security Archives - Page 47 of 50

Windows 7 Update Causing Lock Ups – KB2952664

Security, Softwarepatches, security, updates, windows 7Ophtek, LLC

Apr 2014

A recent Windows 7 update meant to make the transition from Windows 7 to Windows 8 easier has been causing systems to freeze up according to many user accounts online. Microsoft released this update on April 22nd as KB2952664. There have been updates in the past which have caused the operating system to lock up, freeze or malfunction such as this Microsoft Security Essentials update for Windows XP which was pulled by Microsoft after user’s started having issues.

Although the patch has been labeled as an “important” update on some systems and “optional” on others, it isn’t necessary to keeping Windows 7 operating properly. It is best for users to hide this update completely.

If you haven’t installed it yet, here’s how you can avoid this update and avoid issues with your Windows 7 System:

Go to Start and type “Windows Update” without the quotes in the search box. Click on Windows Update at the top of the list:

You will need to look in both the Important Update and the Optional Updates for this patch:

Search for the patch with id KB2952664 in the updates list, right click on it and select Hide Update:

If you have already installed the update, or don’t see the update listed in the Important Updates or Optional Updates section, you may need to uninstall it manually.

You can do this by going to Start -> Control Panel -> Programs and Features -> View Installed Updates. Then find the patch with ID KB2952664, right click on it and select uninstall. Then follow the steps above to hide it from future updates.

All monthly maintenance clients will have this done for their systems during their next update cycle. For further support or questions about this issue, contact your local IT professionals.

Hearbleed Security Bug: Passwords You Should Change

Internet, Securityheartbleed, internet, openssl, securityOphtek, LLC

Apr 2014

The OpenSSL bug known as Heartbleed has affected thousands of websites worldwide, even some common ones you use everyday. Mashable has done a terrific job of compiling a list of sites that have been affected, patches and more importantly the sites you should change your password on immediately.

Keep in mind that there are already open source tools available to the public that take advantage of the Heartbleed bug, and more will likely become available.

Here is the list of major websites that have been patched, but you should change your password for immediately:

Facebook
Box
Tumblr
Google
Yahoo
Gmail
Yahoo Mail
Amazon Web Services (for website operators)
GoDaddy
Intuit (TurboTax)
Dropbox
LastPass
OKCupid
SoundCloud
Wunderlist
Etsy
Flickr
GitHub
IFTTT
Instagram
Minecraft
Netflix
Pinterest
USAA
Wikipedia(if you have an account)

These are major websites Mashable recommends users to change their passwords on. There are likely other sites out there that are affected too. Our previous article explains how you can check if your commonly used websites you have a login to are affected.

http://filippo.io/Heartbleed/ will let you know if the site has the Heartbleed Bug.

For further support on network or internet security, contact your local IT professionals.

Major Online Security Bug Found: Heartbleed

Internet, Securityheartbleed, network, openssl, securityOphtek, LLC

Apr 2014

A major OpenSSL bug has been found that could affect 70% of secure websites.

A major bug has been found in the popular OpenSSL library used by thousands of online merchants, email providers and banks. The bug allows anyone on the internet to read a user’s private information while it is being sent back and forth to the website. A security advisory has been issued by OpenSSL.

Why is the bug called Heartbleed?

The code affected by this bug is in the heartbeat portion of the protocol which keeps the connection to the website active. When the bug is exploited it causes memory to leak its content while it is being sent over the internet, which contains sensitive and private information.

How does this affect me?

If the website you are logging in to, such as your bank, email or an online store uses a version of OpenSSL that has this bug:

An attacker can open a connection to your bank over and silently download among other things the keys used to prove the bank is who they say they are.
They can then pretend to be your bank and you will not notice anything different, while all of your communication is being stolen.

It is estimated that up to 70% of internet websites are affected by this bug. Companies can fix the bug by upgrading to the latest version of OpenSSL, creating new certificates and removing old certificates.

How can I protect myself?

First check if the website you are accessing has an “https” in front of the address, meaning it should be a secure connection. All banks, email webpages and online stores should have this:

If it is a secure connection, enter the website here to check if the bug exists.

http://filippo.io/Heartbleed/ will let you know if the site has the Heartbleed Bug.

If it does exist, avoid using the website until they have upgraded their OpenSSL. For further assistance with the Heartbleed bug or other security issues, contact your local IT professionals.

Scammers Hijack SOHO Routers to Steal User Information

Internet, Office IT, Office Network, Repairs and Upgrades, Security, Servicesd-link, dns, internet, micronet, privacy, router, security, soho, tenda, tp-linkOphtek, LLC

Apr 2014

TP-Link is among the vendors affected by the SOHO pharming campaign.

Recently, it was discovered that several hundred thousand routers fell victim to a hijacking scheme that could become a prevalent problem to many internet users worldwide. The attack, dubbed as a ‘small office/home office (SOHO) pharming campaign,’ was targeting Vietnam, but according to a report by Team Cymru, the SOHO pharming campaign also made its way into regions like the US and Italy.

The criminals behind the pharming campaign took advantage of exploitable security holes in various consumer-grade routers, and from there they were able to redirect users to malicious websites to steal login credentials and/or dropped malware onto the users’ computer. The scary part about this SOHO campaign is that more than one type of routers are affected. According to Team Cymru, the compromised routers could be a brand name like D-Link or and off-brand like TP-Link.

A diagram depicting the ‘man-in-the-middle’ hijacking scheme from Team Cymru.

Cyber security experts found that once the attackers had control of their targeted routers, they changed the devices’ Domain Name System (DNS) settings to force users to send out requests to the 5.45.75.11 and 5.45.75.36 IP addresses. The new DNS settings then acts as a ‘middle-man’ and redirect users to malicious sites instead of legitimate ones.

While it is easy to point the fingers directly at the people manufacturing the routers, it’s not completely their fault. There’s no such thing as a ‘hands-off’ policy when it comes to protecting yourself from intrusions by cyber criminals. That said, there are a few things many router owners can do to lessen their chances of becoming victims to the router hijacking scheme.

Disable router’s remote user-mode and graphical user interface. Disabling remote access will help keep users who aren’t directly connected to your network from accessing your routers’ admin properties. Disabling the GUI will, reportedly, mitigate the likelihood that someone can find a hole in the routers’ software. Instead of making changes to the routers’ setting via a graphical interface, try to change the settings via command lines.
Corporate networks may want deploy tracking systems (i.e. an HTML code on the externally facing servers) to detect possibly malicious IP addresses.
All SOHO router settings (especially DNS) should be controlled at the host level.
Admins must proactively monitor router settings periodically to ensure that the router’s DNS is pointing at those that belong to their internet service providers (ISP).

These are just a few of the basic security measures you must consider if you or your organization is using a SOHO router. Should you have any questions or concerns regarding the recent SOHO pharming campaign or what you should do tighten up your network security, contact our IT professionals.

The Best Free Password Managing Software: KeePass

Softwareaccount, keepass, password manager, securityOphtek, LLC

Feb 2014

Keepass is simple software to manage your passwords.

Computers such as desktop PCs and smartphones have greatly enhanced our lives, but they also bring about many inconveniences. One of which is managing countless accounts that range from emails to a simple PC login screen. Most people have the capacities to remember a few important phone numbers and maybe a few more pins or passwords for various services. However, when it comes to all the services and accounts that a person must manage on a daily basis, it’s often hard to recall what the screen names and passwords of these accounts are right off the bat.

Rock, Paper, Software

Many computer users, despite the advantages that the computer age brought about, are still using stickies or notepads to store their digital usernames and passwords. While this method of management isn’t at all a bad idea, it does come with quite a few inconveniences. We can go on and on about what these are, but if you can just conjure up some common sense you’ll realize that a piece a paper isn’t going to cut it (pun intended) in this day age.

Rather than risking losing all their digital account information in the blink of an eye (i.e. misplacing your paper notepad), a lot people are now relying on software-based account organizers. These account managers, aka ‘password managers,’ have become quite popular, as they are easily accessible whenever and wherever.

KeePass: Rock Solid Password Manager Without the Fuss

There are many password management options available, but nothing beats free—especially when it does the job. One such freeware (free software that is fully functional) is KeePass. This particular program isn’t flashy, but it is simple and extremely easy to use. It lets you store virtually all your digital account information in one place, and it even lets you synchronize this data with your Dropbox and Google Drive account. Just like a conventional paper notebook, you can record all your usernames and passwords into one place, and when you need to retrieve the data you can login into the program with a key file or just a password to obtain what you want.

Open Source and Free

Another nifty built-in feature of KeePass is its password generator. One of the best ways to keep your personal information safe is to secure it with a password that’s difficult to guess, and KeePass’ password generator will help you do just that.

Generate a password so hard even you can’t guess it.

KeePass is also open source, which means programmers (or overly enthusiastic computer users) can examine the program’s code to see if it’s safe for use, and they can even modify some of the software’s settings to fit their needs.

Onsite PC Solution recommends KeePass to all clients because it gets the job done, and with little hassle. Did we mention it’s completely free?

For more tips on how you can better manage your digital accounts and cloud services, contact our IT professionals.

« Previous 1 … 45 46 47 48 49 50 Next »

Tag Archives: security

Why is the bug called Heartbleed?

How does this affect me?

How can I protect myself?

Rock, Paper, Software

KeePass: Rock Solid Password Manager Without the Fuss

Open Source and Free