#mcafee.com

www.mcafee.com/activate

http://wwwmcafeecomactivate.org

www.mcafee.com/activate - Activate Your McAfee Retail card by simply visiting our website mcafee.com/activate and Get Started with McAfee Security.

That puts added pressure on threat hunters to get ahead of the problem before it’s a problem. As the average cost of data breaches continues to climb, too much is at risk by keeping the status quo. Remediation and resolution after the fact no longer cut it. But if threat hunters know ahead of time who is being targeted and what endpoints are going to be impacted, that’s a game-changer. At that point, they can take proactive measures to protect their organizations. 

At McAfee.com/activate, our portfolio of technologies not only extends protection across all endpoints and the cloud but also streamlines the process of investigation, allowing threat hunters to drill down across sectors, industries, and regions. We cross-correlate known campaigns using industry and geographical threat activity with an organization’s own endpoint McAfee.com/activate security posture derived from its security telemetry.   

That’s a major boon for threat hunters who now can glean accurate insights into the potential constellation of potential security risks. They no longer need to manually pick through disparate pieces of data, separating out false positives from real indications of trouble. So, instead of wasting precious time on busywork, they apply their talents to the task of finding the most effective way to deal with incoming threats.  

Even on a good day, the threat hunter’s job is hard enough. Without the necessary information to help understand the bigger picture, it looks more like Mission Impossible. But with a recently announced, uniquely, proactive, McAfee.com/activate MVISION Insights in hand, threat hunters can finally flip the script to take the fight to the bad guys. Remember: the best defense is always a good offense. 

Check it out—our Chief Scientist Raj Samani weighs on MVISION Insights. 

In this article, you’ll learn some of the signs that you may have a computer virus, and you’ll learn tips for effectively removing them. While some of these malicious programs are little more than a nuisance, many others can effectively steal your most personal, private, and sensitive information. In this article, you’ll learn some of the signs that you may have a computer virus, and you’ll learn tips for effectively removing them.

What is a computer virus?

First off, computer viruses can take many different forms. In general terms, these viral programs are any unwanted bit of code designed for the purpose of invading and disrupting your computer. But much like a biological virus, computer viruses invade, replicate themselves, and then try to get into other systems. Some viruses may only affect your internet browser. Others are even more harmful. The rootkit virus type, however, digs deep into the internal controls of your system. Trojan viruses sneak onto your device disguised as programs that seem legitimate.

Signs of a Virus

A sudden slowdown may be the first sign that you have a virus, and you may notice that programs which used to load quickly take longer and longer to load. You may also receive multiple error messages about programs becoming unresponsive. In this case, the virus is using the processing power of your own computer system, and consequently, other programs are having trouble running at the same time.

Some viruses and malware only affect certain parts of your system. For example, you could discover that the home page of your browser has changed without your knowledge. You may also have trouble logging onto antivirus and antimalware sites, or if/when a virus gets into your email program, you may start to hear from your contacts about strange emails coming from your computer.

How does a virus get on your computer?

Computer viruses have been around for about as long as personal computers, and virus programmers understand that human error is always the easiest way to install a virus. Therefore, while McAfee.com/activate antivirus programs can effectively prevent most computerized threats, they cannot stop a user from clicking the wrong link or installing compromised software on their own system. When you download programs or data from an unfamiliar site, remember that you may also be unknowingly accepting a viral program onto your system. Links in malicious emails can also start an automatic download.

And new viruses come online all the time. The experts at McAfee.com/activate are constantly learning about new malicious programs and then developing solutions. If however, you do not regularly update your virus definitions, a harmful program may still be able to sneak by your defensive software.

This week we learned about a leak of source code from 50 prominent companies, posted by a Swiss IT consultant. These come after another recent leak of source code from Nintendo, prompting us to comment on the issue of IP protection and secure development pipelines.  

The latest leak appears to stem primarily from a misconfiguration of SonarQube, an open-source tool for static code analysis, which allows developers to audit their code for bugs and vulnerabilities prior to deployment.  

Our own assessment found that SonarQube communicates on port 9000, which was likely misconfigured to be open to the internet for the breached companies, allowing researchers to gain access and discover the data now exposed in the leak.   

A search for SonarQube on the popular IoT search engine Shodan allows anyone to discover ports used by common software such as this. With this information so easily available, ports unintentionally left open can introduce a wide swath of intrusion attempts.  

Several of the source code repositories also contained hard-coded credentials, which open the door to accessing other resources and expansion of the breach. It is a best practice to never commit code with hard-coded/plaintext credentials to your repositories.   

How You Can Protect Your IP  

Mistakes like misconfiguration and accidental credential exposure will happen in the development process, which is where InfoSec teams need to step in. Auditing infrastructure code both prior to deployment and continuously in production is essential for companies practicing DevOps and CI/CD.  

Our solution to this problem is McAfee.com/activate MVISION Cloud, the multi-cloud security platform for enterprises to protect their data, prevent threats, and maintain secure deployments for their cloud-native apps.  

Audit Cloud Accounts for Misconfiguration 

With McAfee.com/activate MVISION Cloud InfoSec teams can monitor their company’s public cloud accounts, like AWS, Azure, or GCP, for configuration mistakes that may expose sensitive data. In the example below, McAfee.com/activate MVISION Cloud discovered that a resource in AWS EC2 was configured with Unrestricted Access to ports other than 80/443, opening up potential breach scenarios like we saw with the source code leak.  

NetWalker Overview

The NetWalker ransomware, initially known as Mailto, was first detected in August 2019. Since then, new variants were discovered throughout 2019 and the beginning of 2020, with a strong uptick, noticed in March of this year. NetWalker has noticeably evolved to a more stable and robust ransomware-as-a-service (RaaS) model, and McAfee.com/activate's research suggests that the malware operators are targeting and attracting a broader range of technically advanced and enterprising criminal affiliates. McAfee.com/activate Advanced Threat Research (ATR) discovered a large sum of bitcoins linked to NetWalker which suggests its extortion efforts are effective and that many victims have had no option other than to succumb to its criminal demands. For more details on NetWalker, see the McAfee ATR blog here.

We do not want you to be one of those victims, so this blog is focused on how to build an adaptable security architecture to defeat this threat and, specifically, how McAfee.com/activate’s portfolio delivers the capability to prevent, detect and respond to NetWalker ransomware.

Gathering Intelligence on NetWalker

As always, building adaptable defensive architecture starts with intelligence. In most organizations, the Security Operations team is responsible for threat intelligence analysis, as well as threat and incident response. The Preview of McAfee.com/activate MVISION Insights is a sneak peek of some of MVISION Insights capabilities for the threat intel analyst and threat responder. The preview identifies the prevalence and severity of select top emerging threats across the globe which enables the Security Operations Center (SOC) to prioritize threat response actions and gather relevant cyber threat intelligence (CTI) associated with the threat, in this case, NetWalker ransomware. The CTI is provided in the form of technical Indicators of Compromise (IOCs) as well as MITRE ATT&CK framework tactics and techniques.

As a threat intel analyst or responder, you can drill down to gather more specific information on NetWalker, such as prevalence and links to other sources of information.

As a threat intel analyst or responder, you can further drill down to gather more specific actionable intelligence on NetWalker, such as indicators of compromise and tactics/techniques aligned to the MITRE ATT&CK framework.

From McAfee.com/activate MVISION Insights preview, you can see that NetWalker leverages tactics and techniques common to other ransomware attacks, such as spear-phishing attachments for Initial Access, use of PowerShell for deployment, modification of Registry Keys/Startup folder for persistence, and encryption of files for the impact of course.

Basic online scenario—You log onto your computer and notice that something’s just not right, but you can’t quite put your finger on it. Something just seems…a bit off. If you’ve found yourself in this situation, or even thinking you are, there’s a real possibility you could have a Trojan virus on your computer.

Trojan viruses can not only steal your most personal information, but they also put you at risk for identity theft and other serious cybercrimes. In this post, we’ll examine what Trojan viruses are, and where they come from. We’ll also cover how you can protect yourself and get rid of viruses so you can stay safe and maintain peace of mind online.

What Trojan Viruses Do

Trojan viruses are a type of malware that invades your computer disguised as a real, operational program. Once a trojan is inside your system, it can perform destructive actions before you even know it’s there. Once inside, some trojans sit idly on your computer and wait for further instructions from its host hacker, but others begin their malicious activity right from the start.

Some trojans download additional malware onto your computer and then bypass your security settings while others try to actively disable your antivirus software. Some Trojans hijack your computer and make it part of a criminal DDoS (Distributed Denial of Service) network.

How to Remove a Trojan Virus

Before you discover all the places a Trojan can invade your computer, let’s first learn how to get rid of them. You can remove some Trojans by disabling startup items on your computer which don’t come from trusted sources. For the best results, first, reboot your device into safe mode so that the virus can’t stop you from removing it.

Please carefully ensure you know which specific programs you’re removing because you could slow, disable or cripple your system if you remove basic programs your computer needs to function. Installing and using a trusted Mcafee.com/activate antivirus solution is also one of the top ways to get rid of trojans. An effective antivirus program searches for valid trust and app behavior, as well as trojan signatures in files in order to detect, isolate and then promptly remove them. In addition to spotting known trojans, the McAfee.com/activate antivirus program can identify new trojans by detecting suspicious activity inside any and all of your applications.

While Apple does an amazing job of guarding Macs against common security threats, it just can’t stop every determined hacker who looks at its devices as a challenge.

Here are some top tips for shoring up security for your Mac:

Avoid opening spam emails and attachments.

Don’t download questionable files.

Install ad-blocking applications.

Create frequent system backups (Time Machine).

Install the latest OS and application updates.

Manage data.

Install a security suite (Antivirus, firewall, browser destination monitoring).

User VPN software when connected to public or untrusted networks.

Stay protected

Subscribing to a comprehensive security suite service is one of the most effective steps that you can take to safeguard your Apple devices, financial information, and privacy while online. McAfee.com/activate partners with industry, IT experts, and the user community to deliver the most powerful cybersecurity solutions on the market.

Check more information about our latest security products.

As part of our continued goal of helping developers provide safer products for businesses and consumers, we here at McAfee Advanced Threat Research (ATR) recently investigated temi, a teleconferencing robot produced by Robotemi Global Ltd. Our research led us to discover four separate vulnerabilities in the temi robot, which this paper will describe in great detail. These include:

CVE-2020-16170 – Use of Hard-Coded Credentials

CVE-2020-16168 – Origin Validation Error

CVE-2020-16167 – Missing Authentication for Critical Function

CVE-2020-16169 – Authentication Bypass Using an Alternate Path of Channel

Together, these vulnerabilities could be used by a malicious actor to spy on temi’s video calls, intercept calls intended for another user, and even remotely operate temi – all with zero authentication.

Per McAfee.com/activate’s vulnerability disclosure policy, we reported our findings to Robotemi Global Ltd. on March 5, 2020. Shortly thereafter, they responded and began an ongoing dialogue with ATR while they worked to adopt the mitigations we outlined in our disclosure report. As of July 15, 2020, these vulnerabilities have been successfully patched – mitigated in version 120 of the team's Robox OS and all versions after 1.3.7931 of the temi Android app. We commend Robotemi for their prompt response and willingness to collaborate throughout this process. We’d go so far as to say this has been one of the most responsive, proactive, and efficient vendors McAfee.com/activate has had the pleasure of working with.

This paper is intended as a long-form technical analysis of the vulnerability discovery process, the exploits made possible by the vulns, and the potential impact such exploits may have. Those interested in a higher-level, less technical overview of these findings should refer to our summary blog post here.