Could your computer be making someone else rich?

Fortinet, the global player in high-performance cybersecurity solutions, has issued an advisory to users to check their computers if they feel that the devices are acutely slowing down. They could unwittingly be donating computing power to cybercriminals who are "browser cryptojacking".

Fortinet’s FortiGuard Labs researchers have been discovering more and more of such incidents, which are essentially a new trick used to stealthily mine Monero cryptocurrency using stolen CPU resources, the company said. This is done by loading a rogue script into the web browser. The script contains a unique site key that works to enrich cybercriminals with Monero currency every time they visit certain websites.

Browser cryptojacking was discovered last September when a new technology to mine Monero cryptocurrency within web browsers surfaced. The script was written in JavaScript and is easily embedded into any web page. Once a computer user visits compromised pages, their computing power is hijacked for mining the currency*. The more time users spend on such web pages, the more CPU cycles can be consumed. Hackers typically pick illicit video streaming web sites, where people stay for hours watching movies or TV serials, to plant such scripts.

Back-of-the-envelope calculations by security researchers show that cryptojacking can be lucrative − hackers targeting popular illicit sites like The Pirate Bay can earn up to US$12,000 per month.

Fortinet advises that if users hear computer fans running at full speed without any apparent reason, they can check their CPU usage. Go to Task Manager on Microsoft Windows by pressing the [Ctrl]+[Shift]+[Esc] buttons at the same time, or Activity Monitor on the Mac, and Top at the Linux command line.

The above commands will list all the processes running on the computer, allowing users to find the culprit (usually the web browser, e.g. Google Chrome) by ranking which process or software has the highest CPU consumption. Once identified, stop the culprit by right-clicking on the process and selecting “end task”, “kill” or “terminate” respectively. This ends your current connection to the compromised website. After that, users can reopen their browsers and visit other sites without problems.

The next step is to prevent your computer from being cryptojacked again. Install an anti-adware web browser extension, as well as web filtering and antivirus tools on your computer, and keep these updated. Fortinet also advises users to refrain from visiting illicit sites.

“When using computing devices, it pays to always be situationally aware and look out for anomalous things, be it your fan speeding up or an email offering something too good to be true,” said David Maciejak, Director of Security Research, Fortinet. “Cyberspace is a perilous place full of schemers trying to take advantage of the gullible. Deploying the right security tools to protect yourself will help, but being cautious and thinking twice before taking any action will also go a long way in preserving your money, confidential data and computing experience.”

*This refers to making complex mathematical calculations that satisfy certain rules to successfully "discover" a unit of cryptocurrency. Each computer that helps to make the calculations is assigned a unique serial number and is entitled to a share of that unit. Many attempts have to be made to mine cryptocurrency successfully, ensuring its scarcity.

Home networks need to be more secure

Faster and more affordable Internet connections are driving more home users in Southeast Asia to deploy Internet-connected devices at home. At the same time, connectivity is enabling more employees to work remotely, including from home. While connected devices at home provide greater convenience and enable faster communication, ‘home networks’ can become easy targets for cyber criminals, cautions Fortinet, a global player in high-performance cyber security solutions.

“Recent Internet of Things (IoT) -based attacks have revealed the sheer volume and ease by which billions of connected devices can be weaponised and used to disrupt the digital economies of entire countries and millions of users. These issues are compounded by the lack of basic security features and management capabilities in many IoT devices,” said Peerapong Jongvibool, VP, Southeast Asia and Hong Kong, Fortinet.

“As our work and social networks expand into the home, so does the potential threat footprint. With more employees working from home, corporate offices are being regularly linked to these hyper-connected and often poorly secured home networks. It is critical that we take a fresh look at how we are protecting ourselves from the growing number of networks we interact with.”

Sensitive personal, financial and medical information, as well as work assets are all at risk from increasingly sophisticated malware and financially motivated cybercriminals, Fortinet says.

According to market research firm IDC, there will be nearly 9 billion connected devices across Asia Pacific by 2020. Connected devices on the home network range from smart TVs, entertainment and gaming systems, smart refrigerators, to online home security systems. Many home networks also include wireless medical devices, and tools designed to track and monitor children or elderly family members. All of these devices are connected to the Internet through a home Wi-Fi system, or increasingly, a home area network (HAN) combined with network-attached storage (NAS) and cloud-based applications that are accessible from any device, anywhere.

Fortinet proposes three strategies for home users to secure increasingly complex home networks:

1. Learn

With the increasing number of portable IoT and other devices installed or used at home, it may be difficult to know exactly what is on the home network at any given time. Even harder is controlling what they are allowed to do. There are a number of security tools specifically designed for the home which can identify devices looking to connect to the Internet through Wi-Fi network. Many of them can be easily configured to provide them with access to the guest network, while restricting and monitoring the kind of traffic they are generating.

Before purchasing a device that wants to connect to the network, ask some questions. Not every device that wants to connect to the network needs to.

Next, research these devices with an eye towards security. Many connected devices include vulnerable software or backdoors that make them potential targets. And far too many of these devices cannot be hardened, patched, or updated.

2. Segment

Home owners can apply a network segmentation strategy to protect their resources.

Buy separate wireless access points for separate uses, like gaming systems and IoT devices versus PCs and laptops.

Set up a wireless guest network for visitors or new devices. Most access points allow users to restrict access, set up things like firewalls, and monitor guest behaviour.

Consider purchasing a separate, inexpensive device that is only used for sensitive tasks like online banking. Users could also set up a separate virtual device on their laptop or PC for banking online to protect their critical resources.

Keep work and personal devices separated. Set up a separate connection for work, only connect through a VPN tunnel, and consider encrypting sensitive data travelling back and forth between home and corporate networks.

3. Protect

Home networks and devices tend to become infected because security is notoriously lax.

Keep a list of all the devices and critical applications on your network, including the manufacturer. Set up a weekly routine to check for updates for physical and virtual devices, operating systems, applications, and browsers.

Get antivirus and anti-malware software, keep them updated, and run scans regularly. Remember that no software is 100% effective, so set up a regular schedule, say once a month, where a second or third security solution is used to scan devices or networks. Many solutions provide a free online version or let users run a free trial or demo version for a period of time.

Get a firewall. Most home security packages include a firewall option. Turn it on. Even the default settings are better than doing nothing.

Use good password hygiene. Change your passwords every three to six months. Use a password manager to store passwords. Use different passwords for different kinds of things. Do not mix personal and work passwords.

Password managers have been developed to help manage passwords, and all that is needed is to keep track of a single master password. This technology will also automatically create strong random passwords for each application, and store them in an encrypted format.

“Given the rate at which technology is changing, users can no longer afford to simply load an antivirus tool onto their laptop and think they are going to be protected. As users begin to use and interconnect more and more devices, and blend their personal, social, and work lives, security is increasingly important,” said Jongvibool. “It is critical that users begin to develop a strategy now for learning, segmenting, and protecting their network, resources, data, and privacy.”

posted from Bloggeroid