Ransomware Locky Holds Your Data Hostage

Security,
05
Apr 2016

Computer virus.

Reports of a rise in ransomware trojans have seen further evidence in the form of ‘Locky’ which encrypts user data and demands payment to decrypt it.

Gathering data content, be it blog articles or customer databases, is a time consuming affair, so there’s a real sense of relief when it’s finally collated and finished. However, can you imagine how frustrating it would be to have this data suddenly encrypted by a third party? And how annoyed would you be if this third party then started demanding payment to release it?

You’d be VERY frustrated and VERY annoyed!

Locky – which is being distributed by infected MS Word files – is causing all manner of trouble to businesses at present, so it’s time you learned a little more about it to avoid getting a ransom note demanding $10,000!

What is Locky?

Ransomware does exactly what is says on the tin, it’s software which demands a ransom. Locky is a relatively new form of ransomware which, when activated, converts a long list of file extensions to a seemingly locked extension type named .locky e.g. a .jpeg extension will be converted to a .locky extension.

The problem is that the only way you can decrypt these .locky files is by purchasing a ‘decryption key’ online from the perpetrators. Now, you may be thinking that an online payment surely leaves a trail to the cyber criminals behind the ransom. Unfortunately, these hackers only accept payment through bitcoin – an untraceable online currency.

Ransoms as high as $17,000 are reported to have been paid to restore access to data, so it’s crucial you know what the warning signs of Locky are.

How Do You Get Infected By Locky?

virus-infected-word-file

Hackers are taking advantage of the ubiquity of Microsoft Office in our working lives to target victims with Locky. Emails are sent containing an MS Word attachment titled “Troj/DocDL-BCF” and the chaos it releases unfolds thusly:

  • Users open the file to discover it’s full of nonsensical text and symbols
  • A prompt encourages users to enable macros if “data encoding is incorrect” which, when presented with garbled text and symbols, would seem the right thing to do
  • If macros are enabled then this runs software which saves a file to the hard drive and then executes it
  • This file then downloads a final piece of software – Locky
  • Once Locky is downloaded to the system it starts scrambling files to the .locky extension
  • Locky then changes your desktop wallpaper to one of a ransom note detailing how to pay the decryption ransom

How to Protect Yourself From Locky

 virus-protection-services-melbourne-transit-data-about-us

Naturally, the best way to avoid getting infected with ransomware like Locky is to avoid all dubious email attachments.  However, there are a couple of other tips to help protect yourself:

  • Try installing Microsoft Office viewers which allow users to view documents without actually opening them in Office applications and prevents viruses from executing
  • Always install the latest updates for Microsoft Office to ensure any back doors are patched to keep your system protected

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Are Apple Computers Immune to Viruses?

Security, ,
29
Mar 2016

fva-630-skull-and-crossbones-computer-virus-hacking-credit-shutterstock-630w Compared to Windows PCs, Apple’s Mac computers have always been relatively virus free. However, a recent security attack has proved this is no longer true.

March 2016 saw a significant attack on Mac users which involved hijacking the Transmission BitTorrent app in order to deliver ransomware to its victims. It sounds like your stereotypical Windows attack, but why is it now happening to Macs? After all, the general consensus has been that they’re immune from viruses.

Seeing as Macs are very important to a huge number of businesses, I’m going to investigate this latest attack to analyze how it occurred and what it means for Mac users.

The Nature of the Mac Ransomware

computer-viruses

The unknown attackers used ransomware in their attack against Apple users and it’s a type of cyber-attack which is becoming increasingly popular. In this instance, the hackers were able to gain access to users’ systems through the Transmission BitTorrent app. This allowed the hackers to download malicious software onto the Macs. This software literally held the Mac users to ransom by encrypting their files and demanding $400 to release them.

How Did Apple’s Guard Drop?

For a very long time, Apple users were confident that Macs were safe from cyber-attacks. And for a long time this was generally true. This, however, wasn’t down to cutting edge security technology.

The truth is that hackers didn’t have much interest in targeting an Apple Mac. The reason for this is that Apple has a much smaller share of the market than Windows PCs. Why would a hacker want to spend their time writing software which could only target a small number of users?

This fact perhaps led to a sense of complacency on Apple’s part, so they weren’t expecting vulnerabilities in their operating system to be exploited so easily. Unfortunately, Apple’s Gatekeeper security software has, itself, been shown to contain numerous back doors through which hackers can cause chaos.

One of the main routes into Apple’s system is by tricking it to accept pre-approved developer certificates which have been faked. This allows users to download software which isn’t produced by who it says it is and, therefore, can’t be trusted. And this is exactly what happened with the Transmission BitTorrent app.

The Future for Apple Security

mac-shield

This recent attack is not the first security scandal to hit Apple. In 2014, there were around  10,000  – 70,000 attacks on Mac computers per month, but this rose dramatically in 2015 and is set to multiply significantly in 2016.

These figures are very startling for Apple, so it’s crucial that they take a look at Microsoft’s approach to internet security. Due to their dominance of the computer market, Microsoft has had to ensure their PCs are resistant to attacks. Steps taken have included:

  • Working with hackers to understand how they have attacked Windows
  • Offering cash rewards to anyone who finds new security flaws in Windows

It’s essential that Apple take a long hard look at their Gatekeeper software and evaluate how it can be improved. If they don’t they stand to alienate their customers if ransomware attacks continue.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

No More Passwords: Could Passwords Become Extinct?

Security,
23
Feb 2016

No more passwords

We’re all used to creating and remember passwords when working with sensitive data, but could Google make the password a thing of the past?

Passwords are essential when it comes to working with PCs due to the amount of confidential data that they may contain and process. When it comes to business usage, it’s likely that you’re going to need several different passwords to access all your software and hardware needs.

Google, keen as ever to re-invent the digital wheel, has decided that perhaps it’s time to approach data security in a different manner. That’s why they’re trying to implement smartphones as the key factor in accessing data.

Let’s take a look at why Google are doing this and how they plan to achieve it.

The Problems with Passwords

Facebook-Password-Sniper-v1.2-Hack

You’re probably well aware that passwords are inconvenient. After all, the number of passwords you need to use on your PC at work can become disorientating, so it’s no surprise when you forget them. As a result you’ll tap in a couple of guesses and find yourself locked out. It’s then down to your IT team to manually reset your password.

Aside from this inconvenience, though, there are a number of reasons why passwords are not the best way of securing data:

  • Many users use the same password for all their accounts to avoid having to remember numerous passwords. It’s a nice, quick solution but if their password is hijacked then it compromises all their accounts
  • Hackers are able to use spyware and keystroke loggers to easily steal users passwords without them knowing
  • Password reset questions are often very easy to guess, so this offers an easy route into your systems for hackers

There are obviously problems with relying on the humble password, so how are Google going to take security to a new level?

No More Passwords

gmail-password-forgot

Google plans to eliminate the need for passwords to access your Google account by tapping into the modern obsession with smartphones.

Here’s how it’s going to work:

  1. You’ll head over to the Google sign in page and enter your email address as per normal.
  2. At this point your smartphone will receive a notification message asking you to confirm your login.
  3. Once you authorize this – with one tap of the “YES” button – your device (be it PC, tablet or smartphone) will be given access to your Google account.

And don’t worry if your smartphone has run out of battery or you’ve lost it. You’ll still have the option to use your password to login to your Google account.

What Does This Mean for Your Business?

Google’s vision paints an interesting future for your business and the way in which you protect your computer systems. It also highlights the lack of security behind passwords and how you need to ensure that your business is well protected from the threat of hackers.

If Google’s trial is successful then it’s likely that we’ll see this new approach to security filtering into the business world fairly quickly. And not only will it protect your data’s security, it will also reduce the amount of man hours spent resetting passwords.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

How Important is Cloud Security for Small Businesses?

Security,
09
Feb 2016

Cloud Computing

Cloud computing allows you to run programs and store data on the internet and is a world away from the traditional method of physical installs and servers.

It offers flexibility, enhances collaboration and reduces overheads, but many businesses are wary of cloud computing. Sure, it’s a new way of doing things, so this is always going to induce a little anxiety. However, there have also been numerous headlines about the cloud’s security which has raised concerns.

To try and sort the myths from the facts, We’re going to take you through the security aspects of cloud computing.

Cloud Security Breaches are Big News

We’ve all heard a scare story about the cloud becoming breached and the most famous of these is probably ‘The Fappening’ which saw Apple’s iCloud breached to obtain personal photos of celebrities.

The Fappening, naturally, was distressing for those celebrities involved, but also brought to the public’s attention that maybe data isn’t that secure up in the cloud. Matters haven’t been helped by similar concerns being raised such as the possibility that stealing millions of Apple iCloud passwords can be achieved with a simple phishing email.

However, there are always going to be hackers, so is it fair to label cloud computing as a proposition which is too risky? Or is it just a simple case of monitoring the cloud’s security as you would any other type of network?

A Secure Provider is Essential

cloud_swiss_army_knife_nobg

With cloud computing being a relatively new phenomenon it’s not a surprise that there’s a little ambiguity over whom exactly is responsible for what. Cloud vendors are more than happy to provide you with the infrastructure to start cloud computing, but the levels of security are going to vary between providers.

Many cloud vendors may expect your in-house IT team to take on at least some of the responsibility for your cloud network. The problem is, though, that cloud computing is such a new form of networking that most in house IT teams simply don’t have the necessary knowledge to secure their cloud effectively.

Therefore, with the threat landscape ever expanding, it’s important that you identify a cloud vendor who can provide a fully experienced team of personnel to monitor the cloud’s security. The costs, obviously, will increase, but for the peace of mind it brings, it’s relatively small change.

Increasing Your Cloud Security In-House

cloud_security

Now, I know that I just said it’s not a good idea to take on cloud security yourself, but there are certainly ways you can help maximize it at your end!

Remember that your whole network can become compromised by the smallest mistake. This is why it’s essential that you take the following steps:

  • Remind staff of the importance of choosing strong passwords. I always feel that it’s a good idea to insist on the need for a number, symbol and uppercase letter in a password. It may mean that they’re harder to remember, but it also means they’re harder to guess.
  • Increase the level of authentication required for even the most basic applications e.g. instead of just asking for a username or password, follow this up with the need to enter a code sent by SMS to approve access to certain network areas.

Should You Move to the Cloud?

The cloud is, undoubtedly, the future of computing and will prove to be a significant factor in businesses remaining competitive. It’s always difficult to break from the traditional methods of working, especially with security concerns ever present, but as long as you ensure security is tight then it’s the logical step forwards.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

5 Email Security Tips for Small Businesses

Security,
25
Jan 2016

Email Security

Email security is a crucial focus for your business, but as it offers a gateway into your systems you need to understand how to keep it secure.

If your email security is below standard then you’re opening up your network and sensitive data to the mercy of malicious software e.g. trojan horses, malware and viruses which can really disrupt your business and compromise your data.

No business wants this type of risk bubbling away in the background, so we’re going to take you through 5 essential tips which will ensure your emails are secure.

1. Does It Have to Be Emailed?

There’s a tendency to assume that because email is available it has to be used. And many people feel that, seeing as email servers have plenty of storage, that all those attachments are just fine to be stored there.

However, both these methods ensure that data is readily available should your servers be hacked.

Therefore, if you’ve got a highly important report which contains sensitive data it may be best to seek an alternative delivery method e.g. via courier. And do attachments need to stay on the email server? No, they don’t. They can easily be archived to external hard drives which offer security and plenty of retrieval options.

2. Don’t Access Emails from Public Networks

6_secure_email_iStock

It seems as though everywhere you go these days there’s a public wifi network that you can hop onto in a couple of seconds. This accessibility means you can connect with your emails no matter where you are, so many people take advantage of it.

However, the security of these public networks can never be predicted. Due to their ubiquity they’re also the regular targets of hackers. This means that secure data such as your passwords are at risk and this can grant hackers a foothold in your system.

Sometimes, though, you’re going to need to access your emails on the move, so connecting via a public network will be your only option. To protect against any viable security threats, the best practice is to employ two factor authentication for your email servers to provide extra security.

3. Password Resets

padlock-security-protection-hacking

Employees love to keep their password the same for as long as possible because it means it’s easy to remember. And the easier to remember it is, the less chance there is that they’ll have to go through the hassle of ringing their IT department to reset it.

However, this type of complacency leads to your emails becoming vulnerable as it becomes easier to infiltrate your system over a long period of time.

That’s why we would recommend that your email software forces users to routinely change their password every 4 – 6 weeks. And if emails are entered incorrectly 3 times then make sure that email account is locked straightaway!

4. Filter All Attachments

Malicious content is most likely to enter your business’ network through email attachments, so it’s vital that you set up email filters to protect your business. These filters will help block any suspicious attachments and give you the time to review them before releasing them into your system.

Remember, hackers are becoming increasingly sophisticated and are able to package malicious software into seemingly innocent files e.g. a spreadsheet entitled “Monthly Sales Report” may appear genuine, but something nasty may be lurking in the background.

5. Train Your Staff on Email Security

email security training

Staff, of course, represent the final wall between emails and your servers, so it’s important they receive training on email security.

This should be carried out upon their induction into your company, but it’s also a good idea to regularly email updates around warning of any on-going threats. This knowledge allows them to understand what they should be looking out for and helps keep your email security sage.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 37 38 39 40 41 … 49