Look Back into the First Major Cyberattack: The Morris Worm

Thirty years ago, the Morris worm, dubbed as the first major cyberattack, was unleashed into the wild, crashing or slowing to a crawl 10% or 6,000 of the 60,000 computers then connected to the “Internet”. 

What Is Morris Worm?

Morris worm is named after its creator Robert Tappan Morris. A worm, meanwhile, refers to a type of malicious software (malware) that has the ability to spread itself within networks without user interaction.

Courtdocuments showed that Morris, then a first-year graduate student at Cornell University's computer science Ph.D. program, released the worm on November 2, 1988 through a computer at the Massachusetts Institute of Technology (MIT), which Morris hacked using a Cornell University's computer.

Morris worm was released into the wild a year before the world wide web came into existence. The term “Internet” then referred to a U.S. computer network, composed of connected computers from prestigious colleges, research centers, governmental and military agencies.

In less than 24 hours on November 2, 1988, Morris worm infected the computers of institutions, including Harvard, Princeton, Stanford, Johns Hopkins, National Aeronautics and Space Administration (NASA) and the Lawrence Livermore National Laboratory.

While the worm didn’t destroy or damage files, infected computers slowed to a crawl or ceased functioning and emails were delayed for days. The estimated cost of dealing with the Morris worm at each installation ranged from $200 to over $53,000.

The worm infected computers running a specific version of the Unix operating system in 4 ways:

First, via a security vulnerability in “SEND MAIL”, a computer program that transfers and receives electronic mail;

Second, via a security vulnerability in the "finger demon", a computer program that allows extraction of limited information about the users of another computer;

Third, via "trusted hosts" feature that allows a user with certain privileges on one computer to have equivalent privileges on another computer without using a password; and

Fourth, via a program that guesses passwords using various combinations of letters tried out in rapid succession, hoping that one will be an authorized user's password. When the correct password is entered, the intruder is allowed whatever level of activity that the user is authorized to perform.

Morris designed the worm to stay hidden. The worm was designed in such a way that it won’t copy itself onto a computer that already had a copy. The worm was also designed in such a way that it would be killed when a computer was shut down.

Consequences of the Morris Worm

For unleashing the worm into the wild, Morris became the first person convicted for violating the U.S. Computer Fraud and Abuse Act, which outlaws unauthorized access to protected computers. He was sentenced to 3 years of probation, 400 hours of community service, a fine of $10,050 and the costs of his supervision.

The first major cyberattack perpetrated by the Morris worm showed how vulnerable interconnected computers had become. Just days after the Morris worm attack, the U.S. Government created the country’s first computer emergency response team under the direction of the Department of Defense. Developers also began creating intrusion detection software.

On the flip side, the Morris worm inspired a new breed of malicious hackers, plaguing the digital age. In recent memory, the worm that resembles the devastation caused by Morris worm is the WannaCry worm, commonly known as WannaCry ransomware.

In less than 24 hours on May 12, 2017, more than 300,000 computers in 150 countries were infected by WannaCry, each demanding a ransom payment. WannaCry is categorized as a worm as similar to the Morris worm as it has the ability to spread itself within networks without user interaction.

WannaCry specifically exploited the security vulnerability in Server Message Block Protocol (SMB protocol) in some versions of Microsoft Windows. SMB protocol allows users to access files, printers and other resources on a network.

Prevention

Here are some cybersecurity measures to protect your organization’s computers or networks from worms similar to WannaCry and Morris worms:

Implement Network Segmentation

In network segmentation, vital computers that housed critical information and operations are separated or disconnected from computers connected to vulnerable systems like the public internet. Network segmentation ensures that when internet-facing computers are infected by a worm, these vital computers aren’t affected.

Keep All Software Up-to-Date

Make sure that software security updates are installed as timely as possible, not months or years after the release dates of the security updates.

Cyberattackers have automated the process of scanning the internet for finding vulnerable computers – those that fail to install security updates. This was the case for WannaCry victims as they failed to install the security update issued by Microsoft months before the WannaCry cyberattack.

Refrain from Using Legacy Hardware and Software

The term “legacy” refers to old and outdated computer hardware or software. Similar to computers that fail to timely install security updates, legacy hardware and software programs are similarly targetted by cyberattackers as these legacy hardware and software programs no longer receive security update from their vendors.

Some versions of the Microsoft Windows (Windows XP, Windows 8, and Windows Server 2003 operating systems) were targeted by WannaCry attackers as well as during the attack these software programs were no longer supported by Microsoft. A day after the WannaCry attack, however, Microsoft released security updates for Windows XP, Windows 8, and Windows Server 2003.

Protecting computers or networks from worms and other malicious software is important in order to prevent data breaches. Under Canada’s Digital Privacy Act, starting November 1 this year, private organizations are mandated to notify the Privacy Commissioner of Canada and the affected individual “as soon as feasible” in the event that a data breach poses a “real risk of significant harm” to any individual.

When you need help assessing and mitigating the cybersecurity risks, contact out team of expertsand minimize the likelihood of a data breach.

How to Prevent Departing Employees from Departing with Your Organization’s Data

1. Limit Employee Access to Data

Only give employees access to data needed to get their jobs done. For instance, engineers don’t need access to CRM systems.

2. Encrypt Critical Corporate Data

Ensure that critical corporate data, whether data is in-transit, at-rest and in-use, must be encrypted. Encryption ensures that even when there’s data breach, the data will remain useless.

3. Establish Regular IT Audits

While automated, preventative controls are the best defense, no technology is perfect. Establishing regular IT audits performed by an independent third-party will help you detect any outliers and detect data leaks and internal fraud early on. Such audits generally include

4. Require Appropriate Authentication for Critical Content

Accessing critical content must require not just a username and password but also multi-factor authentication. When critical content is being accessed, it also helps that approval must be secured first or an alert must be given to a compliance officer.

5. Regularly Monitor Network Activities

Unusual volume of downloaded data and non-office hours data access are examples of network activities that should be monitored. Said network activities are red flags for unauthorized activities and should be checked.

6. Keep Critical Data Offline

Don't store information vital to your organization, especially trade secrets, on any device that connects to the internet.

7. In-Person Data Security and Privacy Training

One of the means, though not a cure-all approach, of preventing departing employees from stealing corporate data is by providing an in-person data security training the moment the employee is hired.

One training session isn't enough. It's best to regularly remind employees about safeguarding company’s data by implementing a regular, formal cybersecurity awareness training. In addition to the in-person data security and privacy training, a confidentially or non-disclosure provision has to be included in the employment contracts.

8. Don’t Give Employees Administrator Privileges

Don’t give employees administrator rights for the company-supplied computers or devices. Giving them administrator privileges allows them to install malicious software (malware) that could lead to unauthorized access to information vital to your organization.

What is Remote Code Execution Attack & How to Prevent this Type of Cyberattack

Microsoft recently rolled out its latest security update, fixing 50 security vulnerabilities. Out of the 50 security vulnerabilities fixed by Microsoft in its June 12^thsecurity update, 14 security vulnerabilities allow remote code execution.

What is Remote Code Execution?

Remote code execution (RCE) refers to the ability of a cyberattacker to access and make changes to a computer owned by another, without authority and regardless of where the computer is geographically located.

RCE allows an attacker to take over a computer or a server by running arbitrary malicious software (malware). "RCE (remote code execution) vulnerabilities are one of the most dangerous of its kind as attackers may execute malicious code in the vulnerable server," Impervasaid.

Remote Code Execution Example #1: Microsoft Excel Remote Code Execution Vulnerability

One example of a remote code execution vulnerability is the CVE-2018-8248vulnerability – one of the security vulnerabilities fixed by Microsoft in its June 12^thsecurity update. The CVE-2018-8248 vulnerability, also known as “Microsoft Excel Remote Code Execution Vulnerability”, allows an attacker to run a malware on the vulnerable computer.

The CVE-2018-8248 attacker could take full control of the compromised computer if the owner of the compromised computer logs on to the computer with administrative user rights. In taking full control of the compromised computer, the attacker could view, change or delete data; install programs; or create new accounts with full user rights.

According to Microsoft, the delivery method in exploiting the CVE-2018-8248 vulnerability could be in the form of a malicious email with an attachment that contains a specially crafted file with an infected version of Microsoft Excel. Another delivery method in exploiting the CVE-2018-8248 vulnerability is in the form of a web-based attack scenario, whereby an attacker could host a website or compromised website that accepts or hosts user-provided content containing a specially crafted file designed to exploit the CVE-2018-8248 vulnerability.

In the 2 scenarios, malicious email and web-based attack, the attacker has to convince users to click on the attachment or a link to open the specially crafted file. To date, there’s no report that CVE-2018-8248 vulnerability has been exploited into the wild.

Remote Code Execution Example #2: Microsoft Windows SMB Vulnerability

On May 12, 2017, hundreds of thousands of computers worldwide were infected by WannaCry, a malware that encrypts computer files, locking out computer users and asks for ransom payment to decrypt or unlock the computer files.

WannaCry, as it turns out, is a malware that allows remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block (SMB) – a protocol used for sharing access to files, printers and other resources on a network.

Unlike other remote code execution attacks which leverage on malicious emails and web-based attacks as delivery methods, WannaCry’s delivery method was scanning the internet for vulnerable SMB ports and using one of the alleged U.S. National Security Agency (NSA) spying tools called “EternalBlue”, which takes advantage of the vulnerability in Microsoft’s SMB. Once an attacker detects SMB vulnerability, the DoublePulsar (another alleged NSA spying tool) is then used by an attacker to allow for the installation of the WannaCry malware.

EternalBlue and DoublePulsar are 2 of the spying tools allegedly used by the NSA that were leaked in April 2017 by a group of hackers who called themselves Shadow Brokers. According to Microsoft, the security vulnerabilities exposed by Shadow Brokers were fixed by the security update released by the company in March 2017 – a month before Shadow Brokers publicly released the alleged NSA spying tools.

Researchers at Renditionreported that in late April and the first few days of May 2017 – several days after Microsoft issued a security update fixing the security vulnerabilities exposed by Shadow Brokers, more than 148,000 computers were compromised by EternalBlue and DoublePulsar.

Hundreds of thousands of computers were infected by WannaCry as many compromised machines were used as servers and because of the worm or self-propagating capability of this malware. As a result, computers connected to the infected servers were also infected by the WannaCry malware.

Remote Code Execution Attacks and Cryptocurrency Mining

At the height of the cryptocurrency boom in December 2017, Imperva reported that cryptocurrency mining drove almost 90% of all remote code execution attacks.

Imperva said 88% of all remote code execution attacks in December 2017 sent a request to an external source to try to download a cryptocurrency mining malware.

“These attacks try to exploit vulnerabilities in the web application source code, mainly remote code execution vulnerabilities, in order to download and run different crypto-mining malware on the infected server,” Imperva said. “The malware usually uses all CPU computing power, preventing the CPU from doing other tasks and effectively denies service to the application’s users.”

Prevention

Timely patching or timely installation of software update ranks as the top cybersecurity measure in preventing remote code execution attacks.

For instance, to prevent remote code execution via CVE-2018-8248 vulnerability, Microsoft’s June 12, 2018 security update has to be installed. In the case of WannaCry cyberattack, remote code execution via the exploitation of Microsoft Windows SMB vulnerability could have been prevented if only Microsoft’s March 2017 security update had been timely applied.

To prevent attackers trying to infect vulnerable servers with cryptocurrency mining malware, the initial attack must be blocked. As an initial attack, cybercriminals typically exploit remote code execution vulnerabilities to launch their malware, similar to what WannaCry attackers did.

If your organization is using computers or servers that are known to be using software that’s vulnerable to remote code execution, the latest vendor patch to mitigate this particular cyberattack should be timely applied.

As a rule of thumb, to significantly minimize the risk, your company must collect, analyze and act on the most recent threat intelligence. Your IT team must be equipped with the best tool to apply patches timely thus mitigating the risk of a data breach. Better yet, workstation and server patching can and should be automated to prevent remote code execution and other cyberattacks.

Call us todayor send an emailto speak with our security experts about processes and technology to help your organization mitigate IT and cybersecurity risks.

Are You Failing to Protect Yourself Against Fraud?

Online fraud is, sadly, a common danger.

More than 15 million people fell victim to it in 2016, and the risk is still very much present. Companies across all areas of industry must take steps to protect their finances, making any changes necessary to minimize threats.

Some of these may seem simple, while others appear a tad more complicated. As specialists in cybersecurity, we’re dedicated to helping businesses like yours stay safe against ever-more sophisticated tactics.

So, what changes can you make to your everyday operations to combat online fraud?

You Ignore the Warning Signs

Seeing new customers make large purchases can be an exciting time, but you need to be aware of some common warning signs.

Orders placed late at night could be a red flag, while large orders of products that can be resold easily are another fraud giveaway to watch out for.

Another red flag? Multiple attempts to buy an expensive item (or items) with the same payment method, but with minor differences in the expiration date or name.

Purchases made by buyers who have been repeat customers for a long time should be watched if they make an unusual change in their purchases, address, contact details, and order size.

Last but not least: be wary of customers buying goods with a domestic billing address but sending the purchases to international locations. This is especially true if multiple international addresses are used.

You Don’t Invest in the Best Security

In our experience, too many businesses – both big and small – invest too little into their cybersecurity. Even though businesses are expected to spend more than $100bn on online protectionin 2020, it’s still not uncommon to see companies letting themselves down.

It’s easy to assume you can handle your business’s online security when you first enter the market. After all, download some anti-virus software, get yourself a firewall – job done, right?

Sadly, it’s not so simple. Finding the budget for high-quality security protocols can be difficult, but it’s vital – you’re reinforcing your company’s infrastructure, protecting your assets, and minimizing further expense.

In other words: take the danger of online fraud seriously. Your customers and your employees are depending on you to keep their details, their salaries, and safer.

You Haven’t Educated Your Team

Your workforce has to be educated on the signs of online fraud, trained in criminals’ latest tactics and the techniques available to combat them.

After all, they’re the people keeping your operations running day in, day out. They’re handling customers’ purchases, processing transactions, communicating with buyers, using your databases, downloading resources, and more.

Uninformed staff may end up making mistakes that leave your business vulnerable, facing fraudulent activity, and ultimately at risk. When they have the information and the training, they can actually be a much-needed defense against cyber criminals preying on companies like yours.

Make sure you host regular meetings to train your employees on the cyber-security threats they are likely to encounter, and the warning signs they should watch out for. This doesn’t have to be at an expert level, as you don’t want to overwhelm or confuse them, but it should be enough to give them the confidence they need to perform at their best.

Your staff should know enough to identify possible fraudulent behavior, handle customers’ personal information properly, and avoid leaving your business exposed.

You Haven’t Implemented a Reliable Password Policy

Passwords have to be strong, hard to guess, and varied. Make sure your employees and your customers have the information and advice they need to avoid weak passwords.

We all have so many passwords to remember today. Many of us run numerous different aspects of our lives online, relying on online banking, online shopping, online communications … it’s easy to be complacent.

However, complacency leads you to use the same passwords again and again. Your customers may simply create an account and make purchases with your business, but inadvertently let someone else know what their password is.

This could lead to fraudulent purchases, and the customer might blame your company for failing to offer them sufficient advice on how to best create efficient passwords.

It’s vital, then, to provide helpful information at the sign-up stage, and a dedicated page on your site. Make sure they know not to use something simple and easy to find out, such as their child’s name or their birthday. Varying letter case, adding symbols and numbers, and combining words to make longer passwords can all be a big help.

Your employees should follow the same strategy. Using the same password in their work emails or accounts as their personal ones can make increase your business’s vulnerability.

You Don’t Run Background Checks on Your Employees

Hiring employees with a history of criminal activity or suspicious behavior in previous roles (leading to dismissals) can be an easy way to expose your business to fraud.

Running background checks may seem to be something of a hassle, but it’s well worth doing to protect your company. This should consist of criminal background checks, their education, and their past employment – you will have the information to identify who you have working for you.

Trust goes a long, long way in maintaining an efficient, satisfied workforce. If you know your team is unlikely to undertake fraudulent activity and put your company’s and your customers’ data at risk, you can focus on combating external dangers instead.

Employees will generally accept that these background checks are par for the course. Though it might seem intrusive, it’s for the good of your company, your clients, and your reputation.

Online fraud is an intimidating area and makes businesses of all sizes feel vulnerable. Taking the steps explored above is an effective start to a stronger infrastructure, but you should trust the professionals to reinforce (and maintain) your business’s cybersecurity program for maximum protection against threats.

Contact ustoday to assess your risks and protect your business.

Top 7 Cyber Security Tools for Your Business

With so much of our information online, everyone is vulnerable to hackers and cyber-thieves. When it comes to business, a cyber invasion is a constant threat.

Short term loss could be financial, intellectual property theft, data loss, or worse.

The real threat is the long term loss of trust and reputation damage that could take years to repair. If your clients' information is exposed, it will be hard for them to consider it safe to give you their business again. 

Protect your business with these 7 cyber security tools.

7 Cyber Security Tools Your Business Must Be Using

In order to protect your business' digital information, you need a variety of cyber security tools in place. 

For complete peace of mind, you'll want to work with a trusted cyber security partner. In the mean time, these tools are a great place to start. 

1. Malware Scanners

Malware is short for malicious software. It is designed by hackers to gain access to a computer without the owner's knowledge. 

You must have specific anti-malware cyber security tools in place to detect any hacker invasion. 

There are a variety of malware scanners out there, many even available for free (with limited features). 

Protect your business with automatic malware scanners in place. 

2. Routine Patching

Patching is the process of installing a piece of software that repairs any security flaws. Updating an app is an example of patching. 

Picture your business's digital infrastructure as a house. Each time you add a new application, piece of software, etc. it's like adding a new room to the house. 

Software, apps, and the like are built by humans, meaning that there is room for human error. Human error is like an unlocked door or unfinished window in one of the new rooms. 

This can leave a welcome mat out to cyber attackers. That's why your security plan needs to include routine assessments and patching. 

3. Two-Factor Authentication

Use two-factor authentication to add a difficult-to-hack layer of security to your log in systems.

Examples include a verification code sent to a linked phone number or a piece of information only the user would know. 

4. Restrictive Administrative Access

Add an additional security level for your most sensitive information and infrastructure by restricting who can access it.

Click here for more information on how to implement restrictive admin mode. 

5. Network Segmentation

Divide your computer network into sub networks to improve security and performance.

This allows you to isolate the most sensitive data to a specific network to limit access and decrease congestion. 

6. Vulnerability Scanning

There's no better way to access your security levels than a vulnerability scan. 

Try our free vulnerability assessment to find weaknesses in your code and how to remedy them. 

7. 24/7 Security Monitoring

Cyber security protection doesn't come in the form of a quick fix.

Continually protect your business' data with a 24/7 security monitoring system in place to catch attacks the minute they happen. 

Protect Your Business for Peace of Mind

Cyber security tools are of the utmost importance for businesses and individuals alike.

Questions? Let us know if there is anything we can help you with. Our emergency response team is available 24/7 if you're currently dealing with a cyber attack. Contact us today. 

New Bluetooth Malware Puts Billions of Devices at Risk

Is Cyber Insurance for Small and Medium Businesses Worth the Cost?

Counting the Cost of a Cyber Attack: Litigation Cost

In the last 12 months, Canada has seen high-profile data breach class action lawsuit settlements. These data breach lawsuit settlements highlight the added cost of a cyber attack: cost of defense and a judgment or settlement.

5 Ways a Cyber Security Consultant Can Help Your Business

Businesses are constantly burdened with the risk of security breeches. Learn how working with a cyber security consultant can alleviate those headaches.

Think only large corporations get targeted? Think again.

In 43% of cyber security events, a small business was actually targeted.

In the event of a cyber attack, your small to medium sized business (SME) could experience multi-million dollar losses in financial, operational and data breaches, as well as, reputation damage. The average SME -- even one with insurance -- would take quite a blow from this type of attack.

A cyber security consultant can help you both prevent attacks and better manage attacks that occur to protect you and your customers.

Let's explore how.

Supplementing In-House Capabilities

The skill and scope of cyber attacks is ever-increasing. Even organized crime is getting in on the action.

As regulators work to keep pace with burgeoning events, even a dedicated department, team or individual may struggle to keep up. They may be bogged down with operations.

A cyber security consultant stays up-to-date. They can get a panoramic view of your organization and its vulnerabilities. They can help keep your business safer.

Preventing Attacks

A cyber security consultant will go in depth to identify weaknesses in your systems and processes.

Have you safely integrated cloud storage into your systems? How strong are your encryptions? Can transferred data be intercepted?

And potentially the most elusive of all must be addressed. How are you protecting yourself in the event of inevitable human error?

Despite your best efforts to keep systems secure, could you see any of these scenarios happening in your organization? Someone:

• Clicks on a link
• Logs into their workstation through an email link from a nefarious source
• Brings an infected device into your network unaware
• Visits a questionable website on their work laptop while on their home network, downloads something and then re-joins the network
• Integrates questionable 3rd party software that opens you up to attacks
• Intentionally stealing data

A consultant can help you prevent attacks, including those that result from human error or ill-intent.

Mitigating Damage

Data breaches happen. This may be the last thing you want to hear a consultant say. But we'd be dishonest if we said otherwise. And we're not telling you anything that you don't know already.

The difference between $10 thousand in losses and $200 million is largely based on how your organization has invested in the risk management of security breaches.

Through risk management you can put systems in place to spot an attack sooner and limit its scope. Without a consultant, you may not be doing all you should to mitigate damage.

Protecting Customers

Cyber security consultants help you protect your customers/clients. Without them, you don't have a business.

By taking the additional steps of bringing in cyber security consultants, you demonstrate that you care about protecting those who've helped you become what you are today. 

That's good for business and your customers.

Crisis Management

Cyber security consultants know how to handle the heat of an event. They're accessible and ready to help you execute your plan to mitigate damage, comply with regulation and keep your company safe.

Get the Right Cyber Security Consultant

A consultant will help you fill in the gaps in your own security plan and develop a plan to both prevent attacks and reduce damage. For more information on how our cyber security consultants can help your company, contact us today.

How to Choose the Ideal Cyber Security Company

Looking for a cyber security company? Protecting your business in not a luxury, it's a necessity.

2016 saw more cyber security breaches than any other year on record. In fact, according to the Identity Theft Resource Center (ITRC), 1,093 attacks occurred that year--up 40% from the year before.

The ITRC reports that most of the data breaches were the result of email compromise schemes. The second most common type of breach was the result of accidental email or internet exposure of information--employee errors.

Are You Protected?

The Financial Post reports that about 36% of Canadian IT professionals know their companies have experienced a security breach. Many breaches go undetected and reporting them is critical to your company's future.  These breaches can harm not only the business that's been attacked but the clients that are served by the businesses.

An attack has many costs, and one of them is the trust a client puts in you--you may lose that trust and it'll cost you.

Is your company putting its clients and customers at risk for identity theft? If your answer is maybe, read the easy guidelines below that will help you find a cyber security that will meet your company's needs.

Finding the Right Cyber Security Company

Ensure that the company you hire bases its work on the three pillars of cyber security: people, processes, and technology.

People

Within you company, everyone should receive proper training about how to avoid making your network vulnerable.

At the company you hire, the employees should strive to keep up to date with the most current threats and the technology to thwart them.

Process

Your organization must have standards in place that operate as the rules for how to avoid a cyber attack. These standards should be managed by an information security management system that can be put in place by your own technicians or by the cyber security company you hire.

Technology

The technology you employ must be up to date to counter current threats. This should include malware protection, secure mobile and web use for employees, network security, and secure configurations.

Conflict of Interest

Ensure that the firm you want to hire doesn't have a relationship with hardware or software companies that might keep them from having your best interests at heart. Hopefully, you can find a firm that has developed its own technology and isn't relying on someone else.

Going along with the idea of having your best interests at heart, can the firm you're considering tailor their services to your business? Or do they only do one thing for everyone who hires them?

Are They Insured?

Did you know that cyber security companies should carry insurance just like any other contractor you hire?

Who Else has Hired Them?

Find out what other companies trust the firm you're considering. Are some private, some public? Are some commercial and some government?

You want someone who has represented a variety of businesses so that you can benefit from what the firm has learned in dealing with a range of issues your own company may or may not encounter.

In other words, you want the firm you hire to be prepared for anything that may come your way.

What to do

If what you've read has come as news to you, consider finding help. Your business is on the line and the trust your clients and customers place in you is at stake. Act today.