Thursday, 15 December 2016

Ransomware tries its hand at being a deadly viral meme

Memes are weird things and weren’t always about lolcats or frogs or whatever the latest terrible image macro doing the rounds happens to be. I quite like this line from Wikipedia on said subject:

Proponents theorise that memes are a viral phenomenon that may evolve by natural selection…Memes that propagate less prolifically may become extinct, while others may survive, spread, and (for better or for worse) mutate.

The plot of The Ring is pretty much the concept of a meme made deadly – pass on this cursed videotape within 7 days, or you die horribly

How far will you go to save yourself?

Well, our old friend 2016 is here to ask that question one more time, because ransomware authors have decided to tweak their victim’s get out of jail method. Don’t have the funds to obtain an unlock key? No problem – just infect two people and you’re back in business (assuming they pay up to unlock their own files). It’s all gone a bit pyramid scheme, hasn’t it?

Interestingly, the time limit to regain your files is the same as the time limit imposed on potential victims of Sadako: seven days.





The only way that could be creepier is if they’d released this during Halloween. 

Named after the well known BitTorrent client Popcorn Time, this file goes one step further than most in a mission to make some money. It encrypts files in the usual places – Documents, Music, Pictures and Desktop – and targets pretty much every file extension under the sun. After encryption, the splash screen explaining what’s happened claims the creators are from Syria and that money generated from the ransomware will be used for “food, medicine, and shelter”.

At this point, the choices available boil down to randomly entering a key to unlock the files (not a good idea, as there is mention in the source code that incorrect key entry may eventually result in automatic file deletion), or to play the game and begin the process of infecting other people, in the hopes of obtaining an unlock key.
Note that it isn’t enough to infect another person – you have to hope they pay the ransom too, or they don’t count as a notch on your tally of victims.

All of this only works on the assumption that the ransomware authors will actually provide an unlock key and that is certainly up for debate. It’s also probable that victims won’t want to risk friendships so they’ll end up trolling for random victims in chat rooms, social media and other fish in a barrel locations. In other words, like common or garden script kiddies going about their daily business.

What a mess!

As Graham Cluley mentions, you don’t want to risk getting into trouble with the law because you decided to save yourself by torching the data of others. Should you fall victim to a piece of ransomware, don’t give up hope – many of these files are poorly coded and in many cases, members of the security community, independent researchers, security firms, and more besides manage to come up with decryption tools.
Virus Protection Install Norton Security 

See More Details : Norton setup | Norton setup install 

Tuesday, 13 December 2016

Fundamental Endpoint Security Best Practice: Securing Privilege on the Endpoint

Information security professionals know there are two fundamental endpoint security practices that should be part of their security program in order to reduce the attack surface. Validated by various government information security organizations and industry analysts, the first practice is application patching, and it has been widely adopted thanks to commonly available enabling tools. The second is securing privilege on the endpoint.

As part of the research conducted for the “CyberArk Global Advanced Threat Landscape Survey 2016,” 750 IT decision makers were asked if their organization’s users have local administrative privileges on their endpoint devices. Sixty-two percent said yes.

Removing local admin rights from workstations is perceived to be a difficult trade-off between security and usability. This is because the end-user often has to contact the desktop support team for the most trivial of tasks, resulting in lost productivity.

This also increases the burden of work for the support team, which can lead to missed service level agreements and increased support costs. The overall result can be a stand-off between the information security and desktop support teams.

Plugging endpoint security gaps

 To compensate, organizations have added layers of preventative endpoint security, including anti-virus, personal firewalls, intrusion prevention, application and device control.

Even with these in place, many view a network breach as inevitable. In response, data loss prevention (DLP) has been deployed to detect and block attempts to exfiltrate sensitive information. In many instances, file and full disk encryption has also been added to ensure that any information stolen is useless – unless the attacker also steals encryption keys.

Today the perceived choice is either to bet on yet more prevention controls or follow the continued acceptance that a breach is inevitable, and therefore, opt to add detection and response capabilities. These complement prevention controls by helping organizations to understand when and where malicious activity might occur on their network; unfortunately, they often offer too little too late, especially with the current ransomware trend.

Enforcing least privilege

What if information security professionals could go back to that fundamental best practice that is missing? If they can overcome the objections to deploying technologies that allow them to do what they know is right, their endpoints could be far more secure. There are better options today. For example, combining least privilege management with application control allows revocation of local administrator rights, but also offers elevation of privilege for trusted applications when needed.

Facilitating application control

Application control can provide significant additional benefits, such as enabling a policy-based approach to allow known good applications to execute while blocking malicious software. There are two common objections to this approach, which CyberArk has addressed – manual policy creation and the binary approach of white and black listing.

By trusting sources of files, such as those from software distribution tools or file shares, and those with trusted signatures, CyberArk has found that 99% of applications can be automatically added to the policy. The final 1% do not have to be treated in a binary manner. This is the practice that creates a user productivity issue and generates a help desk call when the user tries to install a new application. You can run unknown applications in a restricted mode but prevent access to sensitive information, network shares and the Internet. If the application is malicious, the threat is contained on the endpoint..

Containing attacks on the endpoint

Least privilege combined with application control is a security best practice to contain attacks on the endpoint. As part of a program to secure privileges on the endpoint, consider protecting Windows credentials and those stored by popular browsers too. If you can detect and block credential theft attempts, you will stand a far better chance of containing an attack on the endpoint

CLICK HERE

Tuesday, 29 November 2016

Symantec to Acquire Lifelock to Form World’s Largest Digital Safety Platform for Consumers and Families

We are excited to announce that Symantec has signed an agreement to acquire LifeLock reinforcing our commitment to providing people everywhere the freedom to enjoy their digital lives. We expect to complete the acquisition in the Spring of next year.  Symantec and LifeLock will work together to ensure a seamless transition, without any interruption of your current Norton and LifeLock offerings.  When the time comes, we’ll reach out to let you know about the exciting new ways we’ll continue to serve you.

For more information, click here.

Thanks,

Gayathri Rajendiran


Norton Forums Administrator


Symantec Corporation

Wednesday, 23 November 2016

Brand-New Ransomware Bart Follows Footsteps of Dridex and Locky

Although Dridex (W32.Cridex) and Locky (Trojan.Cryptolocker.AF) have been unusually quiet, a new type of ransomware may be taking their place on the online threat landscape. Bart, a new ransomware variant, introduced by the same cybercriminal group behind Dridex and Locky, was spotted late last week.


ProofPoint researchers recently observed a large malware campaign distributing .zip attachments — mostly labeled as photos, images, or pictures — that contained JavaScript code (JS.Nemucod). Once opened, the attachments download and install RockLoader (Downloader.Zirchap) malware, which in turn downloads the Bart ransomware.


Bart then encrypts files with certain extensions on compromised computers. It displays its ransom note through a text file and the desktop wallpaper. Then the ransomware demands payment from the victim, promising that the encrypted files will then be decrypted.

How to Stay Protected

Norton security products protect your computer against Bart. If you have Norton Security on your computer, it will detect the Bart ransomware. Remember, backing up your files is a preemptive strike against cybercriminals who try to hold your information for ransom. Under no circumstances should you pay the ransom, as it’s not guaranteed that you will get your data back. CLICK HERE

Tuesday, 22 November 2016

Norton 22.8.1 Product Update available now

Norton Security 22.8.1.14 is now available via LiveUpdate. As with our previous updates, this version is being released in a phased manner in all supported languages. To download this update, simply run LiveUpdate.

This update is available for the following Norton products with versions 22.8.0.50 and 22.7.1.32:

To verify you have the update, launch the Main User Interface, click on Help, and select About.






What is the version number for this patch?

  • The version number is 22.8.1.14. This update is currently available via LiveUpdate only.
When will I receive the patch?

  • As is our standard practice, we are deploying the patch in a phased manner. We have released the patch to randomly selected customers, and will then monitor our telemetry, as well as this forum, for any problems or issues.  Once we have confirmed the effectiveness of the patch, we will make it available to all customers. We will post an update on the Norton Community Forums when we make the patch available to all customers.

How can I manually install these patches?

  • This patch is only available via LiveUpdate, and is being released in a phased manner.

I see the engine for this version on my system, but my product hasn’t updated. What’s wrong?

  • Nothing is wrong; that’s how our updates are distributed for the phased approach. The update comes in two parts, and most people will get the engine. Both parts together will get your product updated. You may need to run LiveUpdate and reboot a few times before your product is completely updated to the latest version.

What’s new?

  • Introducing Norton Shopping Guarantee (NSG) – US – English Only

What are the changes in this release?

  • Fixed an issue where Identity Safe login loops and gets back to the ‘Get Started’ screen.
  • Fixed an issue where ‘Your version of Norton Security is not compatible…’ message appears in action center notification after upgrading to Windows 10.
  • Fixed an issue where product patches were failing to apply.
  • Removed Soft-block on Malwarebytes & Hitman Pro.
  • Fixed an issue where Norton conflicts with Windows Bitlocker and causes High CPU usage
  • Other bug fixes.
Note: This patch requires a reboot in all Operating Systems

CLICK HERE