Category: Blog

Fileless Malware Poses New Threat to Computer Users

Fileless Malware Poses New Threat to Computer UsersWith increased cyber threats, there is great awareness of malware that comes attached in files.  Individuals and businesses invest in security solutions to protect against malware. In fact, there are often company policies regarding opening attachments on emails; yet there is an increase in a type of threat (though not new), known as the fileless malware.

What is Fileless Malware?

A fileless malware attack is a type of threat that doesn’t involve executable files. Instead, these attacks include scripts that run on browsers, command prompts, Windows PowerShell, Windows Management Instrumentation, VBScripts, or Linux (Python, PERL).

In other words, fileless malware is a form of cyberattack carried out through software that already exists on your device, in your authorized protocols and in applications that you have allowed on your device.

As such, fileless malware is becoming a favorite of cybercriminals because they don’t have to look for ways to install malicious files in your device – they only need to take advantage of built-in tools.

Reported examples of fileless malware include PowerGhost, which has been used in crypto-mining and DDoS attacks.

How It Works

First, note that these attacks are termed fileless because they are not file-based; instead, they hide in computer memory.

The malware launches an attack in various ways. For instance, a malicious code is injected in an application already installed or a user clicks on a legitimate-looking link that loads a remote script.

Another scenario exists within a legitimate-looking website that a user visits; the attackers exploit vulnerabilities in the Flash plugin; and a malicious code runs in the browser memory of the user’s computer.

While file-based malware uses executable files, the fileless type hides in areas where it can’t easily be detected, such as the memory. It is then written directly to the RAM (and not the disk), where it carries out a series of events.

Once in your system, the malware piggybacks on legitimate scripts and executes malicious activities while the legitimate program runs. At this point, it performs malicious activities such as payload delivery, escalating admin privileges, and reconnaissance, among others.

Since it works in-memory (RAM), its operations end when you reboot your system. This makes it more challenging to trace attacks. The fileless malware also may work in cohorts with other attack vectors, such as ransomware.

Detection and prevention

Various security vendors claim to have products that can detect fileless threats, as well as protect endpoint systems.

Successful security solutions need to be able to put in place technologies that enable them to inspect different kinds of operating systems storage, as well as analyze in real-time the execution of patterns of processes in a system.

But even so, one thing is certain: traditional anti-malware software will not detect fileless malware because they are not file-based and they do not they leave footprints. Here are some tips that will help mitigate against fileless attacks:

  • Regularly update the software on your devices (especially Microsoft applications) to protect against attacks propagated through PowerShell.
  • Apply an integrated approach that addresses the entire full threat lifecycle. This is possible when you use a multilayered defense mechanism.  
  • Use security solutions that can detect malicious attacks against command prompt (CMD), PowerShell, and whitelisted application scripts.
  • Use anti-malware tools that include machine learning, as this will limit scripts from creating new polymorphic malware within your environment.
  • Practice behavior monitoring to help lookout for unusual patterns.
  • Use memory scanning to help detect patterns of known threats.
  • Be on the lookout for high CPU usage by legitimate processes and suspicious error messages that appear for no clear reason.
  • Disable PowerShell and Windows Management Instrumentation (WMI) if you are not utilizing them.
  • Avoid using macros that have no digital signatures or turn off macros if not being used.
  • Use endpoint detection and response tools.

Final Thoughts

The cyber threat landscape keeps evolving. Every day, there are more sophisticated threats as criminals keep advancing to take on countermeasures that have been implemented.

Invest in security solutions that mitigate varying classes of threats, especially machine learning technologies. This will help protect against the latest and emerging threats. Also, keep your Windows OS and other installed software up-to-date to reduce the chances of fileless malware attacks.

Despite taking the mentioned measures, it’s important to stay informed of the latest threats and take necessary precautions.

Helping Small Business Owners, Seniors and U.S. Hostages, and Limiting Intrusive Domestic Surveillance

Helping Small Business Owners, Seniors and U.S. Hostages, and Limiting Intrusive Domestic SurveillancePaycheck Protection Program Flexibility Act of 2020 (HR 7010) – Rep. Dean Phillips (D-MN) introduced this legislation on May 26. This Act modifies provisions related to small business loans issued under the original Paycheck Protection Program. Specifically, the bill permits forgiveness of loans used to pay expenses incurred over a 24-week period, longer than the original eight-week limit, and extends the timeframe to pay off unforgiven loans from two to five years. This bill also increases the limit on non-payroll expenses up to 40 percent when used to pay for rent, utilities, mortgage interest, and similar fixed costs. Loan recipients have until the end of 2020 to rehire employees with full access to payroll tax deferment. The bill was signed into law by the President on June 5.

Providing for Congressional Disapproval Under Chapter 8 of Title 5, United States Code, of the Rule Submitted by the Department of Education Relating to “Borrower Defense Institutional Accountability” (HJ Res 76) – This bill was introduced on Sept. 26, 2019, by Rep. Susie Lee (D-NV). In response to a September 2019 rule issued by the Department of Education (ED), this resolution sought to reverse a process that no longer allows a borrower to be discharged from a student loan if an educational institution misrepresented material facts. The new rule also requires individual borrowers to apply to ED for a defense to repayment, whereas in the past an application could be submitted on behalf of an entire group (e.g. veterans). This resolution passed in both the House and Senate but was vetoed by the President on May 29. No attempt has been made to override the veto.

USA FREEDOM Reauthorization Act of 2020 (HR 6172) – This bill would reauthorize (through November 2023) provisions related to the Foreign Intelligence and Surveillance Act (FISA). Updated provisions mandate that the FBI may not seek detailed phone records on an ongoing basis, cellular or GPS location information, or any evidence in which there is a reasonable expectation of privacy. Other mandates include certifying that the Department of Justice (DOJ) has received any information that might raise doubts about the application, and imposes additional requirements for FISA authorizations that target a U.S. person, federal elected official or candidate. The bill would increase criminal penalties for unlawful violations of FISA electronic surveillance and expands the criteria for when a FISA court decision shall be declassified. The bill was introduced by Rep. Jerrold Nadler (D-NY) on March 10. It was passed in the House in March and in the Senate, with alterations, in May. The bill was recently put on hold during its second pass in the House.

Robert Levinson Hostage Recovery and Hostage-Taking Accountability Act (S 712) – This bill addresses the wrongful detainment of U.S. nationals abroad. It authorizes the President to appoint 1.) a Special Presidential Envoy for Hostage Affairs to engage in U.S. hostage policy recovery efforts; 2.) an interagency Hostage Recovery Fusion Cell to assess and track all cases and coordinate agency efforts to safely recover hostages; 3.) a Hostage Recovery Group to develop, implement and recommend hostage recovery policies. The bill also gives the President the authority to impose visa- and property-blocking sanctions against foreign nationals responsible for or complicit in the unlawful or wrongful detention of a U.S. national abroad. The bill was introduced by Sen. Robert Menendez (D-NJ) on March 7, 2019. It was passed by the Senate on June 15 and is currently with the House.

Stop Senior Scams Act (S 149) – Sponsored by Sen. Robert Casey Jr. (D-PA), this bill establishes a Senior Scams Prevention Advisory Group to develop educational materials to help employees of retailers, financial services companies and wire transfer companies identify and prevent scams that affect seniors. It was introduced on Jan. 16, 2019, and passed in the Senate on June 10. The legislation is currently under consideration in the House.

IRS Questions and Answers on COVID-19 IRA and 401(k) Loans & Distributions

IRS Questions and Answers on COVID-19 IRA and 401(k) Loans & DistributionsThe CARES Act stimulus package substantially relaxed the rules around certain retirement account loan and distribution requirements, but with much confusion. As a result, the IRS recently put out a FAQ document to address the COVID-19 rule relaxation around IRA and 401(k) loans and distributions. This important information should come as welcome news for the nearly one percent of all retirement plan holders who have already taken a distribution under the new rules, according to Fidelity Investments.

Who’s eligible?

If you, a spouse or dependent tested positive for COVID-19, you automatically qualify. You also may qualify under less direct circumstances, such as experiencing economic hardship due to being quarantined, laid off, receiving a reduction in work hours, or missing work because you don’t have childcare. Business owners who are forced to close or reduce operating hours also qualify.

How Much Can I Take Out?

COVID-19 impacted individuals can take up to $100k in distributions without paying the 10 percent penalty imposed on early withdrawals by people under 59 1/2 years old. The $100,000 limit is the total for all the plans you have. For example, if you take $70k out of your 401(k), you can take only up to $30k out of your IRA under these rules. You will still owe taxes on the distributions as ordinary income; however, you are able to pay the taxes owed over a three-year period.

Can I Pay Myself Back?

The law also allows you to pay yourself back. Taxpayers can replace their distributions if they do so within a three-year timeframe. This means that if you take out a distribution in 2020, start to pay the taxes owed over the three-year rule and then pay back the distribution in 2022, you’ll be able to amend your 2020 and 2021 returns to get a refund, as well as not pay the tax you would have owed in 2022.

How Do Loans Work?

The maximum amount you can borrow increases from $50,000 to $100,000. You also can borrow the entire amount of your plan balance up to this limit (net of any outstanding loans). Moreover, for any loans you already have within the plan, the due date for payments due through the end of 2020 can be postponed for up to one year.

Is There Anything Else I Should Know?

Yes. First, there is more guidance coming from the IRS. Second, if you are eager to know what this formal guidance will look like, you can turn to the Hurricane Katrina relief rules from 2005 as this is what is expected will apply for the COVID-19 measures as well. Lastly, the IRS will generate a new form 8915E where taxpayers will report the repayment of COVID-19 covered distributions.

Understanding the Federal Government’s Proposal for Opening Up Again

Understanding the Federal Government’s Proposal for Opening Up AgainAfter seeing a peak and then a sustained decline in coronavirus cases, hospitalizations, and deaths resulting from COVID-19, the White House and the Centers for Disease Control and Prevention has rolled out a three-tier approach to get the nation back to its pre-coronavirus economic activities.

While this program is led by the Federal Government, it is ultimately up to governors how they will reopen states and localities. However, there are some universal criteria that states must follow to gradually reopen the economy.

Before transitioning from the stay-at-home orders to the three phases, certain criteria must be met. In order to move to less restrictive phases, there must be a dropping trend of documented cases over 14 continuous days or a downward trajectory of positive tests as a percent of total tests over 14 continuous days, according to guidelines set out by the White House and the CDC. Once the initial gating criteria are met, the local government can move into phase one.

Phase One

This stage will permit establishments such as places of worship, movie theaters, restaurants, and sporting arenas to reopen if they abide by strict social distancing guidelines. Along with recommending stringent sanitation guidelines for permitted establishments to reopen, this phase also suggests telework for employees and minimizing nonessential travel.

Phase Two

Schools, daycare centers, and camps (and similar events) could resume, along with nonessential travel. Establishments permitted to reopen in phase one can remain open and are now permitted to relax their physical distancing to a moderate level. Bars can start reopening, with diminished standing-room occupancy, and gyms can stay open with strict distancing and sanitation protocols.

Phase Three

This phase would come into force when the state and/or locality has no evidence of a relapse. Worksites would see normal staff protocols without restrictions. Large establishments will be able to function under limited social distancing protocols; gyms will operate with standard sanitation protocols, and bars would be able to run with increased standing room occupancy.

As states across the country are reopening, there are many preparations that businesses can implement to stay compliant with government mandates, including re-integrating their workforce and encouraging customers to return to establishments.

Sanitation

Along with social distancing, maintaining sanitation is equally important. Encouraging workers to wash their hands at every available opportunity, including upon arriving at work; before and after eating; after touching doors, desks, keyboards, and other materials; using the restrooms, etc.

Cleaning

Whether it’s an office environment or a retail/restaurant establishment, cleaning surfaces at least once a day is recommended, but more often for surfaces that are touched or used during the course of business. Examples of items to sanitize regularly throughout the day include handles, tables, elevator buttons, sinks, registers, and point of sale terminals.

Signage

Reminding employees and visitors to go home if they have symptoms or have been exposed to the coronavirus through signage is recommended. A protocol to contact the front office based on these circumstances should be implemented.

Encouraging Telework

Identifying tasks suitable for telecommuting versus in-office is helpful for task completion, as well as promoting social distancing. Look at the perspective of work from two buckets – solitary or collaborative – and telecommuting and office time can be split accordingly. If an employee is tasked with writing reports, performing research, or calling experts, he or she could easily work from home. While collaborative work can be done remotely, it is better to be done at the office.

Other Considerations

Along with face masks, there are other ways to reduce the potential for coronavirus transmission. Offices and other establishments can have fewer seats in common rooms, using tape to mark 6 feet or more of distance. When it comes to hallways, one way to stop face-to-face exposure is to have one-way corridors. While it might create longer days, staggering shifts to reduce the number of people in the office and rearranging breaks would also reduce unnecessary employee-to-employee interactions.

Ditching cash as an accepted form of payment is another way to reduce the likelihood of coming into contact with the coronavirus on currency, along with encouraging social distancing since cash doesn’t need to be exchanged. Using online/digital payments or credit cards only is one way to accomplish this. Using designated entrances for workers (or customers), coupled with designated entrances and exits can help reduce opposing traffic and people meeting face-to-face.

While research continues to create a vaccine and render the coronavirus harmless, until that happens, businesses have many tools to reopen their businesses for the foreseeable future.

Sources

https://www.whitehouse.gov/openingamerica/

Are Dividends Becoming a Luxury During the Coronavirus Pandemic?

drop of 27 percent in dividendsAccording to the futures market, Chicago Mercantile Exchange contracts are forecasting a drop of 27 percent in dividends over 24 months for the S&P 500 index. Dividends are projected to fall to $42.05 in 2021, a drop from 2020’s dividend of $47.55 and 2019’s high of $58.24. Looking forward to 2026, according to CME’s futures contract, the dividend is expected to recover to $56.65. While the latter years are not as likely as what’s up next, it’s worth taking note.

Although these dividend levels have already been announced, the future doesn’t look much brighter. According to Goldman Sachs, Q2 economic growth is expected to drop by 34 percent. Even though the COVID-19 economic crisis is expected to be worse, we can get an idea of how bad by comparing it to the financial crisis of 2008. From 2007 to 2009, the S&P 500 dividend dropped by 25 percent; it took 48 months to recover from this drop. Based on this historical look-back, chances are it’ll take longer to get back to par this time around.

It’s noteworthy to highlight companies that suspended their dividends in April 2020, and when they last suspended their dividends, historically speaking. Dine Brands Global (DIN) initially paused its stock-buyback program. This was followed up with a suspension of its quarterly dividend of 76 cents. Royal Dutch Shell lowered its dividend by two-thirds to 16 cents per share, the first time since 1945. These examples illustrate just how dire the economic situation is for companies around the world.    

Cash Dividends Explained

A cash dividend is money distributed to stockholders according to a corporation’s present earnings or amassed profits. Dividends are declared and issued by a board of directors that determines whether they’ll remain the same, increase or decrease. 

Understanding the Need to Reduce or Cut Dividends

A dividend cut often results in a drop in a company’s stock price since it indicates a weakened financial position. Oftentimes, dividends are cut because earnings are dropping or there’s less money available to pay the dividend, which can be due to increasing debt levels.

The point here is that dividend cuts are a poor sign for a company that is facing financial difficulties due to reduced revenue, with the same overhead still needed to be paid (rent, wages, insurance, debt servicing). While dividends can be cut for short- or long-term reasons, such as buying their own stock back or buying out another company, with the ongoing coronavirus situation the majority of businesses aren’t doing it for positive reasons.

While reducing or removing a dividend from a company’s stock can divert cash for ongoing operations or debt servicing, it also can tell the markets things aren’t going well financially. This is illustrated by looking at AT&T. In December 2000, the company reduced its dividends by 83 percent, lowering it to 3.75 cents, versus the expected 22 cents by shareholders.

One of the first signals that a company can’t pay dividends, or won’t be able to in the near future, is to look at the company’s earnings trend and its payout ratio.

Looking at a Historical Example

During the second half of the 1990s, AT&T’s stock faced more and more competitors as deregulation went into effect. According to the company’s income statements from 1998 to 2000, annual earnings per share dropped by 50 percent.  

This data is according to AT&T’s 10-K, which shows that its yearly earnings dropped from $1.96 in 1998; to $1.74 in 1999; and finally to $0.88 in 2000. With this precipitous decline in earnings and the financial pressure it put on AT&T, a reduction in dividends came next. Based on this data and some analysis, we can explain how the Dividend Payout Ratio works.

Understanding the Dividend Payout Ratio

Using this ratio can help investors gauge how likely a company’s dividend will be cut or removed altogether.

Dividend Payout Ratio = Dividend Payment per Share / Earnings per Share

Looking at AT&T’s 10-Q report for Q3 of 2000, AT&T earned 35 cents per share and gave shareholders a dividend of 22 cents a share. Based on the dividend payout ratio formula, the resulting ratio was 0.63. This ratio means that 63 percent of AT&T’s earnings were given to shareholders via dividends. When companies have challenging earnings seasons, the payout ratio gets closer to 1 because whatever the company earns is eaten up by the dividend. Therefore, the closer the ratio gets to 1, the more likely the dividend will be lowered or suspended.

While there’s no predicting what the economy will do in the future, looking at past trends can give investors insight into what companies will do with their dividends when the economy faces new headwinds.