Symantec: ‘ Update’ may just be a trap for PC users

Downloading can infect network, company warns

Hacker attacks on large companies were up 40 percent in 2014 from the year before, Symantec said in a report released Wednesday.

And when vulnerabilities in software were discovered, it took vendors 59 days to repair them, as opposed to four days in 2013, Symantec said in its 2014 Internet security threat report.

Five out of every six large companies were targeted by various hacker attacks, the Mountain View firm said.

And the hackers often succeeded with a simple trick, an “update” to a legitimate piece of software.

Once the unsuspecting employee clicked “download,” a Trojan horse would give hackers a free ride into company networks, where they had “unfettered access,” the company said.

“Hackers are a lot faster, more creative and are using more resources and making it harder for companies to defend themselves,” said Satnam Narang, Symantec senior security response manager.

The corrupted software update is a scam known as the “watering hole” that grew in popularity among hackers last year, he said.

“Like animals in the wild who wait for prey to come to the watering hole, they plant code on websites that are commonly visited by their target. Individuals have no course of action to protect themselves and they get infected with malware,” he said.

Advanced hackers also were using a company’s own infrastructure against it, the report said.

For example, hackers installed legitimate software onto compromised computers to use as a cloak to avoid discovery by anti- malware tools, or they used company management tools to move stolen intellectual property around a company network. Once inside the network, some hackers built custom attack software using the company’s own servers.

Ransomware was up 113 percent, the report said, and mobile was increasingly under attack.

In 2014, 17 percent of the apps on Android stores were malware, it said.

“They were often knock- offs of popular games and apps,” Narang said, adding that Google said last month it is doing app reviews now.