dating scams to look out for.

Online dating scam sign 1: “I wouldn’t ask if I didn’t love you”

Our first tip is the most important, and combines two top-level warning signs in one. First: they come on too strong, telling you that you’re their soulmate after a few hours of chatting. Secondly – and this is the part to watch out for – they ask you for money.

Thinking you’re falling in love softens your natural suspicions towards others on the web; this might sound obvious, but it works a depressing amount of the time. They tell you they need you to pay half their ticket fare to visit you, or that they sent you a present but it’s stuck in customs and could you please just pay to get it released? Sometimes they’ll wheel out a sob story from their family and ask for thousands of dollars – the average online dating fraud victim pays out over $13,000.

No matter how strong you feel your bond is, check yourself before you send money to someone you’ve never met. Suggest you pay them back in person when you meet, if you like, but if they’ve really fallen for you, they should be able to look past the money. If they lose interest as soon as you decline to pay out, they’re not really interested in you.

Online dating scam sign 2: Sorry, I can’t talk right now…

How to spot a tracking app on your phone

Another sign you’re not talking to the person you think you are is an unwillingness to speak on the phone. Nigerian and Eastern European fraudsters will pretend to be 20-something women from the US, Australia and Britain – a pretense they can’t keep up over the phone. Similarly, watch out for anyone who’s super-keen to get you off the site where you met and talking over email or text: most dating sites can monitor conversations for likely fraudsters – telltale signs like exchanging bank data, for example – and they don’t want their cover blown.

Online dating scam sign 3: Do you look familiar?

It’s not just the scammers and criminals who might be taking advantage of your quest for ‘the one’. Online dating is big business – in order to lure you in, dating sites have been caught creating fake, attractive profiles using celebrity photographs, stock images of models, or even photographs and personal details of real individuals who have no idea their images have been used – stolen from Facebook, usually.

A quick and easy tip: download their profile pic, then open up Google. Drag and drop the image into the search bar to search for any other uses of the picture. If it returns lots of hits from photo libraries, people with different names, or some minor actor, you’ve just rumbled a fake.

Online dating scam sign 4: He just came out of the blue

While romantic novels might be full of dashing, handsome, mysterious gentlemen who just arrive in town one day, in the current age it’s practically impossible to have no online history. If they’re savvy enough to be online dating, the chances are they’ve got at least some social media presence. If you’re Googling your potential heartthrob (admit it, we all do), and they’ve only recently joined Facebook and Twitter, your suspicions should be raised. Check the details match what they’ve told you, and see if their friends or followers look like genuine people.

Online dating scam sign 5: Is that a wedding ring?

online dating scams 2

A MSNBC study found that as many as a third of men using online dating are in fact married. Some common signs: his profile picture is hard to identify; he won’t give a landline phone number, and blocks the number when he calls; his responses are erratic and come at odd times of the day, and most of all, he’s reluctant to let you into his circle of friends or talk about his family life. If these sound familiar – beware.

Online dating scam sign 6: Tell me all about yourself…

This can be a harder one to see through, but you should be alert to the possibility of identity theft. Online dating is a natural forum to share personal information, but be careful what you’re giving away. As well as the obvious – financial information, addresses – be wary of anyone who seems overly keen to know your mother’s maiden name, favorite pet or first school: the stuff that passwords and security questions are made of. We’re not saying you have to clam up like a CIA operative: but the alarm bells should ring if you think it’s all one-way traffic. If you’re sharing with them, they need to do the same – and our previous tips should help you check that they’re not feeding you fake information.

by Rob Waugh, ESET We Live Security

It’s Safer Internet Day. So where is our Internet of Secure Things?

Today, Tuesday 10 February, has been declared “Safer Internet Day” – a day for all of us to work together to “create a better internet together”.

A noble cause, and one that WeLiveSecurity strongly supports.

But you’re probably fed to the back teeth with articles from us telling you to use unique hard-to-crack passwords on all of your online accounts, to disguise your internet browsing with VPNs when using public WiFi access points, and to be wary of unsolicited emails telling you that UPS has failed to deliver a package to you and can you just double-click on the attachment to receive more details…

So, instead, we thought we would talk about something a bit different.

Because every day we are sharing tips with you about how to better secure your computers. But what’s changing is that more and more devices are, almost without many of us even noticing, sneakily having computers embedded into them. And, if you and the vendors who build them are not careful, they could open avenues for a whole new range of internet attacks.

They call it the “Internet of Things” – the myriad of so-called “smart” devices that surround us in our every day lives that are, increasingly, taking advantage of internet connectivity.

Internet of Things

And the breadth of “things” is wide-ranging.

It seems just about everything and anything is eager to jump onto a WiFi connection – whether it be smart home thermostats, lightbulbs or ovens that you can turn on remotely as you approach your home after a long day at the office, internet-enabled fridges that can work out what needs to be ordered next from the supermarket, baby monitors, cars or even medical implants helping kick the sick alive.

More and more, you’re going to hear people talking about the “Internet of Things” (or its ghastly acronym “IoT”), extolling the virtues and advantages of having internet-enabled gadgets and gizmos filling up your house.

In some cases, of course, the advantages are dubious – for instance, the benefits of having an internet fridge have been convincingly and thoroughly debunked for anyone who spends any time thinking about it rather than being swayed by a glossy sales pitch.

But other IoT-devices could genuinely make our life that little bit easier.

A motor vehicle that can communicate with other cars to find out where the travel snarl-ups are? That sounds very useful.

Or a tumble-drier that can send diagnostic information to a customer service team about how it has gone wrong, and maybe even download a software fix, sounds definitely handy.

Or an internet router that not only helps you get on the internet, but can also download its on security updates, would surely save time and protect many.

Right now I have a letter on my desk from the manufacturer of my car, telling me that I need to ring my dealer and book and appointment to bring it in so they can apply a software patch for what sounds (to my non-mechanical ears) like a relatively unimportant technical issue.

How much better would it be if I could press a button on my dashboard and download a patch just like I can for my desktop computer? Or, even better, if the car could download an automatic patch as just occurred for two million luxury BMWs that were found to be less-than-resistant to carjacking hackers?

BMW Connected Drive

But there is a huge problem with many of these internet-enabled devices, whether they be cars or something else around your house or person. And the problem boils down to this: many of the vendors either know nothing about how to operate securely on the internet, or they simply do not appear to care.

The manufacturers realise that they will sell devices and gadgets based upon their ability to do funky internet-enabled things, *not* because they have been built with security in mind. After all, for most people, being told that the device has been hardened and secured to *not* do things is a turn-off, they want to know what it *can* do.

That’s why Google Nest thermostats have been hacked, LED smart bulbs can be zapped by malware, hackers can remotely frighten your baby in its cot, routers have been exploited for DDoS attacks, and expensive Tesla motor cars can have their doors hacked open.

The Internet of Things, love it or hate it, is here to stay.

You can complain all you like about devices’ lax attitude to security and privacy, but the general public are (most likely) going to go ahead and embrace these gadgets with open arms regardless. Because they’re “cool”.

If you want to do something for Safer Internet Day, make it the day that you decided to take a stand against those manufacturers and developers who fail to take device security seriously.

As many millions more devices leap onto the internet, with embedded computers inside them that can be exploited, there’s a real need to ensure that manufacturers know that we *do* demand safety and security to be built in from the beginning – not left as a hastily pushed-out patch when the inevitable screw-ups happen.

HeartThat means no more dumb “smart” devices shipping with default passwords or easy-to-guess open ports, no more software that “does the job well enough” but goes no further for protection.

Because, don’t forget, the Internet of Secure Things isn’t just going to help protect the contents of our fridge. It’s also going to protect the cars that we travel down motorways in, and the medical implants that keep our loved ones alive.

If enough care isn’t taken to ensure that they are properly secured, people’s lives are going to be lost.

You can read more about threats posed by the “Internet of Things”, as well as much much more, in ESET’s recently-published report: “Trend & Predictions for 2015″.

by Graham Cluley, We Live Security

7 out of 10 Irish youths shared photos that would embarrass them if made public

February 10th is Safer Internet Day, promoting online safety, particularly to young people. ESET Ireland has just completed its latest Irish online security survey which showed worrying results among Irish youth.

Last year news headlines were full of stories of celebrities online accounts hacked and various private pictures including those of Jennifer Lawrence, Kate Upton, Rihanna, Arianna Grande being stolen. Two years ago ESET Ireland commissioned a survey asking Irish computer and mobile device users if they use any data leakage protection and 74% answered they had no clue what that is. Now the situation seems to have gotten even worse, as not only do people not seem to realise data can get lost or stolen, but they actively put themselves at risk.

In the latest survey by ESET Ireland, carried out in January 2015 by Amárach Research, 1002 Irish of all ages and from all regions were asked if they ever uploaded or shared (to social media, online storage, Snapchat, Instagram, etc.), messaged or texted any picture of themselves that would be embarrassing to them if it was made available to the public and the results were shocking!

age

No less than 70% of those surveyed in the age group 16-24 have uploaded or texted their embarrassing pictures. The age group 25-34 was just a tiny bit better with 62% being irresponsible, then the numbers slowly decrease down to 14% of those over 55. Region wise Dubliners are the worst offenders with 47% across all ages sending their photos about, while Connaught and Ulster were more conservative with 39%. Income wise, those with higher income lead in carelessness with 43% over 40% of those in the lower income group.

People do not yet seem to realise that once a photo is uploaded it is out there. Online services, cloud storage, emails, social media can and have already been hacked and private data uploaded to them can and has been accessed by unauthorised eyes. If you wouldn’t show an embarrassing photo of yourself insufficiently dressed or having too much fun at a party to your grandmother or your boss, then you’d be better off not uploading or texting it at all.

Follow

Get every new post delivered to your Inbox.

Join 82 other followers