Week 40: Malware myths and what to do if you suspect an infection
The NCSC is currently receiving an increasing number of reports of targeted malware attacks. Following on from last week's look at the most common infection methods, this part of the series explains what to do if you suspect an infection. It also dispels some common myths that the NCSC is frequently asked about.
There are a number of common misconceptions about malware that are no longer accurate. The NCSC is particularly often asked whether simply visiting a website or opening an email can infect a device.
Can opening an email or website infect my device?
Simply opening an email, WhatsApp message or website will only infect your device in very rare cases. Modern operating systems and browsers have numerous security mechanisms in place. Provided the operating system, browser and other software are kept up to date, it becomes extremely difficult for scammers to install programs on a device without the user taking some form of action. As a rule, some action or consent is required on their part. Similarly, answering a scam call will not infect a mobile phone with malware.
There are, however, exceptions. Specially crafted websites or files may attempt to exploit vulnerabilities in operating systems, browsers or other software. In the case of previously unknown vulnerabilities, even a fully up-to-date system may sometimes be affected. These ‘zero-day’ attacks are rare and are generally not carried out on a large scale; instead, they target specific individuals, such as politically exposed persons, employees of international organisations, or diplomats.
Far more often, attackers try to trick people into taking action themselves – for example, by installing a program or running a command that infects their device.
Are macOS systems better protected against cyberattacks?
Mac users can also be affected by malware, as there are many types of malicious software designed for macOS. These include credential-stealing software and spyware, as well as programs that encrypt files or use the computer to carry out further attacks. In short, essentially all types of malware found on Windows also exist for macOS.
Apple has built a range of security features into macOS. While these provide important protection, they do not make Macs immune to attack. Mac users should therefore also install security updates and only download software from trusted sources.
Does antivirus software protect against all infections?
Although antivirus software is an important security measure, it cannot provide complete protection. New malware may initially go undetected, and it can take some time before antivirus software is updated to recognise it. This can be particularly delayed in the case of malware that is only circulating in a specific region. Attackers may also try to trick people into carrying out harmful actions themselves. Antivirus software should therefore be seen as an additional layer of protection rather than the only line of defence. It is no substitute for installing security updates or being careful when using your device.
How can you tell if your device is infected?
An infection is not always immediately apparent. Malware is usually designed to operate unnoticed, as attackers want to remain undetected for as long as possible. One important sign is a warning from your antivirus software or operating system. Such warnings should never be ignored. In particular, if security software detects and blocks malware, you should take a closer look at the warning. Be wary, however, of pop-up messages claiming that your device is infected and telling you to call a particular number. These are fake support scams.
Other possible signs include:
- Browser extensions that you do not recognise;
- Unusual changes to browser or system settings;
- Unexpected adverts or redirects in your browser;
- Unusually high CPU, memory or network usage;
- Your device becoming noticeably slower for no apparent reason.
- Programs opening or closing unexpectedly.
- Frequent system errors;
- Local files being changed, deleted or encrypted.
- Unrecognised logins to online accounts;
- Suspicious messages or emails being sent from your accounts.
- Passwords or other login credentials suddenly no longer working.
None of these signs on its own proves that your device is infected. A slow computer, for example, can have many other causes. However, if you notice several of these things happening at the same time, it is worth investigating further.
Recommendations
- If you suspect your device is infected with malware, have it examined by a specialist.
- The changes that malware makes to a system are often difficult to undo. If a device is infected, the whole system needs to be reinstalled. Regular backups will help prevent data loss.
- After reinstalling the system, change the passwords for all your online accounts, including email, online banking and social media. The malware may have sent your login credentials to the attackers.
- If you also use the device for work, or if it is a work device, inform your employer or your company’s IT department.
- For smartphones, we recommend resetting the device to its factory settings and setting it up again from scratch.
- You can also reset IoT devices to their factory settings and set them up again. Install the latest firmware and protect the device with a strong password. Do not allow incoming connections from the internet. If the device is so old that no current firmware is available, consider replacing it.