Post Windows XP: Exploit Attack is Imminent

Security, Software, Uncategorized, , ,
08
Apr 2014

 

The original Windows XP Background location taken in Sonoma Valley, California

The original Windows XP Background location taken in Sonoma Valley, California

Windows XP has officially been retired by Microsoft but does that mean you can safely continue running it at home or at the office?  A report put out by security firm F-Secure has recently highlighted some ways to stay somewhat safe while continuing to run the expired Operating System, while emphasizing that an exploit could be ready any day now:

1. Install the final updates for Windows XP from Microsoft

2. Make sure Microsoft Office is fully patched

3. Update all third party software

4. Run a firewall and antimalware protection

5. Run Micrososft’s EMET (Enhanced Migration Experience Toolkit)

Although these steps can help delay a system compromise, once Windows XP has been infected it is considerably more difficult to clean than other operating systems.  Virus and malware writers will now be able to look at the updates released for Windows 7 or 8 and know exactly where to attack Windows XP since the operating systems share some similar code.  The report also goes on to mention that an exploit on Windows XP will occur soon.

 

The latest F-Secure report highlights risks of continuing to run Windows XP

The latest F-Secure report highlights risks of continuing to run Windows XP

According to the report, web based attacks and infections doubled in the second half of 2013.  It is important to note that modern virus writers and criminals often do not want to damage a computer system.  It is much more lucrative to hold the system ransom for money or to steal sensitive information such as bank logins, email accounts and credit card information.

For more guidance on moving away from Windows XP or securing your home or office, contact your local IT professionals.

Read More

Scammers Hijack SOHO Routers to Steal User Information

Internet, Office IT, Office Network, Repairs and Upgrades, Security, Services, , , , , , , , ,
06
Apr 2014

TL-WR1043ND-01

TP-Link is among the vendors affected by the SOHO pharming campaign.

Recently, it was discovered that several hundred thousand routers fell victim to a hijacking scheme that could become a prevalent problem to many internet users worldwide.  The attack, dubbed as a ‘small office/home office (SOHO) pharming campaign,’ was targeting Vietnam, but according to a report by Team Cymru, the SOHO pharming campaign also made its way into regions like the US and Italy.

The criminals behind the pharming campaign took advantage of exploitable security holes in various consumer-grade routers, and from there they were able to redirect users to malicious websites to steal login credentials and/or dropped malware onto the users’ computer.  The scary part about this SOHO campaign is that more than one type of routers are affected.  According to Team Cymru, the compromised routers could be a brand name like D-Link or and off-brand like TP-Link.

soho-hijack

A diagram depicting the ‘man-in-the-middle’ hijacking scheme from Team Cymru.

Cyber security experts found that once the attackers had control of their targeted routers, they changed the devices’ Domain Name System (DNS) settings to force users to send out requests to the 5.45.75.11 and 5.45.75.36 IP addresses.  The new DNS settings then acts as a ‘middle-man’ and redirect users to malicious sites instead of legitimate ones.

While it is easy to point the fingers directly at the people manufacturing the routers, it’s not completely their fault.  There’s no such thing as a ‘hands-off’ policy when it comes to protecting yourself from intrusions by cyber criminals.  That said, there are a few things many router owners can do to lessen their chances of becoming victims to the router hijacking scheme.

  1. Disable router’s remote user-mode and graphical user interface. Disabling remote access will help keep users who aren’t directly connected to your network from accessing your routers’ admin properties.  Disabling the GUI will, reportedly, mitigate the likelihood that someone can find a hole in the routers’ software.  Instead of making changes to the routers’ setting via a graphical interface, try to change the settings via command lines.
  2. Corporate networks may want deploy tracking systems (i.e. an HTML code on the externally facing servers) to detect possibly malicious IP addresses.
  3. All SOHO router settings (especially DNS) should be controlled at the host level.
  4. Admins must proactively monitor router settings periodically to ensure that the router’s DNS is pointing at those that belong to their internet service providers (ISP).

These are just a few of the basic security measures you must consider if you or your organization is using a SOHO router.  Should you have any questions or concerns regarding the recent SOHO pharming campaign or what you should do tighten up your network security, contact our IT professionals.

Read More

Turbocharge Home or Office File Sharing and Backup With A NAS

General, Office IT, Office Network, , , ,
26
Mar 2014

wdfWDSentine6l

What a NAS typically looks like.

NAS (not to be confused with NOS) is an essential tool for sharing files, doing backups and many other common functions between computers in your home or office.  Network Attached Storage, or ‘NAS’, isn’t the first thing you will think of when you’re shopping around for a computer.  As your home or office PC’s, tablets and smartphones build up, the term NAS will likely come up somewhere.

How can you use a NAS for your Home or Office?

Once you have several computers in your home or office, you’ll realize that it’s an inefficient use of time to constantly duplicate files from one hard drive to the next just so you can access them from all your devices.  That’s where NAS come in.  It’s an external hard drive with a light operating system (OS) to help make ‘sharing’ easier.

Western-Digital-Red-3TB-Synology-DS1812

Another look at a different NAS model.

Most of us pull information directly from the cloud, or huge datacenters scattered all over the world, but the issue with this is many people are not yet connected to a high speed connection.  A typical image (i.e. JPG or PNG) will download in just a few seconds if you’re retrieving it from a server, but large files like HD videos will require several hours.  The proximity to a server and the connection quality become limiting factors when we want to share any type of digital content.

So instead of uploading huge video files to the cloud (i.e. DropBox) and then sharing them via this route, people on the same network can share information using a NAS.  The biggest benefit of having a NAS for your home or office network is that you don’t need to run a dedicated PC at all times for people to access files.  As we already pointed out, the NAS is a computer on its own, with the exception that it possess just enough horsepower to carry out what it’s intended for.

More features already built in

Most NAS devices also have built-in printer sharing, so a single household can have access to the printer’s feature at all time from any supported devices.

You may also notice that your computer has a ‘back-up’ feature, which allows you to restore or retrieve lost files should there be some sort of software complications down the line.  While this method is completely acceptable for most cases, people who are even more concerned about their data should find a secondary source to back up their files to, such as a NAS.

Lastly, NAS is also extremely useful for pulling up information on-the-go.  If configured correctly, a NAS can act like a server so any user can pull up whatever is stored on the server from any location with an internet connection.  Just keep in mind that once you’re out of range of your own network, how fast you can retrieve these files from the NAS will depend on the connection you’re currently using.

To learn how your office can benefit from a NAS device, contact your local IT support.

Read More

Google Apps GMail vs. Your Webhost Email

Services, ,
16
Mar 2014

gmail-dash

Google didn’t get to where it is now if it offered only a search engine.  GMail, a member of the GApps family, is perhaps the crown jewel of all the services that Google has to offer.  So what makes Google’s email service more appealing than its competitors?  Why should a business move its email system to GMail instead of relying on services offered by the hosting company which already maintains its website? Below are some of the reasons why we think GMail is such an appealing service:

  1. Spam filter—Unwanted emails are perhaps the reasons why many of us dread checking our emails each morning.  Google has put a lot of effort into developing an extremely good spam filtering system that will send most (if not all) of the unwanted ad/scam/phishing content into the junk bin.  From time to time, one of these dubious emails will sneak past the spam filter, but at least you can instantly notice the bad egg if its among 20 or so legitimate emails you have in your box.
  2. Security—The first step to keeping your digital information safe is to create a good password for your account.  After you’ve done that, it’s up to Google to handle and store this information in a safe vault (not literally of course).  Google enforces secure transmission of your personal messages by encrypting them via the Secure Socket Layer (SSL) protocol.
  3. Automatic sorting—This GMail feature was only recently added, but we have to admit it’s pretty awesome.  If you’re a heavy social media user, chances are your inbox is flooded with notifications from Twitter, Facebook and whatever else you’re into.  GMail sorts out the different types of emails into three tabs: A ‘Primary’ tab, which receives all your important emails, a ‘Social’ tab to store all your social media/networking content, and a ‘Promotion’ tab that contains some of the less spammy ads (deals from Amazon and such).
  4. Speed and uptime—If you’ve been using the internet every day for the last ten years or so, can you recall the number of times Google.com was down?  Maybe once or twice?  If the servers were ever down, we can’t recall it happening. For that exact reason, we can say we’re confident in how Google handles its datacenters so users can have access to all the services it offers 99.99% of the time.  Moreover, Google has invested heavily in its infrastructure to ensure that most of us can access things like GMail in a timely manner.  By timely, we mean broadband users can essentially pull up anything from their inbox in a blink of an eye.
  5. Capacity—There once was a time when most email services offered just a few MB of storage, but that ancient tradition has since been squashed by GMail’s 15GB of free space.  Most emails are just a few hundred KB in size, so just imagine how many emails you can save if you have 15GB.  You also have the option of sending emails with a 25MB attachment, and if you signed up for Drive (Google’s cloud storage solution) you can ‘attach’ a 10GB file.  The 10GB file won’t be directly sent to your recipient (imagine losing 2/3 of the inbox storage in just one email!) as the file is actually stored in Drive as a shared file.
  6. Accessing Google goodies from GMail dash—Lastly, if you’re a Google fanatic and use services like YouTube and Hangout, these services are readily available right from the dashboard.  Thus, there’s not need to manually type in the individual service URLs to get to these pages. What Google basically did was bookmarked most of the services it offers into the GMail dash so you don’t have to do it through your browser.

For small businesses (and even large ones), GMail is an indispensable tool.  One GMail account gives you access to a slew of other Google-derived applications.  Services such as Calendar, Hangout, Docs and Sites all sync with one account.  That means, you can easily access any of the documents or services you started via GApps under one handle.  The added benefit of being able to integrate personal or business domains (i.e. Janesflowershop.com) into the GMail system will greatly improve your workflow and information management. All the pros that we’ve listed above are either not offered via webhosting emails or are just too clunky to work.  For help moving your email to GApps, contact your local IT professional.

Read More
Youtube ads serving up malicious code
Youtube ads serving up malicious code

Hackers Use YouTube Videos to Serve Up Malware Ads

Security, , , ,
12
Mar 2014

image_thumb

Make sure you have your firewall up!

With over 1 billion users, YouTube is one of the most visited sites on the web, but its incredible popularity is also drawing in criminals and viruses.  Cyber criminals are always looking for new ways to exploit popular platforms, and YouTube is not an exception.

Recently, it was discovered that YouTube videos were serving up ads that contained the necessary precursors for an attacker to inject malware into a targeted machine.  According to a Bromium Labs, the cyber criminals were leveraging holes in systems running Java, and if that was the case a Banking Trojan belonging to the Caphaw family was dropped locally onto the user’s computer.  Another reason to keep your Java up to date.

Once a connection with the victim’s machine is established, the malware then tries to connect with domains which are likely based in Europe.

image_thumb1

It’s as easy as 1-2-3.

The YouTube malware ad was delivered in the following manner:

  1. User watches YouTube video
  2. User sees an appealing thumbnail embedded in and clicks on it to watch another video
  3. Once the thumbnail is clicked, the machine opens up the malware ad in the background (served by Google Ads)
  4. Malware then redirects the user to ‘foulpapers.com’
  5. The malicious website then serves up iFrames with the aecua.nl domain
  6. Aecua.nl then detects the system’s Java version and drops the malware onto the victim’s machine

Casual YouTubers may never even notice that their machine was the target of such an attack.  Cyber criminals will often put some work into promoting their YouTube videos to make them seem legitimate and worth watching.  A video containing such exploits may contain thousands or even hundreds of views, so it is only after the damage is done that one will notice his machine is infected.

As always, we advise everyone to take the necessary precautions to prevent such an attack by installing and updating their antivirus software.  It is also recommended that people disable Java unless it is absolutely necessary for running verified/safe services and applications.

For further help keeping your office or home computers secure against such attacks, contact our IT support services.

Read More
1 … 114 115 116 117 118 … 122