Last week Google unveiled Project Zero, a new team dedicated to making Internet users less vulnerable to cyberattacks. From Heartbleed to Cryptolocker, the headlines are increasingly full of news about scary new threats that target the average Internet user.
“You know to delete that email that tells you you’ve won the lottery, so attackers have to change their approach over time,” Chris Weber, the co-founder of Casaba Security, told NBC News. “But really, these are new spins on old kinds of attacks.”
Here are four common and dangerous types of cyberattacks to watch out for — and how to avoid or fix them.
Ransomware
What it looks like: Ransomware falls under the large cyberattack umbrella of “malware” –- malicious software — and it’s a particularly scary brand. It locks up a victim’s computer files and demands payment in exchange for unlocking them.
Internet Danger: What Is Ransomware?
Victims of ransomware usually see a pop-up warning that overtakes the device’s screen, blocking access and encrypting files. The message demands the victim pay hundreds of dollars to unlock the files and regain access to the computer.
What to do: While it’s tempting to pay the ransom, security experts say that’s a bad idea: There’s no guarantee the crooks will actually free the files, and funding criminal activity only fuels it.
Ransomware victims can try to remove the malicious program themselves using anti-virus software, or take the infected device to a computer repair shop. If the ransomware can be removed, sometimes that’s all that’s needed: if the files weren’t actually encrypted, they would be accessible again. But if the files were indeed encrypted as threatened, removing the ransomware won’t change that.
“Unfortunately this is one of those cases when if your data has been encrypted, there’s just nothing you can really do,” Kevin Johnson, the CEO of cybersecurity consultancy Secure Ideas.
As with most malware, ransomware is often unwittingly downloaded when users open email attachments or click on links, so as always caution is advised.
Sketchy video sites that ask you to install a “codec” or update
What it is: Didn’t feel like paying to stream that new movie, eh? It can be tempting to watch it for “free” on a website that streams pirated video, but these disreputable sites are sometimes filled with potential cyberattacks.
In this type of attack, victims click what looks like a regular video player in an attempt to stream the content. But then a message pops up telling the user to install a “codec” or other kind of update in order to view the video. Victims who download the so-called update are actually installing malware on their own computers.
What to do: Be wary of any message that pushes you to download something in order to view a video. And it’s not only sketchy “free video” sites: spammy viral video clips that make their way around Facebook could also be malicious. (One of the exceptions is Netflix, which uses Microsoft Silverlight to stream video.)
“You really have very few reasons to have to install anything to watch content on the Internet,” Dave Aitel, the CEO of security firm Immunity Inc., told NBC News. “But people say, ‘I really want to watch that show, so I’ll click until the clip starts playing.'”
Malicious links in messaging apps and social networks
What it is: This threat is perhaps the most similar to attack methods that have been around a while. That old spam email that contains a malicious link or attachment isn’t dead; it has simply moved to networks where people are active, and where they think they can trust a network of friends.
“We know to be more careful about email, but getting infected now isn’t like it used to be,” Raj Samani, the chief technology officer for McAfee’s EMEA region, told NBC News. “It could be a link in a LinkedIn connection request that looks legitimate, or a Twitter direct message that is supposedly from a friend.”
On a mobile device,the malicious software could harvest contact information, secretly send calls and send texts to premium numbers and track a user’s location, for example.
What to do: Beyond the standard advice to avoid clicking on suspect links and files, Samani suggests mobile phone users install anti-virus programs that could catch the threats.
“Anti-virus is standard for most people on their desktop or laptop, but how many people do you know have it installed on mobile?” Samani said. His employer — McAfee — offers a free version of mobile anti-virus, as do companies such as Avast.
Fake Flappy Bird (and other popular apps)
What it is: The addictively simple (and temporarily pulled) mobile game Flappy Bird is lots of fun — but the hundreds of malicious clone apps lurking in app stores are quite the opposite.
“When an app gets even halfway popular — much less something as viral as Flappy Bird — app stores get so flooded that it’s hard to find the legitimate one,” Aitel said.
In Flappy Bird’s case, a report released last month from anti-virus company McAfee said hundreds of clones emerged in the first quarter of 2014 (after the legitimate app’s creator took it down). McAfee tested 300 of the clones and found that almost 80 percent of them contained malware.
Once downloaded, those malicious clones did very bad things with the victims’ phones, and in the worst cases, the malware gained full control of the infected device.
What to do: Carefully check before downloading an app from an app store: Check the creator’s name, the app’s description and the reviews among other information. Avoid giving any app sweeping permission to access parts of the phone, as tempting as it is to simply keep clicking “yes.” As with the previous threat, mobile anti-virus software can help mitigate or avoid the damage.
By Julianne Pepitone
