Today the internet has become a ubiquitous part of our lives and businesses. There is so much that we each take for granted when searching the web for all manner of things. We have become conditioned to the fact that many actions include new needed security features. While matching pictures or doing simple math problems has become a necessary evil to completing many web-based requests, these changes are not perfect at thwarting cybercriminals. A relatively new technique in the cyber criminal wild is exploiting our acceptance of CAPTCHA.
A CAPTCHA test is designed to determine if an online user is really a human and not a bot. CAPTCHA is an acronym that stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.” Users often encounter CAPTCHA and reCAPTCHA tests on the Internet. Here is what we are used to seeing:
Most everyone understands that all that needs to happen when we encounter this security measure is to click on the box.
Now, cybercriminals have come up with a new technique to load malware onto our computers by exploiting the normalization of the CAPTCHA verification process.
What happens is this screen shows up when you click on the “I am human” box:
When we click on the alternative method, we are presented with this:
Cybercriminals are counting on users reading these instructions and following the steps as shown. They are seeking to control the computer on which the user is logged in, and this sequence of keystrokes grants them that permission. The first step opens up a command line prompt, and the second step pastes what the cybercriminal saved to the clipboard as the webpage was loading, which is a series of commands to retrieve a file, download it, and when Enter is pressed, everything will run on the computer, allowing the thief to completely take control.
Executive Summary
Remember and remind everyone in your organization that anytime something does not perform as expected, to STOP. Encourage them to reach out to your technology team to see what is truly being presented and seek their support when they encounter anything that looks “off” before it’s too late. Helping staff appreciate, understand, and embrace the consistency of changes in security protocols is the best way to crush cybercriminals. Invest in helping everyone understand clearly and patiently how to work to safeguard their work and personal computing environments, as these are unavoidably connected today.
If you are unsure whether you or your team have adequate protections or skill sets to address these types of concerns, reach out. Remember that Lead IT Consulting is here to help small businesses avoid cyberthreats as well as understand and navigate challenges in the IT landscape so your business can grow. We help our clients mitigate IT challenges daily to minimize risks. To find out more about how Lead IT Consulting can help your company with this and more book a meeting with the author or send an email to happiness@leaditconsulting.net.
