MaaS: A malicious service provider

We dive into how hackers have figured out how to exploit SaaS by creating their own malicious version; namely, MaaS. By creating a service agreement with malware, more criminals can commit cybercrime, which can be harder to detect. Read more about what MaaS is and what you can do to strengthen your cyber defense against it.

Malware-as-a-Service

You may have heard of Software-as-a-Service, with the acronym SaaS. In short, it's a service offered by software developers where you can subscribe to a software - which then becomes a monthly service that you buy. The software is hosted by an external provider, which reduces the risk of your software being compromised in a cyber attack on your device, as it is not locally hosted on your device.

With great solutions like SaaS for us consumers, hackers and cybercriminals have found a way to use the same concept as SaaS for their illegal activities. This is MaaS, or, Malware-as-a-Servce. To refresh your memory, malware is malicious software that can allow hackers to steal data or install viruses on your device. Hackers can also install e.g. keyloggers or spyware on your device so they can monitor your activity - and see when and how you log in to various websites.

The core of MaaS is that cybercriminals and hackers sell malware as a service, where customers buy malware to hack into victims' devices and software. Hackers offer malware to other hackers so they can commit cybercrime.

Typically, you'll find MaaS on the dark web. Once a hacker gets hold of the malware, they can steal sensitive personal data, destroy computer systems or encrypt data so the victim can't access their files - unless they pay the ransom demanded by the hacker.

The roles in MaaS

There is a larger ecosystem built in MaaS and it requires several different actors to perform the malicious service.

First, there's a developer who sits and creates and develops plans for vulnerabilities in software, hardware and operating systems. Their job is to create codes and viruses that ultimately harm our devices and software.

Then there is a reseller and salespeople who sell the code and malware to buyers. They promote their malware on the dark web to potential customers. The malware they sell is typically categorized into two categories: malware packages, where the buyer has to assemble the codes and malware themselves, making it much more flexible in terms of what the buyer needs the malware for; and malware where the seller "hosts" the management of the malware, making it possible to reach even further out on the internet and thus hit more victims.

Finally, there are the buyers and consumers of MaaS. There are three main types of buyers of MaaS:

• Criminals who want to harm victims. This involves stealing personal data, login credentials, compromising data for ransom, and encrypting data.
• Security professionals who want to learn more about vulnerabilities and flaws in their own systems - that way they can get ahead of the hacker.
• Government officials who, like security professionals, want to identify and address security flaws and deficiencies in systems.

MaaS and the damage it can cause

One of the biggest challenges with MaaS is that it makes it possible for non-technical people to carry out cyberattacks, precisely because it's delivered to their doorstep.

Unfortunately, there are many different types of malware and the damage it can cause. Therefore, there are several things to be aware of:

• Viruses and worms: Code that allows programs and malware to duplicate themselves in the device. This means that the malware spreads faster than you can often react. Viruses can steal information, destroy files and disrupt operating systems.
• Spyware: Software that is programmed to monitor a user's activity and steal information from the victim.
• Adware: Software that provides a victim with unwanted advertisements and pop-ups when they are on different websites.
• Ransomware: Essentially, a victim's data is encrypted by a hacker and then the hacker demands a ransom to give the victim access to their data back.

As mentioned, one of the biggest disadvantages of MaaS is that virtually any cybercriminal can carry out cyberattacks with MaaS because it becomes easily accessible and much easier for those who are not IT savvy.

How can you protect yourself against MaaS?

You might be thinking that becoming a victim of a cyberattack is inevitable now that virtually any criminal can carry out a cyberattack. But there are some things you can do to prevent it and reduce your risk of being affected.

It is essential for a company to have exposure management, attack surface management (ASM) and an action plan in case of a cyber attack.

All three elements prepare your business for potential cyberattacks. They provide insight into what vulnerabilities there are in the systems, what attack surfaces you need to be aware of, and how you should act if you are hit by a cyber attack.

In addition to these measures, it's important to have good awareness training for employees. Hackers have found that the easiest way to access systems is through employees. Therefore, you should have in-depth cybersecurity awareness training so that all employees are prepared for the increasing cyber threat we face.