Posted on

Our Top 5 Google Chrome Extension Picks For Better Web Security

Top 5 Google Chrome Extension Picks For Better Web Security

Security and privacy are some of the major concerns when using the internet. One of the more popular internet browsers Google Chrome allows users to add extensions to the browser adding new functionality. Here are our picks for the top 5 Google Chrome security and privacy extensions that you should install for safer web browsing along side using your SUPERAntiSpyware software on your PC.

Click on each link and it will bring you to the Chrome Web Store where you can learn more about the extension and its creators. Most of these extensions are available on other popular browsers, such as Mozilla Firefox or Opera so do not feel limited to only Google Chrome!

1) uBlock Origin – A lightweight ad-blocker and anti-tracking extension that is efficient on memory and CPU footprint.

2) Privacy Badger – Developed by the Electronic Frontier Foundation (EFF).  Privacy Badger is an anti-tracking extension that stops advertisers and other third-party trackers from tracking where you go on the web. Privacy Badger Works great alongside uBlock Origin.

3) HTTPS Everywhere – Developed by the Electronic Frontier Foundation (EFF) and The Tor Project. HTTPS Everywhere ensures that you always connect to a website using a secure HTTPS connection if one is available. HTTPS is a form of encryption making your browsing much more secure.

4) DuckDuckGo for Chrome– DuckDuckGo is the search engine that doesn’t track you. This add-on makes DuckDuckGo your default search engine and includes some other useful features.

5) LastPass: Free Password Manager – “Only remember one password. Your LastPass master password. Save all your usernames and passwords to LastPass, and it will auto-login to your sites and sync your passwords everywhere you need them.”

Do you have any Google Chrome extension recommendations? Feel free to leave a comment below!

–SUPERAntiSpyware Team

Posted on

Our Top 5 Mozilla Firefox Extension Picks For Better Web Security

Top 5 Mozilla Firefox Extension Picks For Better Web Security

Security and privacy are some of the major concerns when using the internet. One of the more popular Open Source internet browsers Mozilla Firefox allows users to add extensions to the browser adding new functionality. Here are our picks for the top 5 Firefox security and privacy extensions that you should install for safer browsing along side using your SUPERAntiSpyware software on your PC.

Click on each link and it will bring you to the Firefox Extension website where you can learn more about the extension and its creators. Most of these extensions are available on other popular browsers, such as Google Chrome or Opera so do not feel limited to only Mozilla Firefox!

1) uBlock Origin – A lightweight ad-blocker and anti-tracking extension that is efficient on memory and CPU footprint.

2) Privacy Badger – Developed by the Electronic Frontier Foundation (EFF).  Privacy Badger is an anti-tracking extension that stops advertisers and other third-party trackers from tracking where you go on the web. Privacy Badger Works great alongside uBlock Origin.

3) HTTPS Everywhere – Developed by the Electronic Frontier Foundation (EFF) and The Tor Project. HTTPS Everywhere ensures that you always connect to a website using a secure HTTPS connection if one is available. HTTPS is a form of encryption making your browsing much more secure.

4) DuckDuckGo Plus – DuckDuckGo is the search engine that doesn’t track you. This add-on makes DuckDuckGo your default search engine and includes some other useful features.

5) NoScript Security Suite – Preemptive approach to prevent security vulnerabilities out on the web. It allows JavaScript, Java and other executable content to run only from sites you trust, guarding your trusted sites against cross-site scripting attacks (XSS), cross-zone DNS rebinding / CSRF attacks (router hacking), and Clickjacking attempts.

Do you have any Mozilla Firefox extension recommendations? Feel free to leave a comment below!

–SUPERAntiSpyware Team

Posted on

Typosquatting: Another front of malware attacks

Typosquatting is a type of internet scam that relies on end users making mistakes, such as spelling errors or entering the wrong domain name when entering a websites URL. It is also commonly known as URL Hijacking. There are many motivations for a hijacker to take the Typosquatting approach to deceiving unsuspecting victims:

1) To redirect web traffic to their own or a competitor’s product.

2) Installing malware to infect the user’s machine, typically with ad-hosting pieces of malware.

3) Freeze the web browser for a fake Tech Support scam, scaring the user into calling a fake tech support number claiming the user has a virus infection. These scams potentially cost the users hundreds of dollars.

4) To steal user information by running a phishing scheme to mimic legitimate website.

5) Making revenue from the user clicking on advertisements (either in plain site or disguised as legitimate search links) on the Typosquat website.

6) To blackmail or strong-arm payment from the company they’re Typosquatting in order to force a purchase of the website from the Typosquatter.

A scammer who runs a Typosquat scam typically registers a website address with spelling close to the legitimate websites address. This is typically something simple like omitting a letter, adding a letter, or using a different Top Level Domain. For example if a user wants to go to our website, they may end up typing superaantispyware[dot]com with double a’s. This will end up showing a user a Typosquatting website such as this:

Another type of Typosquat scam would be due to the person improperly typing out the full URL, typing something like google [dot] om , rather than typing google [dot] com. In this instance, the person typing the .om domain would actually be viewing a page hosted on Oman’s Top Level Domain, rather than the basic .com domain. In some instances, large corporations will buy up as many associated domains as they can in order to prevent this type of mistake (Google, for example, has variants of their site containing multiple o’s and different Top Level Domains); however, not all companies have the foresight and/or money to do this.

It is easy to avoid falling prey to a Typosquatting scam. Here are a few easy things you can do to prevent this.

1) Never open links in emails from unexpected senders, and exercise caution when visiting sites you’re not familiar with.

2) Bookmark your favorite websites so you can easily access them.

3) Use a search engine like Google, Bing, or Yahoo when looking for a specific website if you are unsure about the spelling or if the business’ website is the same as their name. Some car dealerships, for example, use dealer names or slogans as their website.

4) Double check the URL you are typing before loading the page

5) Make sure Real-Time Protection is turned on in SUPERAntiSpyware Professional

6) If you are starting a web-based business, consider buying multiple domains that are similar to your primary site to preemptively stop Typosquatters. Most domain registrars will offer bulk rates when you purchase more than one domain at a time.

While this type of attack is somewhat uncommon by today’s standards, it still happens every once in a while. By practicing safe browsing habits, keeping your web browsers up-to-date, and running regular scans of your machine, you should not be impacted by most of these types of attacks.

Posted on

Macros and You: An old attack becomes chic again

Macros and You ?

Some of the earliest computer viruses and malware were created using macros in Microsoft Office documents. These pieces of malicious code would run once the document was opened, and the infection would happen without the user even being aware that their machine had been compromised. While these types of attacks had fallen out of favor over the years, they’ve come back in style and are more popular than ever before.

What exactly is a macro?

While you’ve probably heard the term thrown around before, most people don’t actually know what they are, or what they’re capable of. In short, macros are little snippets of code that run through your office software. Many people use macros to speed up a repetitive processes, like formatting items. Unfortunately, the same type of code that is used to perform the mundane can also be used to perform the malicious.

Due to the ease of abuse, Microsoft removed the automatic enabling of macros many years ago. This is ultimately what lead to the majority of these types of attacks going by the wayside. Because there was no longer a way to abuse this on most machines, would-be attackers changed their methods to more traditional programs, which are far easier to detect with a normal malware scanner.

With the recent surge in ransomware, new methods of delivery were needed by would-be attackers. The anti-malware engines had been able to detect many variants, and it was only getting easier. This meant that stealth was needed. What better way to do that than to bring back a tried-and-true method in Office Macros. Few people expected it due to the fact that these infection types hadn’t really been seen in years.

The basic attack is carried out like this:

1) An infected person sends you an email with the subject similar to “ATTN: Invoice Attached” that has a Word document attached.

2) The person downloads and opens the file, only to see a garbled mess of characters with a notice that says “Enable macro if the data encoding is incorrect” in big bold red letters at the top of the window

3) The unknowing victim enables macros, thereby initiating the malicious code

4) The code runs, sending out an email to your Outlook contacts (attempting to infect them), downloads whatever payload(s) it wants, then runs the ransomware (locking your files)

Because of the sharp increase in these types of attacks, Microsoft, SUPERAntiSpyware, and many other security vendors recommend that all users disable macros if they do not need to use them. While Macros should be disabled by default, it is worth double-checking your preferences in order to ensure that you are protected as best as possible.

For more information on how to disable macros in Office files, please visit this Microsoft Support article.

NOTE: This is a recommendation specifically for home users, if you are in a work environment please contact your IT department first before making any changes!

Posted on

Ransomware: Revisited

Ransomware Revisited By SUPERAntiSpyware

A lot has changed in the world of ransomware since we last talked about it on this blog back in 2013. For those who are new to ransomware, this post should provide a primer of what this family of malware is and what it does. For those who are more well-versed, some of our best practices at the end of this post should help provide some extra prevention methods.

TeslaCrypt, Locky, CryptoLocker, CryptoWall, and other ransomware families are making their way around the internet at break-neck pace. If you find yourself in the unfortunate place of having fallen victim to this type of malware, you’ve essentially got two options: pay up or start from scratch. While this is not something that most people want to hear, it’s the unfortunate reality for a machine that’s been ravaged by these types of infections. Even the FBI has come out and stated that your best option at data retrieval is to pay the ransom (if you do not have proper backups)!

What is Ransomware?

Ransomware is a designation given to families of malware that encrypt your personal files, and then demand a ransom payment in order to be given the decryption key. The types of files that ransomware targets range from generic text files and documents, to pictures, to video games, to music, and even beyond. Unfortunately, the type of encryption that’s used is so strong, that newer versions of some ransomware are completely impenetrable.

Most ransomware families are spread by a special type of Trojan called a “dropper”. The purpose of a dropper is to run processes in the background of your machine to download and execute code from a remote server. That code then searches your computer for files of a specific type (or types), then modifies those files by scrambling them with high-end, two part encryption. After a critical mass of files have been encrypted, the ransomware will then typically create a few different unencrypted documents and/or display a dialogue on your machine telling you that you’ve been locked out of your files unless you pay the price. To add fuel to the fire, many different variants will have a timer imposed upon you for when payment is “due” to them. If you don’t pay in time, they either increase the ransom, or delete the encryption key from their server, thereby making it impossible to retrieve your files.

To make matters worse, many different ransomware variants will disable the Volume Shadow Copy Service on your machine. This service is used by Windows to perform automatic backups and create restore points. These backups are what you would typically use to “roll back” your computer to before a major change happened.

How did I get infected?

Ransomware droppers come in all different shapes and sizes, but one thing that’s true about them is once they’ve been started, it’s almost always too late. These droppers typically are files that you download from your email, other websites, or p2p servers (such as torrent sites). Unfortunately, this is changing rapidly, and we’re starting to see “drive-by” exploits occur in the wild through infected ad-streams on popular sites many people visit on a daily basis.

One of the most frustrating parts of ransomware infections are that they’re extremely difficult to clean up. Even if you run antivirus and antimalware scanners, once the damage has been done, there’s nothing that these pieces of software can do to reverse the damage. These tools, including SUPERAntiSpyware®, can remove the underlying cause of the infection (the dropper) in many instances, but the encryption itself can’t be reversed.

Some versions of ransomware will display messages saying that they are from the FBI, NSA, INTERPOL, or other law enforcement agency. They’ll accuse you of possessing illegal documents and/or visiting illegal websites. This type of scare tactic has fallen out of favor, as people have gotten wise to it. Most modern ransomware will simply display a page admitting freely that you’ve been infected and display instructions on how to pay the ransom.

If you have a home or office network, it’s also possible that your machine got infected due to sharing a network with another infected machine. Because of how these infections work, they simply spread out across the drive space they can see, encrypting whatever data that can be found, regardless if it is on the machine that was initially infected.

What about my data?

If your machine has fallen prey to a ransomware attack, there’s not a whole lot that can be done with the files that were encrypted. Creating new files without removing the underlying infection is a fool’s errand, as they will quickly become encrypted as well.

After coming to terms with the fact that your data has been encrypted, you will find yourself in the middle of an ethical quagmire. If you pay the ransom that is demanded, you will most likely get your files back; however, you’re actively giving these attackers what they want, which is your money. There’s also no guarantee that by paying, your files will be restored; however, if people didn’t get their files back by paying the ransom, why would people continue to pay? If you don’t pay the ransom, you will lose access to all of your files, some of which may be irreplaceable. This is probably one of the most difficult decisions you will make after an infection.

While we can’t tell you one way or the other to pay the ransom or not, one thing that makes it extremely easy to rebound from is the availability of recent backups. If your backups are good, it is far more palatable to format your machine and reinstall the operating system than it is to pay the ransom. There are a few older variants of ransomware that can be decrypted by special software; however, these versions aren’t found in the wild much anymore for that very reason.

How can I protect myself?

There are many different steps you can take in order to help ensure that your machine doesn’t fall victim to a ransomware attack. Below you will find some of the best practices we have to offer:

Back up your data frequently on an external hard drive AND in the cloud. One set of backups is very rarely going to provide you with 100% coverage, either due to timing differences between when you back up your data and what you’re working on, drive failures, or infection of files in your backup.

If you network computers in your home or office make sure that each machine has its own set of backups. Most ransomware infections can not only infect drives that are connected directly to the infected machine, but also the drives of machines that are connected to the same network as the infected machine.

Always disconnect physical backup drives from your machine when not in use. If you constantly have your backup drive plugged in, there’s a strong chance that the ransomware can find and encrypt files on your backup drive.

Don’t ever download from a site that tells you that something is outdated on your machine. Websites aren’t able to detect outdated software or drivers unless you give them access to your machine. If you think that you have outdated software, download the latest version directly from the publisher’s website.

Practice caution when downloading files of any kind, even if it’s something that your grandmother sent you. Many variants of ransomware will send out emails to logged-in accounts with copies of itself attached. Always make sure to save files to your machine before running them, and always scan those files with your antivirus and antimalware scanners.

Keep your antivirus and antimalware scanners up to date with both the most recent versions of the programs themselves and the most recent versions of the detection databases. You should also take this practice a step further and make sure to keep your operating system up to date as well, as many attacks rely on exploiting bugs that have already been patched.

Leave macros in Microsoft Office disabled if you do not use them regularly, and do not turn them on if you don’t. One of the most common attack vectors of ransomware is to have unknowing victims turn on macros in order to “fix” a document that appears to be corrupted. In actuality, once the macros are enabled, the dropper begins its work.

Don’t give yourself (or other users) more login power than you need. Having administrator rights to your machine is definitely something most people overlook. Unfortunately, if a ransomware infection sees that you have administrative access, it makes the computer much easier to infect.

(OPTIONAL) Use adblocking software while browsing the web, disable scripting within your web browser, disable Flash, and disable Java. Many of the drive-by attacks are distributed through infected advertisements, Javascript commands, or through the downloading of files automatically when you open the page. By turning off this vector of attack, you might limit some of your web browsing capability, but will be that much more secure against attacks.