Cryptolocker, trick or threat: phishing e malware alla ricerca dell'anello debole

Il Cryptolocker è un malware diffuso su scala globale appartenente alla categoria ransomware. La mia analisi consiste nel ripercorrere le origini dei software maligni alla ricerca di rappresentanti del genere con caratteristiche simili al virus che senza tregua persevera a partire dal 2013: il Cryptolocker. Per imparare di più sul comportamento di questa minaccia vengono esposte delle analisi del malware, quella statica e quella dinamica, eseguite sul Cryptolocker (2013), CryptoWall (2014) e TeslaCrypt (2015). In breve viene descritta la parte operativa per la concezione e la configurazione di un laboratorio virtuale per la successiva raccolta di tracce lasciate dal malware sul sistema e in rete. In seguito all’analisi pratica e alla concentrazione sui punti deboli di queste minacce, oltre che sugli aspetti tecnici alla base del funzionamento dei crypto, vengono presi in considerazione gli aspetti sociali e psicologici che caratterizzano un complesso background da cui il virus prolifica. Vengono confrontate fonti autorevoli e testimonianze per chiarire i dubbi rimasti dopo i test. Saranno questi ultimi a confermare la veridicità dei dati emersi dai miei esperimenti, ma anche a formare un quadro più completo sottolineando quanto la morfologia del malware sia in simbiosi con la tipologia di utente che va a colpire. Capito il funzionamento generale del crypto sono proprio le sue funzionalità e le sue particolarità a permettermi di stilare, anche con l’aiuto di fonti esterne al mio operato, una lista esauriente di mezzi e comportamenti difensivi per contrastarlo ed attenuare il rischio d’infezione. Vengono citati anche le possibili procedure di recupero per i dati compromessi, per i casi “fortunati”, in quanto il recupero non è sempre materialmente possibile. La mia relazione si conclude con una considerazione da parte mia inaspettata: il potenziale dei crypto, in tutte le loro forme, risiede per la maggior parte nel social engineering, senza il quale (se non per certe categorie del ransomware) l’infezione avrebbe percentuali di fallimento decisamente più elevate.

The role of warning behaviors in threat assessment: an exploration and suggested typology

The concept of warning behaviors offers an additional perspective in threat assessment. Warning behaviors are acts which constitute evidence of increasing or accelerating risk. They are acute, dynamic, and particularly toxic changes in patterns of behavior which may aid in structuring a professional's judgment that an individual of concern now poses a threat - whether the actual target has been identified or not. They require an operational response. A typology of eight warning behaviors for assessing the threat of intended violence is proposed: pathway, fixation, identification, novel aggression, energy burst, leakage, directly communicated threat, and last resort warning behaviors. Previous research on risk factors associated with such warning behaviors is reviewed, and examples of each warning behavior from various intended violence cases are presented, including public figure assassination, adolescent and adult mass murder, corporate celebrity stalking, and both domestic and foreign acts of terrorism. Practical applications and future research into warning behaviors are suggested. Copyright © 2011 John Wiley & Sons, Ltd.

Free-Ranging Wild Boar: A Disease Threat to Domestic Pigs in Switzerland?

The risk of transmission of pathogens from free-ranging wild boars (Sus scrofa scrofa) to outdoor domestic pigs (S. scrofa domesticus) is of increasing concern in many European countries. We assess this risk, using Switzerland as an example. We estimated 1) the prevalence of important pathogens in wild boars and 2) the risk of interactions between wild boars and outdoor pigs. First, we tested 252 wild boars from selected areas between 2008 and 2010 for infection with Brucella spp. Bacterial prevalence was estimated to 28.8% (confidence interval [CI] 23.0-34.0) when using bacterial culture (B. suis Biovar 2) and real-time polymerase chain reaction. Antibody prevalence was 35.8% (CI 30.0-42.0), which was significantly higher than in previous studies in Switzerland. We also tested 233 wild boars for porcine reproductive and respiratory syndrome virus (PRRSV). Antibody prevalence was 0.43% (CI 0.01-2.4) for EU-PRRSV and real-time reverse transcription polymerase chain reaction results were negative. These findings suggest that B. suis is increasingly widespread in wild boars and PRRSV is currently not of concern. Second, we documented the spatial overlap between free-ranging wild boars and outdoor piggeries by mapping data on their respective occurrence. Wild boars are most widespread in the mountain range along the western and northern Swiss borders, while most piggeries are located in central lowlands. A risk of interaction is mainly expected at the junction between these two bioregions. This risk may increase if wild boars expand eastward and southward beyond anthropogenic barriers believed to limit their range. Therefore, we evaluated the potential of expansion of the wild boar population. Population trends suggest a continuous increase of wild boars for the past 15 yr. Surveillance of selected wildlife passages using cameras on highways and main roads indicates that these barriers are permeable (average of up to 13 wild boar crossings per 100 days). Thus an increase of wild boar range should be considered. There may be a risk of B. suis spillover from wild boars in Switzerland, which could increase in the future. Data on the occurrence of interactions between pigs and wild boars are needed to assess this risk.

To look or not to look at threat? Scanpath differences within a group of spider phobics

Predicting the behavior of phobic patients in a confrontational situation is challenging. While avoidance as a major clinical component of phobias suggests that patients orient away from threat, findings based on cognitive paradigms indicate an attentional bias towards threat. Here we present eye movement data from 21 spider phobics and 21 control subjects, based on 3 basic oculomotor tasks and a visual exploration task that included close-up views of spiders. Relative to the control group, patients showed accelerated reflexive saccades in one of the basic oculomotor tasks, while the fear-relevant exploration task evoked a general slowing in their scanning behavior and pronounced oculomotor avoidance. However, this avoidance strongly varied within the patient group and was not associated with the scores from spider avoidance-sensitive questionnaire scales. We suggest that variation of oculomotor avoidance between phobics reflects different strategies of how they cope with threat in confrontational situations.

Presence in a Three-Dimensional Test Environment: Benefit or Threat to Market Research?

In market research, the adoption of interactive virtual reality-techniques could be expected to contain many advantages: artificial lab environments could be designed in a more realistic manner and the consideration of “time to the market”-factors could be improved. On the other hand, with an increasing degree of presence and the notional attendance in a simulated test environment, the market research task could fall prey to the tensing virtual reality adventure. In the following study a 3D-technique is empirically tested for its usability in market research. It will be shown that the interactive 3D-simulation is not biased by the immersion it generates and provides considerably better test results than 2D-stimuli do.

The Effects of Living in Segregated vs. Mixed Areas in Northern Ireland: A Simultaneous Analysis of Contact and Threat Effects in the Context of Micro-Level Neighbourhoods

This study examines the consequences of living in segregated and mixed neighbourhoods on ingroup bias and offensive action tendencies, taking into consideration the role of intergroup experiences and perceived threat. Using adult data from a cross-sectional survey in Belfast, Northern Ireland, we tested a model that examined the relationship between living in segregated (N = 396) and mixed (N = 562) neighbourhoods and positive contact, exposure to violence, perceived threat and outgroup orientations. Our results show that living in mixed neighbourhoods was associated with lower ingroup bias and reduced offensive action tendencies. These effects were partially mediated by positive contact. However, our analysis also shows that respondents living in mixed neighbourhoods report higher exposure to political violence and higher perceived threat to physical safety. These findings demonstrate the importance of examining both social experience and threat perceptions when testing the relationship between social environment and prejudice.