Week 39: How malware gets onto your device
Reports of malware account for a relatively small proportion of all reports received by the NCSC. Most of these have involved ransomware attacks, which can cause considerable damage. However, in recent weeks, the NCSC has been receiving an increasing number of reports of targeted attempts to infect devices with malware. These include "ClickFix" attacks and attempts to trick people into downloading malware as part of a recruitment process. The NCSC is therefore dedicating the next two Weekly Reviews to malware, covering everything from how devices become infected to how you can protect yourself against ransomware. This first article examines the various infection vectors and explains how malware can infiltrate a device.
Malware poses one of the biggest threats to computers, smartphones, and other connected devices. Often remaining undetected for long periods of time, it can cause considerable damage in the background. The specific aim of a piece of malware depends on its type. Common aims include stealing data and login credentials, and extorting money. Malware can also be used to control devices remotely, without the owner's knowledge, or to use them in further attacks. So, how does malware get onto a device? The most common methods are described below.
PCs and laptops
There are various ways in which conventional computers running Windows or macOS can become infected. One method that is currently being seen quite frequently is the "ClickFix" attack. On a compromised website, you are led to believe that there is a technical issue or that you need to perform a particular action. Rather than exploiting a technical vulnerability, this attack relies on you carrying out the action yourself.
Programs and apps from untrusted sources can also infect devices, as can fraudulent advertisements within apps, particularly free ones. Downloading software from unfamiliar websites or installing potentially manipulated programs from unverified sources increases the risk of downloading malware.
Browser extensions can also pose a risk. Some have extensive access to browser data, including saved passwords. A malicious extension could spy on your data or redirect you to manipulated websites, for example. That's why you should only install the extensions you actually need.
For a long time, email attachments were one of the main ways of delivering malware to devices. While this infection route has not disappeared entirely, the security mechanisms built into modern operating systems have made it much less common.
Smartphones
Smartphones are most commonly infected through apps installed from untrusted sources. Installing apps from unofficial app stores or directly from the internet – such as APK files on Android devices – is particularly risky if you do not know who the app comes from or whether it has gone through a review process.
Even apps from official app stores carry some risk. Although store operators check apps for malware and other problematic features, these checks cannot guarantee complete security. That's why you should only install apps that you actually need. You should also check that the provider is legitimate, and that the permissions requested by the app are appropriate.
TVs, security cameras, printers and other IoT devices
Malware does not only affect computers and smartphones. Internet-connected devices, sometimes called Internet of Things (IoT) devices, can also be attacked. These include routers, security cameras, network video recorders, smart home devices, printers, TVs and other connected devices.
Outdated devices with known vulnerabilities are particularly problematic. Unchanged default passwords also pose a significant risk. Such devices are often inadequately protected and may also be accessible from the internet, for example because port forwarding has been enabled on the router, allowing access from outside the home network.
A compromised router can manipulate network traffic or attack other devices on the network, for example. IoT devices can become part of a botnet and be used to subsequently attack other systems or spy on people. Therefore, security updates should be installed promptly on these devices, and default passwords should be changed immediately. Where possible, devices for which the manufacturer no longer provides security updates should be replaced or secured so that they can only be accessed from within the home network.
Recommendations
It is impossible to guarantee complete protection against malware. However, taking a few basic precautions can significantly reduce the risk of infection.
- Keep your devices and software up to date
Install security updates for operating systems, browsers, apps and other software promptly. Many attacks exploit vulnerabilities for which an update is already available. - Use antivirus software
PCs and laptops should have up-to-date antivirus software installed. The security features built into modern operating systems already provide important basic protection and should not be disabled without good reason. - Only install software from trusted sources
Wherever possible, download programs and apps from official stores or directly from the manufacturer's website. Avoid unfamiliar download sites. - Do not blindly follow instructions
Be particularly cautious if you are told to run certain commands, disable security features or install unfamiliar software. "ClickFix" attacks in particular rely on you carrying out part of the attack yourself. - Limit browser extensions
Only install trusted extensions that you actually need, and remove any that you no longer use. - Protect your passwords and login credentials
Use strong passwords of at least twelve characters, including upper- and lower-case letters, numbers and special characters. Use a different password for each application or service rather than reusing the same one. If possible, enable two-factor authentication. - Do not overlook security on IoT devices
Keep routers, cameras and other connected devices in your home up to date and protect them with unique passwords. Where possible, disable any functions or access options that you do not need.