“The Travelers Guide To Wi-Fi Hacking”

  • 0

“The Travelers Guide To Wi-Fi Hacking”

Dear Blast Reader,

Do you stay at hotels when you travel? Do you ever use the hotel internet? Did you know that there may be someone spying on you while you are in your hotel? Did you know that hackers target hotel Wi-fi? Did you know that the hackers that target hotel wi-fi also target traveling business professionals?


Hotel wi-fi is targeted and compromised to assist in the delivering of the malicious payload to the selected victims. A ­payload is the part of the malware that performs the malicious action. Those behind the attack continually evolve the malware’s tactics and payload. It is believed that the attackers are exploiting the vulnerabilities in the server software, either by:

  • Gaining remote access.
  • Physically gaining access to the hotel and the hotel’s servers.


Now, attackers are using a new form of malware known as the “Inexsmar Attack”. This attack starts with a phishing email.  To make the email look real, the message is tailored to you. This email address you by name, and has real looking documents attached.


But, looks can be deceiving. Within this email there is a self-extracting archive package. This is a package that begins the trojan downloader process. A trojan downloader process is a malicious program, usually installed through an exploit or some other deceptive means. Using email attachments the malware is installed onto your computer. Once you are convinced to open the attachment, hackers will then initiate their malware attack.


How does the malware go un-detected?

To prevent being detected, the malware is downloaded in stages. These stages include:

  1. Hiding malicious codes and strings by linking malicious code to otherwise unrelated code.
  2. The malware then runs an operation to download the second part of the payload, the trojan malware.


So, as your defences improve, it is believed that the multi-stage download for the trojan malware is an evolutionary way to keep the trojan viable.

So, how do you protect yourself?

To protect yourself against this new form of advanced and evolutionary trojan malware, here are a few tips:

  1. Use public wi-fi as little as possible. Hackers exploit public wi-fi in places like coffee shops, restaurants, and hotels.
  2. Use a Virtual Private Network, also known as a VPN. VPNs are encrypted web browsers that hide your IP addresses & your location.


If you have any questions about Hacking, Malware, Cyber Security, or Computer Forensics contact FDS Global. You can reach us at our office at (954) 727-1957 or by email at RMoody@FDS.Global. Please feel free to visit out website at www.FDS.Global.

  • 0

“Don’t Let Your Independence Be Hacked”

Dear Blast Readers,


From everyone here at FDS Global we would like to wish you a Safe and Happy Fourth of July! As we celebrate this national holiday, Cyber Threats are continuing to get more advance.


The recent outbreak of the ransomware known as “Expetre” is not really a ransomware attack. It is really a form of malware known as a “Wiper Attack”, which can disguise itself so its victims are unaware of how serious it is.


A “Wiper attack” is a type of attack that sabotages PC computers. It is different from ransomware because it was created to destroy the data that is located on the computers disk.  While ransomware is a form of malware that blocks data, and threatens to delete or publish the data unless the user pays the ransom.

How does a “Wiper Attack” destroy data?

It destroys the data on the disk by overwriting the Master Boot Record, also know as the MBR. This form of malware is called a “Wiper” because it wipes part, if not all, of the drive.


It can be mistaken as a ransomware because the infected computer displays a message on the screen. This message states that the user’s files have been encrypted, and if the users pay a ransom then the encrypted files will be decrypted and returned. The user is then provided with an email address to send their payment information to.


But, little does the user know the ransom will have no affect when it comes to decrypting their files.


Why will the ransom have no affect?

The ransom will not have any affect because the email address provided to the user is inactive. Unfortunately, even if the email was active and the ransom could be paid in full, recovery of the MBR is impossible once wiped.


So, how are you supposed to protect yourself and/or your organization from this type of malware attack?

Here are a few tips:

  1. Any crucial and confidential information should be stored in hardened systems. Systems that can only be accessed one way, through privileged connections.
  2. Important data should be backed-up and stored somewhere offsite.
  3. It is important to institute and test an emergency recovery & response plan.


If you have any questions about Ransomware, Malware, Cyber Security or Computer Forensics contact FDS Global. You can reach us at our office at (954)727-1957 or by email at RMoody@FDS.Global. Please feel free to visit our website at www.FDS.Global. Enjoy your holiday!

  • 6

“IoT Devices Beware: The BrickerBot”

Dear Blast Readers,


Do you leave your IoT (Internet of Things) Devices connected to the internet? Did you know that if you leave you IoT devices connected to the internet, even when you are not using them, it opens doors allowing hackers more time to gain control of your devices? Did you know that there is a form of malware that leaves your device impossible to use once infected?


A BrickerBot is a form of malware that has been created to infect a collection of devices. The “Bricker” in “BrickerBot” is referring to rendering a device, or devices, completely useless or inoperable, like a brick used as a paperweight. This is accomplished when the BrickerBot corrupts the device’s storage capabilities.


The way in which BrickerBots behave do not always match up with the behavior of traditional botnets. A botnet is a network of devices that have been infected. Their purpose is to keep the infected devices around for as long as possible.


Most botnets can be used for:

  • Sending out spam.
  • DDoS Attacks (also known as “Distributed Denial of Service Attacks”).
  • Phishing Attacks.


BrickerBot Malware uses a “Permanent Denial of Service” attack or PDDoS attack. This is when the BrickerBot physically disables the device.




The device is physically disabled when the BrickerBot corrupts the firmware on the devices. Usually the only way to fix this is to replace the device, or if possible re-install the firmware.


BrickerBots use a set of commands to help accomplish their end goal of “Bricking” your smart devices. These commands will:

  • Render Flash storage useless by writing random bits to the storage drives on the devices.
  • Disabling TCP Time stamps, leaving connectivity vulnerable.
  • Limiting the processes that the devices can run at once.


How are you supposed to protect yourself from a BrickBot?

To protect yourself and your IoT Devices from BrickBots, you should:

  • Change your login information (BrickBots come with a dictionary containing default login information).
  • Limit the internet connectivity your device has. (Leaving your IoT devices connected, especially when you are not using them, gives hackers more time to take control and infect your devices.)
  • Install updates as frequently as they become available.


It is important to remember:

  • Every device that is smart and/or has internet connectivity should have STRONG PASSWORDS.
  • Take security into your own hands, do not rely on default security from the manufactures. (Remember: BrickBots come with a dictionary that contains default login information. Changing your login information should make your devices harder to hack.)


If you have any questions relating to IoT Devices, IoT Security, Hacking, Cyber Security or Computer Forensics contact FDS Global. You can reach us at our office at (954) 727-1957 or by email at RMoody@FDS.Global. Please feel free to visit our website at www.FDS.Global.