alt=Digital illustration of a secure network with a glowing shield and padlock icons, symbolizing cybersecurity protection.

2025-06-05 Post a Comment

Do I need an antivirus and a VPN?

Story byÂ Sead FadilpaÅ¡iÄ‡

TheÂ best antivirusÂ acts as most people’s go-to for device protection, but as I have already discussed,Â there are some threats that antivirus can’t protect against.

With online threats are becoming ever more prevalent, an increasing number of people have an â€œit wonâ€™t happen to meâ€ attitude about their security.

Itâ€™s easy to understand why â€“ the web standards have drastically increased over the years, and vanilla browsers and operating systems have become better at identifying all kinds of dangers.

However, with the rising sophistication of cyberthreats (and an uptick in hybrid working environments), a robust antivirus software in combination with a VPN is necessary for complete protection of your computers.

The new threats emerging

Artificial intelligence is, unfortunately, ushering in an era of more sophisticated malware and phishing attacks. If AI-generated phishing emails that are indistinguishable from the real thing werenâ€™t bad enough, cybercriminals can now use AI to modify malware in real time, making it more likely to slip under the radar.

Thereâ€™s also a major uptick inÂ ransomware. In the past, threat actors would implant malware that would encrypt the data and demand a ransom in exchange for decryption. Now, they exfiltrate the data and threaten to leak it on the dark web.

Not only are ransomware kits freely available for purchase, thus lowering the barrier of entry for cybercrime, but attackers also use AI to optimize their methods and choose their next target.

Remote work environments are simply adding fuel to the fire. Hackers will often compromise unsecured home or public networks to gain access to company systems through vulnerable personal and work devices.

Unfortunately, not all cybersecurity risks happen at the hands of a shady external individual. People also have to contend with internal threats, such as children or the elderly who may inadvertently expose systems to malicious actors.

Again, people that enjoy remote working practices get the short end of the stick. Companies that allow staff to connect to the company network with personal devices may get their system decimated by malware on the employeeâ€™s own device.

Regardless of the nature of the threat, your entire home network including your personal device can completely fall apart due to a cyberattack, and the financial toll can lead to some serious headaches.

How an antivirus can help

While safeguarding your computer from the wide scope of emerging cyber threats requires continuous effort, a dedicated antivirus software is the bare minimum.

It protects your devices from malware and viruses by scanning files and applications, as well as keeping an eye on the network. In other words, a good AV can stop viruses and malware before they cause damage to your device and files.

Now, we get what you may be thinking â€“ modern devices usually have pre-installed antivirus software like Windows Defender. However, such solutions fall short of the comprehensive security that you might need to face modern threats.

For instance, even theÂ best free antivirusÂ may not have a centralized dashboard for monitoring security across different devices on your network. Windows Defender also doesnâ€™t protect against sophisticated threats like targeted attacks or zero-day exploits, and is notorious for its slow response time. Put differently, it may not recognize the malware immediately, and if it does, it may only identify the attack when a device is already infected.

On the other hand, a robust antivirus will safeguard your information and offer additional security layers. Modern tools also implement AI to identify issues more quickly, allowing you to proactively boost your network security.

Itâ€™s also worth noting that investing in antivirus software is cost-effective, especially when you compare it to all the expenses that a cyberattack could incur.

How a VPN can help

A VPN (virtual private network) is a piece of software thatÂ routes your data through an encrypted tunnelÂ to a secure server, encrypting your data in the process. In even simpler terms, it changes your IP address and makes internet traffic unreadable by third parties, even if they somehow manage to intercept the connection.

This simple tool is vital as it helps protect your sensitive data regardless of how secure the network it travels over is, thus allowing you to also securely access your companyâ€™s network and resources, or yourÂ cloud storage, in a safe and responsible way.

Compared to an antivirus, implementing a VPN is one of the cheapest ways to strengthen your cybersecurity. To put things into perspective,Â NordLayer, TechRadar’s top choice for theÂ best VPN, can be snagged for just $3.39 per month. Thatâ€™s practically nothing when you consider the benefits it brings to the table, and costs far less than a potential data breach.

Plus, VPNs often offer applications for different devices, including smartphones â€“ useful if you require protection across all platforms.

Do you need both?

The more the merrier also applies to your cybersecurity. While implementing just one measure is definitely a step in the right direction, both a VPN and an antivirus are necessary if you want to cover all your bases.

In short, a VPN protects the data transmitted over the internet and the connection itself. An antivirus is great against threats attempting to infiltrate the system. You can see a thread develop here, but these solutions are complementary and will lead to a better security posture.

For example, even if youâ€™re using a VPN, you might still fall prey to phishing and download an infected file. Whatâ€™s more, the opposite is equally dangerous. You may have solid AV protection, but if you connect to a public network, a hacker may be able to intercept the data in transit.

Should you invest in more advanced types of software?

Both an antivirus and a VPN are the essentials when it comes to protecting personal devices. However, businesses are more prone to cyberattacks, and need therefore need to stay on top of the latest developments. A good upgrade is theÂ best endpoint protectionÂ solutions, which are becoming the golden standard in digital security.

For consumers this is definitely overkill, asÂ I have discussed before. Most of the time, the combination of antivirus, VPN, and one of theÂ best password managersÂ is enough to secure you against most threats. But it is worth understanding the capabilities an EPP can provide.

Whereas an antivirus is limited to a single endpoint and uses signature-based detection (rendering it useless against fileless malware or threats that donâ€™t use a signature), an endpoint security suite scans all devices connected to the network for suspicious behavior. Put differently, it continuously scans all endpoints and can recognize threats a lot faster.

Investing in such a solution may often end up being more economical in the long run for many businesses. EPP can include a VPN, as well as the basic AV functionality (such is the case withÂ Avast Business Security), which centralizes the protection of the entire network and eliminates the need to deploy separate applications.

You can also get some extra goodies like USB protection, which disables the use of unauthorized removable storage devices. Other providers also employ advanced correlation engines that help identify green zone threats that a regular antivirus might overlook.

The good thing is that despite the advanced nature of an endpoint security software, itâ€™s as easy to implement as a traditional antivirus. You can get it up and running in a few minutes and instantly start protecting thousands upon thousands of endpoints.

Are these tools enough?

Despite being rather effective, the trio of antivirus, VPN, and endpoint security software may not erase all the vulnerabilities in your system, and thatâ€™s a fact. We can go as far as to claim they may be dangerous if they lull you into a false sense of security.

Look at it this way:

VPNs and antivirus software are just tools and will always be fallible unless you implement the right personal practices and cybersecurity awareness.

For individuals, this includes being wary of dodgy websites and questionable emails, and also making sure that what your are downloading is legal and from a reputable source. There are many horror stories of people looking to dodge paying for a game or service and being greeted with ransomware the second they launched their new ‘software’.

For businesses on the other hand, training to recognize fake login pages and phishing emails goes a long way in preventing you from becoming a target of a cybercrime. In addition to all the technological gizmos, you also need to work on your password policy byÂ creating strong passwordsÂ and enabling multi-factor authentication on all accounts that support it.

Once you minimize the possibility of human error (which is still theÂ leading source of cyberattacks), your VPN and AV will be a lot more effective in your hands, and significantly help you avoid becoming a cyberattack statistic.

alt=3D render of a stylized black and red checkers board with abstract pieces.

Cyber security

2025-02-11 Post a Comment

Huge cyber attack under way – 2.8 million IPs being used to target VPN devices

ByÂ Sead FadilpaÅ¡iÄ‡

Millions of devices, likely infected with malware, are being used in a hacking campaign
Researchers spotted brute-force attacks against VPN and other internet-connected devices
The majority of the IP addresses are located in Brazil

A wide range of Virtual Private Network (VPN) and other networking devices are currently under attack by threat actors trying to break in to wider networks, experts have warned.

Threat monitoring platform The Shadowserver Foundation warned about the ongoing attack on X, noting someone is currently using roughly 2.8 million different IP addresses to try and guess theÂ passwords for VPNs and similar devices built by Palo Alto Networks, Ivanti, SonicWall, and others.

Besides VPNs, the threat actors are going for gateways, security appliances, and other edge devices connected to the public internet.

Brute force

To conduct the attack, the threat actors are using MikroTik, Huawei, Cisco, Boa, and ZTE routers and other internet-connected devices, likely compromised withÂ malware, or broken into themselves, thanks to weak passwords.

Speaking toÂ BleepingComputer, The Shadowserver Foundation said that the attack recently increased in intensity.

From those 2.8 million, the majority (1.1 million) are located in Brazil, with the rest split between Turkey, Russia, Argentina, Morocco, and Mexico.

This is a typical brute-force attack, in which threat actors try to log into a device by submitting an enormous amount of username/password combinations, until one succeeds. Brute-force attacks are usually successful against devices protected with poor passwords (those that donâ€™t have a strong combination of uppercase and lowercase letters, numbers, and special symbols). The whole process is automated, making it possible on a grander scale.

The automation part is made possible through malware. Usually, the devices used in the attack are part of a botnet, or a residential proxy service. Residential proxies are IP addresses assigned to real devices by internet service providers (ISPs). They make it appear as though the user is browsing from a legitimate residential location rather than a data center, which makes them a major target for cybercriminals.

Cyber security

2025-01-23 Post a Comment

Dangerous new botnet targets webcams, routers across the world

Story byÂ Sead FadilpaÅ¡iÄ‡

Security researchers observe new botnet-building campaign called Murdoc
Its attacks are targeting IP cameras and routers
More than 1,000 devices have been identified as compromised

Cybersecurity researchers from the Qualys Threat Research Unit have observed a new large-scale operation exploiting vulnerabilities in IP cameras and routers to build out a botnet.

In aÂ technical analysis, Qualys said the attackers were mostly exploiting CVE-2017-17215 and CVE-2024-7029, seeking to compromise AVTECH IP cameras, and Huawei HG532 routers. The botnet is essentially Mirai, although in this case it was dubbed Murdoc.

Qualys said Murdoc demonstrated â€œenhanced capabilities, exploiting vulnerabilities to compromise devices and establish expansive botnet networks.â€

The persevering Mirai

The campaign most likely started in July 2024, and has so far managed to compromise 1,370 systems. Most of the victims are located in Malaysia, Mexico, Thailand, Indonesia, and Vietnam.

With a network of internet-connected devices (bots) under their control, malicious actors can mount Distributed Denial of Service (DDoS) attacks, bringing websites and services down, disrupting operations and causing financial and reputational harm.

Mirai is a highly popular botnetÂ malware. Created by three college students in the US: Paras Jha, Josiah White, and Dalton Norman, Mirai became infamous in 2016 after orchestrating a large-scale DDoS attack on Dyn, that temporarily disrupted major websites, including Netflix, and Twitter.

The creators released the source code online, right before their arrest in 2017. They pled guilty to using the botnet for DDoS attacks and other schemes.

While law enforcement continues to target and disrupt the botnet, it has shown great resilience and continues to be active to this day.

Less than two weeks ago, a Mirai variant named â€˜gayfemboyâ€™ was found exploiting a bug in Four-Faith industrial routers. Although clearly spawned from Mirai, this new version differs greatly, abusing more than 20 vulnerabilities and targeting weak Telnet passwords. Some of the vulnerabilities have never been seen before, and donâ€™t have CVEs assigned just yet. Among them are bugs in Neterbit routers, and Vimar smart home devices.

Cyber security

2025-01-10 Post a Comment

Look for the label: White House rolls out ‘Cyber Trust Mark’ for smart devices

Beware the IoT that doesnâ€™t get a security tag

Thomas Claburn

The White House this week introduced a voluntary cybersecurity labeling program for technology products so that consumers can have some assurance their smart devices aren’t spying on them.

“The White House launched this bipartisan effort to educate American consumers and give them an easy way to assess the cybersecurity of such products, as well as incentivize companies to produce more cybersecure devices, much as EnergyStar labels did for energy efficiency,” the White HouseÂ said.

The program is overseen by the US Federal Communications Commission. It will be administered byÂ 11 different companiesÂ [PDF], withÂ UL SolutionsÂ as the lead administrator. Makers of wireless consumer Internet of Things (IoT) devices will be able to submit their products for a security compliance review at an accredited laboratory.

And products that meet theÂ NIST-defined testing criteriaÂ [PDF] â€“ which cover secure software development and supply chain requirements, security lifecycle policies, vulnerability management policies, and the like â€“ will be able to display the US Cyber Trust Mark and a QR code that device owners can use to look up online product information related to password resets, security, and updates.

Vendors such as Best Buy and Amazon have said they’ll highlight products bearing the mark, so there’s a marketing incentive to participate in the program.

Image of different versions of the US Cyber Trust Mark – Click to enlarge

The US Cyber Trust Mark, available inÂ several attractive color schemes, is focused on IoT home security cameras, voice-activated shopping devices, smart appliances, fitness trackers, garage door openers and baby monitors. It’s not intended for medical devices regulated by the US Food and Drug Administration, wired products, automotive products, industrial or enterprise products, or equipment that falls under other network security regulations like theÂ FCC Covered List.

The program originated in 2021 when the White HouseÂ issued an executive orderÂ to improve cybersecurity in response to high-profile attacks like those targeting Colonial Pipeline and SolarWinds. The order, among other things, directed government officials to develop IoT cybersecurity criteria for a consumer labeling program.

In a statement, Amazon VP Steve Downer said Amazon looks forward to collaborating with industry partners and government officials to implement this program.

“Amazon supports the US Cyber Trust Markâ€™s goal to strengthen consumer trust in connected devices,” said Downer. “We believe consumers will value seeing the US Cyber Trust Mark both on product packaging and while shopping online.”

The US Cyber Trust Mark program “is not going to solve every problem that comes with the amount of connected devices a lot of us have in our homes, but it’s definitely not going to hurt,” RJ Cross, director of US PIRG’s Consumer Privacy Program, toldÂ The Register.

“The whole model is to incentivize companies to take security more seriously and prioritize transparency with the public. I’d say that we’re at the point that there are so many dang breaches and hacks that most folks are aware of cyber security as an issue. So giving people more info about the security of the devices they let in their lives is going to give them more control than they’ve had to date and that’s a good thing.”

Asked whether the certification program will shift the burden of security away from consumers to product makers, Cross said that’s the real question.

“The devil is in the details,” said Cross. “Any program worth its salt is going to have to be comprehensive. It needs to look not only how secure is the hardware of your smart washing machine, but also how secure is the cloud where the company is storing the data that’s collected through your washing machine.” Â®

Cyber security

2025-01-10 Post a Comment

Ivanti warns of new Connect Secure flaw used in zero-day attacks

Lawrence Abrams

Ivanti is warning that hackers exploited aÂ Connect Secure remote code execution vulnerability tracked as CVE-2025-0282Â in zero-day attacks to install malware on appliances.

The company says it became aware of the vulnerabilities after the Ivanti Integrity Checker Tool (ICT) detected malicious activity on customers’ appliances. Ivanti launched an investigation and confirmed that threat actors were actively exploiting CVE-2025-0282 as a zero-day.

CVE-2025-0282 is a critical (9.0) stack-based buffer overflow bug in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 that allows a unauthenticated attacker to remotely execute code on devices.

While the flaw impacts all three products, Ivanti says they have only seen it exploited on Ivanti Connect Secure appliances.

“We are aware of a limited number of customers’ Ivanti Connect Secure appliances which have been exploited by CVE-2025-0282 at the time of disclosure,”Â reads an Ivanti blog post.

“We are not aware of these CVEs being exploited in Ivanti Policy Secure or Neurons for ZTA gateways.”

Ivanti has rushed out security patches for Ivanti Connect Secure, which are resolved in firmware version 22.7R2.5.

However, patches forÂ Ivanti Policy Secure andÂ Ivanti Neurons for ZTA Gateways will not be ready until January 21, according to aÂ security bulletinÂ published today.

Ivanti Policy Secure:Â This solution is not intended to be internet facing, which makes the risk of exploitation significantly lower. The fix for Ivanti Policy Secure is planned for release on January 21, 2025, and will be available in the standard download portal. Customers should always ensure that their IPS appliance is configured according to Ivanti recommendations and not expose it to the internet. We are not aware of these CVEs being exploited in Ivanti Policy Secure.

Ivanti Neurons for ZTA Gateways:Â The Ivanti Neurons ZTA gateways cannot be exploited when in production. If a gateway for this solution is generated and left unconnected to a ZTA controller, then there is a risk of exploitation on the generated gateway. The fix is planned for release on January 21, 2025. We are not aware of these CVEs being exploited in ZTA Gateways.

The company recommends all Ivanti Connect Secure admins perform internal and external ICT scans.

If the scans come up clean, Ivanti still recommends admins perform a factory reset before upgrading to Ivanti Connect Secure 22.7R2.5.

However, if the scans show signs of a compromise, Ivanti says a factory reset should remove any installed malware. The appliance should then be put back into production using version 22.7R2.5

Today’s security updates also fix a second vulnerability tracked asÂ CVE-2025-0283, which Ivanti says is not currently being exploited or chained with CVE-2025-0282. This flaw allows an authenticated local attacker to escalate their privileges.

As Ivanti is working with Mandiant and theÂ Microsoft Threat Intelligence Center to investigate the attacks, we will likely see reports about the detected malware shortly.

BleepingComputer contacted Ivanti with further questions about the attacks and will update this story if we receive a response.

In October, Ivanti released security updates to fixÂ three Cloud Services Appliance (CSA) zero-daysÂ that were actively exploited in attacks.

Do I need an antivirus and a VPN?

The new threats emerging

How an antivirus can help

How a VPN can help

Do you need both?

Should you invest in more advanced types of software?

Are these tools enough?

Huge cyber attack under way – 2.8 million IPs being used to target VPN devices

ByÂ Sead FadilpaÅ¡iÄ‡

Brute force

Dangerous new botnet targets webcams, routers across the world

Story byÂ Sead FadilpaÅ¡iÄ‡

The persevering Mirai

Look for the label: White House rolls out ‘Cyber Trust Mark’ for smart devices

Beware the IoT that doesnâ€™t get a security tag

Ivanti warns of new Connect Secure flaw used in zero-day attacks

Lawrence Abrams

Add Living safe online to your Homescreen!