Much like the Internet itself, your computer is a battleground for malicious software (a.k.a. malware). Thus, financial advisors must be extra diligent about avoiding infection, given the sensitive nature of their work. But what are these threats and how can they be avoided?

Back in the day, malware took the form of a simple virus that infected computers via a disk or a file. Since then, malware has evolved and matured, posing a variety of threats. One of the least dangerous is adware, which typically hijacks browsers to display the adware’s advertisements on web pages. Although adware can slow down computers and make them unreliable, this form of malware is more of an annoyance than anything.

– The spy inside

A more dangerous type of malicious application is spyware, which monitors your activities, potentially logging your keystrokes to learn your passwords as well as looking at which websites you visit. The attacker responsible for the spyware then can use your information to compromise your accounts.

Still more worrying are botnets and remote administration tools (RATs), which enable an attacker to take over your computer entirely. There are a few key differences between these two types of malware: botnet malware joins your computer to a vast army of computers controlled en masse by an attacker. These may be used to launch attacks on other computers, to send spam email or even to host pornography.

RATs, on the other hand, are used to control a single computer in a targeted attack. These malware can be used for spying purposes, not just by keystroke logging, but also by turning on your computer’s webcam and microphone. The attacker can control your desktop, turn your computer on and off, delete files or install more malware.

Some malware applications will do more than one of these things. One strain of malware, known as Dridex, can steal your banking login credentials and send them to the attacker, join your infected computer to a botnet and function as a RAT. Thus, Dridex can send money to the attacker from your infected computer, even if the you use a smartcard reader to protect your online banking sessions.

Other malware can include another, increasingly popular attack tool: ransomware. This tool is one of the most dangerous kinds of malware because of its immediate financial effect. Ransomware scrambles files on your hard drive, rendering them useless, then demands payment to restore your files. If infected, you will be asked to send a payment in the bitcoin cryptocurrency, because it’s untraceable.

Finally, be wary of another increasingly common attack: browser hijacking. This alters your computer, directing it to an alternative, malicious version of a legitimate website, such as an online bank or a search engine. The attacker then can snoop on your banking sessions.

– How malware gets installed

One of the most popular installation methods for malware is via a phishing email. The attacker sends an email that persuades you to open a file attachment that’s infected with malware. The email also could encourage you to visit a malicious website that uses a vulnerability in your browser to install malicious code.

Malware doesn’t come just from malicious websites, though. Even legitimate websites can infect users with drive-by downloads. This often happens when websites display advertisements from third parties, but don’t vet those ads properly; such an attack is known as “malvertising.” These malicious advertisements can take control of your browser and compromise your computer. Last summer, for example, ads on eBay, the Drudge Report, www.weather.com and AOL were hit with malvertising, meaning that users of these reputable websites were infected.

Another common infection method is the Trojan horse. In this attack, a seemingly legitimate software tool carries a secret, malicious payload. This malware can range from pirated software to screen savers, online games and computer utilities, but it also covers rogue antivirus software. Many attackers offer anti-malware tools that seem legitimate, but actually infect your computer. These attackers often may persuade you to install this software by displaying fake infection messages on compromised websites.

– Ways to protect yourself

So, how can you protect yourself from these online nasties? Antivirus tools still are a first line of defence, and Investment Executive published a detailed buyers guide last year to help you choose the most appropriate one. You can find this guide at bit.ly/1PPE4ma.

Many of these antivirus applications include anti-spam capabilities to stop phishing emails from reaching you in the first place. Financial advisory firms also can use online services from companies such as Trend Micro Inc. that scrub emails of malicious links and attachments.

There are other protective methods that should be used in combination with these tools, though. For example, a safe domain name system (DNS) service can stop you from visiting known malicious destinations.

DNS is like an address book for the web. This service turns web destinations that humans can understand, such as www.investmentexecutive.com, into Internet addresses that make sense to computers, such as “38.102.92.115.”

Most web users rely on their Internet service providers to translate one address into the other, but there are some DNS services that also check the Internet addresses to see if they are associated with any malicious activity and will warn you in advance before letting you visit that destination. OpenDNS, a unit of San Jose, Calif.-based Cisco Systems Inc., offers free home-use versions of this service and fee-based versions for business users.

Other protective methods include always keeping your operating system (OS) or software up to date. Microsoft Corp.’s Windows now updates itself automatically by default, although you can switch that off by completing a set of complex steps. Ensure that other software on your computer also are updated, whether they’re browsers, utilities or productivity software. “Unpatched” software is one of the biggest causes of infection.

– A multi-layered defence

Finally, avoid connecting any untrusted removable media, such as a USB key drive or a removable hard drive, to your computer. Windows will automatically run certain programs on a USB key unless configured not to do so; but, even then, some files may not be safe.

Ultimately, protecting yourself from malware is about multiple layers of defence. No single tool or service can guarantee protection from a particular threat. However, a selection of tools and techniques can minimize your risk when used together.

You can’t be too careful when dealing with the growing base of highly innovative malware littering the Internet.

FIGHTING MOBILE ATTACKS

Mobile devices are likely targets for attackers because they’re such an intimate part of our lives. Attackers can use your smartphone’s microphone and camera to listen in on your meetings, as well as hack your device to make phone calls to premium-rate numbers.

Mobile remote administration tools (RATs) can send your smartphone’s location to an attacker, then compromise your smartphone to provide an extra level of authentication when accessing websites. These malware tools include AndroRAT, DroidJack, OmniRAT and Dendroid.

Even more worrying, some legitimate websites now send an authentication code to your smartphone as a protective step before completing a transaction. If an attacker has control of your smartphone, your codes are compromised.

Here are some things you can do to keep the data in your pocket safe:

1. Upgrade your operating system

Ann Arbor, Mich.-based Duo Security Inc. recently analyzed two million smartphones running its security software. That study found that 80% of iPhones were not running the latest version of iOS, and thus missing out on security improvements. Only 5% of Android devices were running a current version of that operating system. Furthermore, one-third of Android devices were running versions susceptible to malware that can infect a smartphone when you open a simple multimedia text message.

2. Don’t root or jailbreak your smartphone

You may run tools to remove the restrictions that vendors impose on smartphones. This allows your “jailbroken” device to run unauthorized apps, commonly riddled with malware, from sources other than the official app store.

3. Don’t use non-standard app stores

Apple Inc. has only one app store, but the Android operating system has several providers. Android users should use only the official Google Play app store.

4. Always check permissions

Apps installed via an official store will request specific permissions, such as access to your device’s camera or location data. Take notice of what is asked. If the app you downloaded to turn your camera’s flash into a torch is asking to access your contacts and make calls, think twice.

Finally, install mobile antivirus protection software (MAPS) from a well-known vendor if you use an Android device. (Apple doesn’t allow MAPS on its App store, claiming superior protection.) With so much valuable information on your smartphone, being diligent pays off.

© 2016 Investment Executive. All rights reserved.