Scary Disguises Hide Malware Too

goblinIt’s Halloween tomorrow, the traditional time when we dress up in scary or not-so scary costumes to disguise our identity and trick our friends and family.  It’s good to remember that malware often uses disguises to trick us into committing an action that releases the attack.  What follows are my scary Halloween stories.

  • Social Engineering – In this exploit the attacker may present themselves in person, over the phone, or by email, representing themselves as the tech from Comcast, Randy from IT, or Pete from an important client.  Often the easiest way for an attacker to access your network is just to ask for it.
  • Email Links – In this exploit the email itself may be tricked out to look like a legitimate message from UPS, FedEx, an important vendor, a client, or your bank.  There will be some sort of plausible story encouraging you to click on the supplied web link.  Once at this website, you may be coaxed out of your user credentials, or you may just download some malware that opens the attack.
  • Malvertising – Many websites sell advertising space on their margins in order to pay for services provided by the website.  Malicious actors will buy ad space and supply an ad the has malware embedded in it.  Clicking on the ad or even just mousing over it is often enough to install malware on your computer.
  • Drive-By Downloads – When legitimate websites are illegally accessed by attackers, often they will insert their malicious software into the code for the home page, and when people visit the site, they are unwittingly given the gift of malware.  Site owners may be unaware of the breach for a few days or even weeks, so you might get infected, have your computer cleaned up, and the get infected again when you return to a favorite site.
  • Trojan Horses – This malware is often bundled with other software we think we want, such as a game, a video file, music, or some sort of free software.  In addition to what you see, you may end up installing a remote access tool, or a keylogger, or software that turns your computer into a zombie host in some cyber-criminal’s bot-net.
  • Phishing – The most common (94%) way that criminals get access to your computer, personal data, or network.  Like email links above, these emails are designed to look like they are from a legitimate source, and often contain links to malicious or infected website, or attachments that install malicious software when opened.


About the Author:

Cybersecurity guru to business owners in the St Paul, Minneapolis, and western Wisconsin area. Computer security and hacking have been a passion of mine since I entered the computer and networking business in 2000. In 2013 I completed a course of study and certification exam to become a Certified Ethical Hacker (CEH). In 2016 I was certified as a Certified Information Systems Security Professional (CISSP). As Cybersecurity Analyst at The WyzCo Group, I help our clients experience high levels of computer security, network security, and web site security. In addition to consulting on security products and services, we also conduct security audits, vulnerability assessments and full penetration tests. We also provide Cybersecurity Awareness Training for clients and their employees. We also work with companies and organizations that need to certify compliance with regulations such as PCI-DSS (credit card processing), HIPAA/HITECH (medical records), and GLBA. The views expressed on this Web site are mine alone and do not necessarily represent the views of my employer.

Add a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.