14 DAY TRIAL // Earlier this week, researchers from Trustwave uncovered a server hosting around 2 million credentials for various services. The data appears to have been harvested by cybercriminals with the aid of keylogging malware.
Such malware is designed to capture keystrokes and transmit the data back to a server controlled by the attackers, such as the one identified by Trustwave.
Experts note that the best way to protect a computer against such pieces of malware is to make sure that all the pieces of software installed on it – including applications and plugins such as Java, Flash, Reader and Adobe – are always up to date.
“Keylogging software is one of the oldest and most effective forms of information-harvesting malware in use. However, its effectiveness relies on the ability of the software to get onto a user’s system – be it a client or a server – install and run without being noticed,” Sergio Galindo, head of global product management at GFI Software, told Softpedia.
“Systems that are not fully patched with the latest application versions and critical updates are far more likely to fall foul of this kind of scam, as keylogging software and other malicious code will be able to take advantage of known operating system and application vulnerabilities in order to install itself and execute without detection.”
Galindo highlights the fact that while making sure that systems are always patched is essential, the task is not always easy to achieve, particularly for organizations that have a large number of endpoints. This is where automated patch management systems come into the picture.
“This is why more and more organisations are deploying automated, unified patch management systems as part of a multi-layered security defence alongside traditional AntiMalware protection, web content filtering and antispam both at the client and server level,” Galindo said.
There’s also the issue of zero-day vulnerabilities. However, such security holes are usually leveraged in more sophisticated, targeted attacks. Most users and organizations can fend off a majority of cyberattacks by making sure that their software is kept up to date.