Zero Day Internet Explorer Exploit Targets Users

Internet, Security, Software, , ,
05
May 2014

Onsite_PC_Solution_IE_Exploit

A zero day exploit affecting Internet Explorer 6 through 11 has been discovered which allows an attacker to execute code and install malicious software.  Security firm Fire Eye has recently released the details of how this attack works.

Internet Explorer accounts for about 25% of the worlds browsers used to surf the internet. We will cover a high level summary and how you can protect yourself and your business.

How does it work?

The exploit works by loading a corrupted Adobe Flash SWF file in a webpage, which allows the attacker to modify data in memory, effectively bypassing Internet Explorer’s security and allowing any malicious software to be downloaded and installed.  This can include viruses, malware, keyloggers, bitcoin mining software, fake anti-virus programs among other destructive software.

Rapid 7 shows an attack on a Windows 7 system using this exploit.

Rapid 7 shows an attack on a Windows 7 system using this exploit.

The exploit can be used on any version of Windows that runs IE 6, 7, 8, 9, 10 or 11, which means this is the first time that running a newer version of Windows does not protect you from an exploit.

What can I do to protect myself?

Microsoft has already started rolling out an update to patch the security bug, so be sure to keep your operating system up to date.  It is also recommended that you install Microsofts EMET 3.0, which brings better security protection especially for older Windows operating systems.

As always, we recommend running more secure and light weight web browsers such as Chrome or Firefox and avoiding Internet Explorer unless absolutely necessary.

All Onsite PC Solution clients with monthly maintenance plans will automatically be patched during their next monthly maintenance cycle.

For more ways to protect your business and home computers, contact your local IT professionals.

Read More

Hearbleed Security Bug: Passwords You Should Change

Internet, Security, , ,
15
Apr 2014

Onsite_PC_Solution_Heartbleed

The OpenSSL bug known as Heartbleed has affected thousands of websites worldwide, even some common ones you use everyday.  Mashable has done a terrific job of compiling a list of sites that have been affected, patches and more importantly the sites you should change your password on immediately.

Keep in mind that there are already open source tools available to the public that take advantage of the Heartbleed bug, and more will likely become available.

Here is the list of major websites that have been patched, but you should change your password for immediately:

 

Facebook
Box
Tumblr
Google
Yahoo
Gmail
Yahoo Mail
Amazon Web Services (for website operators)
GoDaddy
Intuit (TurboTax)
Dropbox
LastPass
OKCupid
SoundCloud
Wunderlist
Etsy
Flickr
GitHub
IFTTT
Instagram
Minecraft
Netflix
Pinterest
USAA
Wikipedia(if you have an account)

These are major websites Mashable recommends users to change their passwords on.  There are likely other sites out there that are affected too.  Our previous article explains how you can check if your commonly used websites you have a login to are affected.

http://filippo.io/Heartbleed/ will let you know if the site has the Heartbleed Bug.

http://filippo.io/Heartbleed/ will let you know if the site has the Heartbleed Bug.

For further support on network or internet security, contact your local IT professionals.

Read More

Major Online Security Bug Found: Heartbleed

Internet, Security, , ,
08
Apr 2014

A major OpenSSL bug has been found that could affect 70% of secure websites.

A major OpenSSL bug has been found that could affect 70% of secure websites.

A major bug has been found in the popular OpenSSL library used by thousands of online merchants, email providers and banks.  The bug allows anyone on the internet to read a user’s private information while it is being sent back and forth to the website.  A security advisory has been issued by OpenSSL.

Why is the bug called Heartbleed?

The code affected by this bug is in the heartbeat portion of the protocol which keeps the connection to the website active.  When the bug is exploited it causes memory to leak its content while it is being sent over the internet, which contains sensitive and private information.

How does this affect me?

If the website you are logging in to, such as your bank, email or an online store uses a version of OpenSSL that has this bug:

  • An attacker can open a connection to your bank over and silently download among other things the keys used to prove the bank is who they say they are.
  • They can then pretend to be your bank and you will not notice anything different, while all of your communication is being stolen.

It is estimated that up to 70% of internet websites are affected by this bug.  Companies can fix the bug by upgrading to the latest version of OpenSSL, creating new certificates and removing old certificates.

How can I protect myself?

First check if the website you are accessing has an “https” in front of the address, meaning it should be a secure connection. All banks, email webpages and online stores should have this:

Check for https in front of your website address.

If it is a secure connection, enter the website here to check if the bug exists.

http://filippo.io/Heartbleed/ will let you know if the site has the Heartbleed Bug.

http://filippo.io/Heartbleed/ will let you know if the site has the Heartbleed Bug.

If it does exist, avoid using the website until they have upgraded their OpenSSL.  For further assistance with the Heartbleed bug or other security issues, contact your local IT professionals.

Read More

Scammers Hijack SOHO Routers to Steal User Information

Internet, Office IT, Office Network, Repairs and Upgrades, Security, Services, , , , , , , , ,
06
Apr 2014

TL-WR1043ND-01

TP-Link is among the vendors affected by the SOHO pharming campaign.

Recently, it was discovered that several hundred thousand routers fell victim to a hijacking scheme that could become a prevalent problem to many internet users worldwide.  The attack, dubbed as a ‘small office/home office (SOHO) pharming campaign,’ was targeting Vietnam, but according to a report by Team Cymru, the SOHO pharming campaign also made its way into regions like the US and Italy.

The criminals behind the pharming campaign took advantage of exploitable security holes in various consumer-grade routers, and from there they were able to redirect users to malicious websites to steal login credentials and/or dropped malware onto the users’ computer.  The scary part about this SOHO campaign is that more than one type of routers are affected.  According to Team Cymru, the compromised routers could be a brand name like D-Link or and off-brand like TP-Link.

soho-hijack

A diagram depicting the ‘man-in-the-middle’ hijacking scheme from Team Cymru.

Cyber security experts found that once the attackers had control of their targeted routers, they changed the devices’ Domain Name System (DNS) settings to force users to send out requests to the 5.45.75.11 and 5.45.75.36 IP addresses.  The new DNS settings then acts as a ‘middle-man’ and redirect users to malicious sites instead of legitimate ones.

While it is easy to point the fingers directly at the people manufacturing the routers, it’s not completely their fault.  There’s no such thing as a ‘hands-off’ policy when it comes to protecting yourself from intrusions by cyber criminals.  That said, there are a few things many router owners can do to lessen their chances of becoming victims to the router hijacking scheme.

  1. Disable router’s remote user-mode and graphical user interface. Disabling remote access will help keep users who aren’t directly connected to your network from accessing your routers’ admin properties.  Disabling the GUI will, reportedly, mitigate the likelihood that someone can find a hole in the routers’ software.  Instead of making changes to the routers’ setting via a graphical interface, try to change the settings via command lines.
  2. Corporate networks may want deploy tracking systems (i.e. an HTML code on the externally facing servers) to detect possibly malicious IP addresses.
  3. All SOHO router settings (especially DNS) should be controlled at the host level.
  4. Admins must proactively monitor router settings periodically to ensure that the router’s DNS is pointing at those that belong to their internet service providers (ISP).

These are just a few of the basic security measures you must consider if you or your organization is using a SOHO router.  Should you have any questions or concerns regarding the recent SOHO pharming campaign or what you should do tighten up your network security, contact our IT professionals.

Read More

Check Your Network: Linksys and Netgear Vulnerable

Internet, Security, , ,
13
Jan 2014

A Common Netgear Wireless Router. Model DG834G.

A Common Netgear Wireless Router. Model DG834G.

A number of Linksys and Netgear DSL modems have been found to be exploitable via a simple hole in the components’ firmware.

How Was This Discovered?

Eloi Vanderbeken recently took up the task of reverse engineering his Linksys WAG200G wireless DSL gateway’s firmware.  At first he did it just for kicks, but during the process he found out even brand name tech components are just as vulnerable to hackers as off-brand products.  Vanderbeken found out during his self-imposed hack-a-thon that his WAG200G DSL gateway was accessible to hackers via an undocumented port.

After Vanderbeken toyed around with the Linksys firmware, he was able to come up with a simple interface that allowed him to send various commands to the gateway without administration authentication.  At first, Vanderbeken found that he couldn’t do much with the interface besides resetting the gateway to its factory settings.  However, as he delved deeper into it, he found that he could inject some home-brewed command lines into the interface.  These simple code injections allowed him to gain control of certain administrative properties using a wireless connection, and to reset the gateway’s web password.

How To Check if Your Are Affected

People interested in the hack and are tech savvy enough can check out Vanderbeken’s published work on Github.  Would-be hackers can do a few things with the script.  Firstly, Vanderbeken only hacked his router because he wanted access to his router’s web console without having to input the admin password—which he forgot.  So if you are the proud owner of these selective devices, you can be assured that they’re hack-able to both you and others with malicious intents.  Chances are most people will rather reset their gateways the easy way by pressing the little red reset button on the back of their device using a pen tip.  People looking for an adventure into the world of coding, however, might actually test out the scripts to see if their highly secured network is bulletproof or not.

Eloi Vanderbeken's bruteforce code to test the vulerability.

Eloi Vanderbeken’s bruteforce code to test the vulerability.

Another thing to note is that the backdoor vulnerability in these LinkSys and Netgear components are only assessable locally.  Meaning, a hacker would have to be in range of your Wi-Fi network for them to compromise your network and personal data.

What Should I Do If I Am Affected?

Quite frankly speaking, unless your neighbor or a passerby knows exactly the type of router you’re currently using, they won’t bother to attempt to hack your network.  The easiest solution, if you happen to own one of these vulnerable devices, is to name your wireless network something other than the router’s brand and model.

Often times, the routers come shipped with preconfigured settings which use the brand or model as the default wireless network name.  If that is the case, simply log into your router, and change the network’s name.  Next, you may also want to upgrade the product’s firmware, but keep in mind that different manufacturers have different firmware upgrade requirements.  Check your product manuals or website before attempting to upgrade firmware, because one wrong move can render your router unusable.

If you need further help, contact your office IT support.

Read More
1 … 3 4 5 6