Take a closer look at your current Windows machine. It might be one of the millions of PCs that could be hacked right now and you might not even know anything is happening. At least, that’s what two different reports say, covering two equally disturbing vulnerabilities that hackers can take advantage of.
FROM EARLIER: A dangerous bug in Windows 8.1 and older versions could be used to spy on you
A new zero-day vulnerability that exists in Microsoft’s Office suite of apps has been discovered. It’s similar to the one Microsoft patched a few days ago, which was believed to have been used for spying on the U.S. government.
Hackers can take advantage of certain code in PCs running various Windows operating system versions, from Vista to Windows 8.1, and infiltrate a user’s computer to steal personal information. Microsoft has put together a quick tool to prevent hackers from exploiting the vulnerability in PowerPoint and other Office file types, although the company has yet to patch it.
The tool can block the attacks seen so far, so at least users have something at their disposal to try to limit attacks, assuming they know they have been targeted — more information about it is available on Microsoft’s support pages (see first source link below).
The second, more dangerous hack does not have a real fix though. Instead of taking over the user’s computer through a zero-day attack or a complex phishing scheme, some hackers have figured out a smarter way of making money from using malware programs referred to as “malvertising.”
The term describes a common practice among hackers to describe taking over advertisements on trusted websites with malware, and injecting code that can then perform actions on a computer. A user wouldn’t even know the PC has been infected while he or she is reading something online.
Discovered by Proofpoint, CryptoWall 2.0 is a ransomware program that infects the PC from an ad, and then holds the device for ransom until $500 is paid in Bitcoin to a random address. The company estimated that as many as 3 million visitors per day have been exposed to such malvertising, which can generate up to $25,000 per day for attackers, or up to $750,000 in total since the attack was first discovered.
Interestingly, hackers simply use the current ads (for example for Microsoft Bing, Fancy or Case Logic products) shown on certain pages (such as Yahoo Finance, AOL, The Atlantic, 9gag, match.com, The Sydney Morning Herald, and many others), without the companies paying for the ads, or the websites displaying them, realizing what’s going on.
One way you could try to limit your exposure to malvertising is installing an ad-blocker on your computer. Also, regular hard drive backups could also be more than useful so that you won’t have to pay to free your hard-drive from ransomware, in case you ever get hit by such attacks.
More information about this advanced malvertising campaign is available at the second source link.
