Reset

Hikvision’s Senior Cybersecurity Director on Current Cyber Threats: Zero-Day Vulnerability Exploits and Ransomware on the Rise

December 1, 2020

Hikvision HikWire blog article Current Cyber Threats: Zero-Day Vulnerability Exploits and Ransomware

Hikvision Senior Director of Cybersecurity, Chuck Davis, blogs about current cyber threats and trends to help our partners stay cybersecure. Today, Davis is covering zero-day vulnerability exploits in iOS and Android, and ransomware on the rise.

A vulnerability is a weakness in software that, when exploited, can give an attacker the means to do something malicious or unauthorized. Learn more about vulnerabilities in this Hikvision blog.

iOS Zero-Day Exploits
According to Kapersky.com, a zero day exploit “is a cyberattack that occurs on the same day a weakness is discovered in software. At that point, it's exploited before a fix becomes available from its creator.”

Apple released multiple security updates to iOS in early November that included patches for three zero-day vulnerabilities that are actively being exploited.

“The list of impacted devices includes iPhone 5s and later, iPod touch 6th and 7th generation, iPad Air, iPad mini 2 and later, and Apple Watch Series 1 and later,” reported The Hacker News.

Many iOS devices will update themselves, but to be sure you get the update in a timely manner, follow these steps:

  • Go to Settings > General, then tap Software Update.
  • Tap Download and Install.

To verify that you install updates automatically, go to Settings > General > Software Update > Automatic Updates, then turn on Install iOS Updates. Your device will automatically update to the latest version of iOS or iPadOS. Some updates might still need to be installed manually.

Android Zero-Day Vulnerability
Google recently patched additional Chrome vulnerabilities for Windows, Mac and Linux. Google also patched a zero-day vulnerability that is unique to Chrome on Android. “Chrome for Android has a zero-day hole that crooks are already abusing, so you need to patch,” according to NakedSecurity.

To stay safe from this vulnerability, ensure you have the latest version of Chrome running on your system:

  • On Windows, Mac, and Linux you should be running version 86.0.4240.183 or later.
  • On Android, you should be running version 86.0.4240.185 or later.

Ransomware on the Rise
Ransomware is a form of malware that is silently installed on someone’s computer after they fall for a phishing attack. Ransomware quietly encrypts all of the files and folders on your computer, and any data on connected USB or mounted shared drives, and then uploads the decryption key to the threat actor who tricked you into installing the ransomware.

According to the latest Coveware Quarterly Ransomware Report, ransomware is not only increasing in frequency, but the average ransom demand has greatly increased to $233,817 in Q3, up 31 percent from Q2 in 2020.

Additionally, attackers are more likely to keep stolen data to demand additional ransom to keep the victim’s data from the public eye, instead of deleting the files. However, Coveware has observed that some ransomware attackers are sending false evidence to prove that they deleted the data and then leaking the data anyway.

To defend against ransomware attacks, secure your network. Be very careful not to fall victim of a phishing attack, back up your systems, and keep sensitive data in offline backups. Learn more about phishing and vulnerabilities in these Hikvision blogs:

IMPORTANT! This model requires non-standard firmware. Do Not Install standard firmware (e.g. v.4.1.xx) on this model. Doing so will permanently damage your system. You must use custom firmware v.4.1.25 from the iDS-9632NXI-I8/16S product page.

By downloading and using software and other materials available via this website, you agree to be legally bound by HIKVISION General Terms of Use . If you don’t agree to these terms, you may not download or use any of those materials.

If you are agreeing on behalf of your company, you represent and warrant that you have legal authority to bind your company to the General Terms of Use above. Also you represent and warrant that you are of the legal age of majority in the jurisdiction in which you reside (at least 18 years of age in many countries).