For the chosen few in the world of "Geek" (I say that lovingly) their minds are imprinted with a keen sense of intricacies on all, or at least most aspects of Information Technology.
But for the general public, most of us understand very little about the world of I.T. And so, in the specific case of "cyber security", our lack of knowledge sets us up to be "sitting ducks."
Case in point...in 2014, a blog was published discussing the "Droidpak"...an Android banking malware that leveraged vulnerable PCs to install itself onto mobile devices. What made this news most disturbing is that in most other security cases of this nature, the situation is usually the other way around...that is, the mobile device distributes the malware to the PC. This was new...the malware cleverly was designed to initially exploit the PC...right under the victim's nose.
The attack was crafty, yet fairly simple. The trojan was designed to exploit the Windows operating system and gain a foothold on the victim's computer. Once settled in, it contacted a remote command and control server. Then, according to Symantec SecurityResponse, the remote server would send a configuration file back to the infected Windows computer similar to the example below:
[https://]xia2.dyndns-web.com/iconf[REMOVED]
Notice the configuration file references a website. The infected computer would try connecting to the website. If successful, an Android malware file similar to the one below began to download:
%Windir%\CrainingApkConfig\AV-cdk.apk(Android.Fakebank.B)
Android.Fakebank.B would show up as a “Google App Store” application.
Once it was installed, Android.Fakebank.B would look to see if there were any mobile banking apps installed on the Android device. Symantec said the version of Android.Fakebank.B studied was specifically targeting Korean-banking applications. If Android.Fakebank.B found a familiar banking app; it attempted to make the user believe the currently installed banking app was malware, should be removed, and replaced by Android.Fakebank.B. If the user agreed and loaded Android.Fakebank.B, the malware was in a position to steal log in credentials and possibly account information when the user logged in using what was thought to be the correct banking app. It was that easy.
How can we protect ourselves from "the bad guys?" For us here at Alcala Consulting, the primary answer is, of course, to work with us! But diligence is even more so the obvious and practical answer. The more we know...the more we grow; in other words, we must abandon the hesitancy and apprehension that exists in educating ourselves in I.T. It seems to be a viscous circle - most of us feel that "tech talk" is "over our heads," which prevents us from educating ourselves so that technology will not remain "over our heads."
In the animal kingdom, it is the weak and infirmed in the herd that are attacked by the enemy. So it is in the world of I.T. The more vulnerable your system and your information is, the stronger the likelihood is of your security being compromised. True...if you are a specific target, and you have a rather sensitive piece of information that the "bad guys" want, in the end, you will probably be hacked. But that is not the norm. In the world of "cyber crime", the victims are usually the easiest targets Knowledge, therefore, is indeed power. And clearly, what you DON'T know CAN most definitely hurt you.
For more information, contact us directly at 877-791-4400. We're here to answer any and all technology concerns and issues.
