Security roundup: Top 10 hacking methods, why you should never pay ransomware

This week we take a look at the 10 most popular hacking methods, why you should never pay a ransom to get your files back, and more.

Top 10 most popular hacking methods
Balabit’s recent CSI report has revealed the top 10 most popular hacking methods to aim to help organisations to understand which methods or vulnerabilities attackers are using the most – or taking advantage of – when they want to get sensitive data in the shortest time.

The key finding of the survey is that outsiders want to become insiders with the least possible effort, and insiders help them do so – mostly accidentally.

1. Social engineering (e.g. phishing)
2. Compromised accounts (e.g. weak passwords)
3. Web-based attacks (e.g. SQL/command injection)
4. Client side attacks (e.g. against doc readers, web browsers)
5. Exploit against popular server updates (e.g. OpenSSL, Heartbleed)
6. Unmanaged personal devices (e.g. lack of BYOD policy)
7. Physical intrusion
8. Shadow IT (e.g. users’ personal cloud-based services for business purposes)
9. Managing third party service providers (e.g. outsourced infrastructure)
10. Take advantage of getting data put to the cloud (e.g. IAAS, PAAS)

4 in 10 UK ransomware victims have paid to recover their documents
Bitdefender has discovered that 44 per cent of all ransomware victims in the UK have paid to regain access to their data, and predict this number to rise in the years to come. 39 per cent of victims found it probable or very probable that they will be attacked again in the future.

Catalin Cosoi, chief security strategist at Bitdefender said: “The ransomware phenomenon has been hitting internet users and generating huge profit for cybercriminals for years.

“While victims are usually inclined to pay the ransom, we encourage them not to engage in such actions as it only serves to financially support the malware’s developers. Instead, coupling a security solution with minimum online vigilance could help prevent any unwanted ransomware infection.”

Don’t pay ransomware, no matter how important your business is
Troy Gill, manager of security research at AppRiver, agrees with Cosoi’s advice.

With regards to the news that Hollywood Presbyterian Medical Council paid 40 bitcoins (about $17,000) in ransom to have its systems restored, he commented: "Feeding the fire by paying these guys should be avoided if at all possible. If you’ve been the victim of a ransomware attack, and you’re contemplating paying the ransom, keep in mind that the only reason these thieves keep making these attacks is because people are paying them. If all of the victims stopped paying ransoms, they wouldn’t have a successful business model, whose core objective is to steal your money.

“Also, there is no honour amongst thieves so don’t be surprised if they take your money and never give you the key to unlock your files. Additionally, these thieves are often associated with larger criminal organisations, that use the money to fund their illegal activities, so do you really want to reward them further?"

"Better security and user awareness can help minimise the likelihood of a ransomware infection. Organisations that back up their files, update their software and hardware, and have layered, redundant security, shouldn’t find themselves in this predicament."

1 in 5 UK enterprises suffered at least one mobile security breach in 2015
Wandera has a revealed the growing threat of mobile security breaches in UK companies.

In a survey of over 500 IT decision makers in the UK, 18 per cent of respondents reported suffering at least one security breach via a mobile device in the last 12 months, with an average ‘clean up cost’ of £167,000.

In other news:
– Kaspersky Lab has announced the discovery of the Poseidon Group, an advanced threat actor active in global cyber-espionage operations since at least 2005.
– Cyber Security Partners (CSP), a subsidiary of Marketing Source, has launched its new real-time, data-driven, cyber threat detection platform, Zero.
– Symantec has announced that Norton Security won AV-TEST’s coveted “Best Protection Award 2015” for home user security.

Hacker image: Shutterstock