Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label Antivirus Apps. Show all posts

Cybersecurity: Are Viruses Still a Threat?

 

Viruses were considered the biggest cybersecurity concern in the world, but is that still the case? How prevalent were viruses in the past, and are they still as deadly today? 

Understanding the modern computer viruses

Viruses are no longer the most dangerous type of cyber threat, despite the fact that they once were. With the last few major virus campaigns, such as Stuxnet, SpyEye, and W32.Dozer, the prevalence of computer viruses started to fall around the beginning of the 2010s. 

Technology developments are primarily to blame for viruses' diminished menace. The antivirus software that was available to use in the early 2000s was very different from what we use today because of better service, more features, and greater detection rates that have come along over time. 

As a result of their lack of extreme complexity, viruses are not very huge programmes. Viruses require a "host" on which to replicate, just like in the biological world. Typical viruses have to be pretty little since they have to sneak inside a programme. This doesn't allow the virus much area for additional coding that would give it complex powers. 

Furthermore, many viruses have a consistent pattern, so antivirus software is accustomed to detecting them. What actually poses a threat to our smartphones and computers today is malicious software like ransomware, spyware, Trojan horses, and other similar threats. 

These malware programmes can be extremely complex and occasionally are made to completely avoid antivirus protection. Overall, current malware just outperforms viruses, which is why they aren't employed nearly as frequently as they once were. 

Through the 2010s, ransomware in particular grew significantly as a cybercrime trend. This type of malware encrypts the contents on an infected device and notifies victims that the files can only be unlocked when they pay the requested ransom. WannaCry, LockBit, Jigsaw, and Bad Rabbit are a few well-known ransomware instances. 

Many ransomware operators acquire their malicious software through ransomware-as-a-service platforms, which sell ransomware to third-party hackers in exchange for a charge. This makes ransomware available to less technically savvy bad actors as well as seasoned pros.

Viruses are clearly no longer the most significant cybersecurity concern. However, viruses are not entirely extinct. As previously stated, the once-feared MyDoom virus was discovered in use in 2019. MyDoom was disseminated in this case through a phishing email campaign. Viruses are still used today, even if they are deemed primitive, and this is critical to remember. 

Is antivirus still required?

The definition of the phrase "antivirus" has changed over time. While antivirus programmes were initially designed solely to protect against viruses, they can now identify and remove various types of malware. 

Malware, as you are probably aware, is a worldwide problem that claims thousands of victims each month. According to Statista, security experts discover 560,000 new pieces of malware every day. That equates to about 17 million new pieces unearthed each month. 

Statista also revealed an 87 percent increase in malware infections over the last decade. These two data alone demonstrate how terrible the malware issue has become. In order to secure your gadgets from cybercrime, you must still use an antivirus programme. 

Always choose a highly regarded antivirus programme that has demonstrated its efficacy in avoiding viruses and malware. It's not a good idea to install any free antivirus software you come across because you can end up with subpar security or even malware that poses as antivirus software.

SharkBot Android Trojan Resurfaces On Google Play Store

 

Check Point researchers have unearthed multiple malicious Android apps on the Google Play Store posing as an antivirus applications to deploy the SharkBot Android trojan. 

The malicious banking trojan was initially spotted in November last year when it was only being deployed via third-party application stores. The primary motive was on initiating illegal money transfers via Automatic Transfer Systems (ATS) by auto-filling fields in authentic applications. 

Last month, NCC Group reported that multiple SharkBot droppers had infiltrated Google Play, all of which showed similar code and behavior. The first SharkBot dropper discovered in Google Play masqueraded as antivirus solutions. It was identified as a downgraded version of the trojan containing only minimum features, but capable of fetching and installing the full version at a later date. 

Apparently, on March 9th, Google removed four apps in question, and a few days after that, another SharkBot dropper was identified. The app was reported right away, so no installations for this one. The same happened on March 22 and 27. Those new droppers got removed from Google Play due to quick discovery. 

According to Check Point researchers, they identified a total of seven droppers in Google Play, published from developer accounts that were active in late 2021, and which had some of their applications removed from the store. However, these malicious apps have been already installed more than 15,000 times before the takedown from the store. 

Once installed on an Android device, SharkBot exploits Android's Accessibility Services permissions to present fake overlay windows on top of legitimate banking apps. Thus, when victims enter their usernames and passwords in the windows that mimic benign credential input forms, the stolen data is sent to a malicious server. 

“What is interesting and different from the other families is that SharkBot likely uses ATS to also bypass multi-factor authentication mechanisms, including behavioral detection like bio-metrics, while at the same time it also includes more classic features to steal user’s credentials,” NCC Group stated. 

The malicious Android trojan also employs geofencing features and bypassing techniques, which makes it unique from other mobile banking viruses. The particular features include ignoring the users from China. Romania, Russia, Ukraine, Belarus, India. The majority of victims reside in Italy and the United Kingdom.