Security

The Three Scariest Threats To Small Business Networks

October 27, 2015

Thomas Fox is president of Tech Experts, southeast Michigan’s leading small business computer support company.

While spam, pop-ups, and hackers are a real threat to any small business network, there are three security measures that you should be focusing on first before you do anything else.

Worry About E-mail Attachments, Not Spam
Sure, spam is annoying and wastes your time, but the real danger with spam is in the attachments.

Viruses and worms are malicious programs that are spread primarily through cleverly disguised attachments to messages that trick you (or your employees) into opening them.

Another huge threat is phishing e-mails that trick the user by appearing to be legitimate e-mails from your bank, eBay, or other financial accounts.

Here are three things you must have in place to avoid this nightmare: [Read more…] about The Three Scariest Threats To Small Business Networks

Beware The Fake Microsoft Cold Calls

October 27, 2015

Scott Blake is a Senior Network Engineer with Tech Experts.

The phone rings and you don’t recognize the number or name on the caller ID. You pick up anyway and the caller tells you that they work for Windows Support or Windows Service Center and they are a Microsoft Certified Technician.

They go on to say they have received log files or have determined that your computer is infected and causing corruption throughout your Windows operating system.

They ask if you’re at your computer now and, if not, to go there. Once there, they walk you through how to open your Event Viewer and show you the Administrative Events under the Custom Views folder.

They are quick to point out all of the red circles labeled “Error” are all Malware infections. They then ask you to look at the number of events listed and they go on to advise this is the total number of infections currently on your computer.

The caller then says they can clean your system of all infections, but they will need to have remote access to the computer.

At this point in the call, most people have been thoroughly convinced by the voice on the other end of the phone that their system is indeed infected and needs to be cleaned. After all, the caller knew where to look for the so-called infections and they do sound like they truly want to help.

The Microsoft “employee” will even tell you that if you don’t let them remove the infections, the “hackers” that placed the malware on your system will have complete access to all of your information.

They warn that your identity is in jeopardy of being stolen. You must give them remote access to your computer. They are your only hope and you must trust them. After all, they say they work for Microsoft.

The fact of the matter is that the caller does not work for Microsoft in any capacity. They don’t work for any of their third party vendors nor any security firm that has been retained by Microsoft.

They are in fact the “hackers” attempting to convince you to give them access to your computer to infect your system and steal your data.

If you allow them remote access, they will start to install malicious programs on your computer. They’ll copy all of your information and, in some cases, encrypt your data.

They will tell you that that the infection is too severe for a “standardized” cleaning and you will need to pay money to have them install removal programs to clean the system.

In mid-2013, NBC News Technology reporter Frank Catalano, reported on receiving one such phone call himself.

After his ordeal with the fake Microsoft, Mr. Catalano contacted the real Microsoft. He received the following reply:

“In 2010, Microsoft began receiving reports of scammers making phone calls or sending emails to people,” replied a spokesperson for Microsoft’s Digital Crimes Unit. They advised that they had referred the cases to the Federal Trade Commission.

One very important thing to remember is that Microsoft (or any of its partners) will never cold call you. They will never ask for remote assistance. They will never ask for usernames and passwords.

If you have fallen victim to such a scam, disconnect your network cable and take your computer to a trusted service center or repair facility and explain in detail what happened as soon as possible.

For questions or advice on what to do about cold call scammers, contact Tech Experts at (734) 457-5000, or by email at info@mytechexperts.com.

Can Your Car Really Be Hijacked?

September 23, 2015

On your daily commute, imagine your car suddenly not responding to your driving cues. Turn the steering wheel, and nothing happens. Push the brake, and you don’t stop. Few things could be more frightening than hurdling through space at any speed and not knowing what will happen. This scenario may sound like a scene from a science fiction or adventure movie, but it is certainly possible. Wired reporter, Andy Greenwood, recently proved that today’s smart vehicles can be remotely accessed and controlled by hackers.

While the likelihood of someone with the means and know-how to hack your personal vehicle may be low, the mere possibility of it happening shakes our very foundation of how we see the world. After all, there’s enough to worry about when driving: from animals suddenly crossing in front of you to weather conditions with the potential to send you careening off the road. Now, there’s this. Pretty much any device with a CPU is at risk to being hacked and controlled from afar, whether it is a pacemaker or a washing machine.

This is what Andy Greenburg set out to illustrate when he arranged for his Jeep Cherokee to be hijacked by two car-hacking researchers. The researchers were able to gain control of Greenburg’s vehicle, transforming his role from driver to passenger in little time. They turned the steering wheel, jerked on the reporter’s seat belt, and even disabled the brakes using the Internet. Much of the not-so-amusing shenanigans were controlled through Fiat Chrysler’s “Uconnect” feature, which electronically manages a vehicle’s navigation, entertainment features, and more. Basically, a vulnerability in this system let the hackers in.

While it is possible to remotely hijack vehicles without this Uconnect feature, this vulnerability is now well-known and puts certain Chryslers at an even greater risk to this new technological danger. The Uconnect package is an option offered for 2013 through 2015 Chrysler and Dodge cars and trucks, including the Jeep Cherokee, Dodge Ram, and Dodge Charger. The good news is that, if you have a vehicle featuring the Uconnect package, there is a fix that can be installed. Although it is possible to do it yourself by visiting the Chrysler website and downloading it onto a USB drive, this is a job perhaps best left to the dealership.

Battling Bloatware, Trial Programs and Time Bomb Software

August 31, 2015

The day has finally come. You’ve saved money for what seems like a lifetime to purchase a new desktop or laptop. You’re all excited to get it unboxed and powered on… only to find yourself confronted with loads of bloatware, trial programs and time bomb software you will never use and never asked for. You quickly find yourself spending hours removing all the preinstalled programs instead of enjoying your new device. Why is that?

The sole intent of a vast majority of the programs you find already installed is to track your presence on the web. Some programs, such as Superfish (which Lenovo was installing on their computers), also change your search results so you see different ads than you would from normal browsing habits. This can also affect your computer’s security.

Some of the more common programs that tend to get overlooked are browser toolbars. Several of the most common toolbars you will find are Yahoo, AOL, Google and Ask. These are so common that most computer users think they are part of their browser.

The purpose of a browser toolbar is to gather information on your browsing habits such as popular search words or phrases and sites visited. This information is then sold to advertising companies or used to place custom targeted ads on the sites you visit. In most cases, you will also start to see an increase in spam messages in your email inbox. It’s recommended to properly remove all browser toolbars from your Internet device.

Just when you think you have removed everything that needs to be removed, look again. Most likely, you will find trial or time bomb software installed as well. These are programs that offer you their fully functional features for a predetermined amount of time.

Two of the most popular software programs preinstalled in this way are Microsoft Office and anti-virus programs. Office programs will give you full functionality of the Office suite for usually about 30 days, then features will become unavailable to the user after the program expires. In some cases, this has little to no effect on the user, but in other cases, it can have a severe financial impact.

Trial versions of anti-virus programs can be the most devastating to the user. A user will power on their computer, see there is an anti-virus program made by a large and well-known company already installed, and they think they are fully protected against the evils that await them. This may be true for the first 30 to 90 days. However, after the trial period ends, most users either ignore the pop-ups warning that the program is going to expire or they are not notified. This leaves the user in a state of vulnerability. After the program expires, they no longer receive regular security definition updates.

Let’s say you have taken the time to fully clean and remove all the bloatware, trial, and time bomb software from your computer. The only things you need to watch for now are third-party programs piggybacking on the installs or updates of other programs.

Two of the most common programs to pay attention to when updating or installing are Adobe Flash Player and Oracle’s Java. You need to pay close attention to the installer windows or you will end up spending more time removing unneeded security scanners, toolbars, and/or browsers. For more information about bloatware, trial programs, and time bomb software, contact Tech Experts at (734) 457-5000.

Internet Security: Beware Of “Malvertising”

July 27, 2015

Michael Menor is Vice President of Support Services for Tech Experts.

As if Internet use wasn’t already troubled with cyber perils, users now have to add “malvertising” to the list of things from which they need to protect themselves.

“Malvertising,” like the name suggests, means “ads that contain malware.” Some mal-ads aren’t dangerous unless you click on them – but others can do “drive-by downloads,” sneaking their malware onto your computer simply because you’re viewing the page on which the ad appears.

While most malvertising is on websites, it can also show up on other ad-displaying apps, such as Facebook, Skype, some email programs, and many games.

The reason that malvertising is more of a problem than other malware approaches is that it can be spread through online advertising delivery networks like Google DoubleClick to legitimate sites that users routinely visit, like the New York Times, Huffington Post, and Yahoo, as well as routinely-used mobile apps that show ads. Malware-bearing ads can be “injected” either by hacking ads at the provider end or by buying and providing mal-ads. In most cases, there’s no way for a user to tell just by looking that an ad has been compromised.

The Potential Damage
The dangers of advertising-delivered malware are the same as those from malware you get any other way. Malware can steal account usernames and passwords, bank and credit card information, and other sensitive data.

It can encrypt your data and “hold it for ransom.” It can, in turn, infect other computers on your network and turn your computer into a “zombie,” spewing out spam and malware to the Internet.

Like other viruses and malware, malvertisements take advantage of security vulnerabilities on users’ computers and mobile devices. These may be anywhere from the operating system, to web browsers and other applications, to add-ons and extensions like Java, JavaScript, and Flash.

How do you know if your computer has been infected by malware? One sign is that your web browser shows unexpected pop-ups or seems to be running slower. But many malware infections remain “stealthy,” possibly even eluding anti-malware scans.

Legitimate ad creators and ad delivery networks are working on ways to detect and prevent malware from getting into the digital ads they serve. Otherwise, people have even more reason to not look at ads or block ads entirely.

But, assuming it can be done, this won’t happen for a year or more. The burden is on companies and individuals to do their best to protect their networks, computers, and devices.

What Can Companies and Users Do?
Although malvertising is a relatively new vector, the best security practices still apply; if you’re already doing things right, keep doing them. But what does “doing things right” look like?

Avoid clicking on those ads, even accidentally.
Maintain strong network security measures. Next generation firewalls at the gateway can often detect malware payloads delivered by ads, block the ads entirely, and/or detect communication from already-infected devices.
Regularly backup systems and critical files so you can quickly restore to a pre-infected state if your systems and data are compromised.
Deploy endpoint security software on every device so that it’s protected on and off the network.
Ensure that all operating systems and client software (especially web browsers) are fully patched and up to date.
If you suspect a computer has been infected, stop using it for sensitive activities until it’s been “disinfected.” Again, many security appliances can help you identify and quarantine infected devices.

It’s unfortunate that even more of everyday Internet use is potentially unsafe, but the steps to fend off malvertising are essentially security precautions that companies and individuals should already be following.

Does Your Company Need An Internet Usage Policy?

July 27, 2015

With the growth and expansion of the Internet, it is important to make sure that your business has a policy in place to protect its assets.

Depending on your business, an Internet Usage Policy (IUP) can be long and drawn out or short and to the point.

An IUP will provide your employees with guidelines on what is acceptable use of the Internet and company network. IUPs not only protect the company, but also the employee.

Employees are informed and aware of what is acceptable when it comes to websites and downloading files or programs from the Internet.

When employees know there will be serious consequences for breaking the IUP, such as suspension or termination of employment, companies tend to notice a decrease in security risks due to employee carelessness.

You will need to make sure your IUP covers not only company equipment and your network, but also employee-owned devices such as smart phones and tablets. You may be surprised at the number of employees that feel they do not have to follow the IUP because they are using their own device to surf or download from the Internet.

Make sure you address proper usage of company-owned mobile devices. Your business may have satellite employees or a traveling sales force. Even when they are away, they need to be aware they are still representatives of the business and must follow the business IUP.

After all, it would not go over well if your sales staff was giving a presentation to a prospective client and suddenly, “adult content” ads popped-up on the screen because one of your employees was careless in their web habits.

The downloading of files and programs is a security risk in itself. Private, internal company documents and correspondence downloaded from your company’s network can become public, causing unrepairable damage.

On the same thought, employees downloading from the Internet open your company’s network up to malware attacks and infections.

There are a lot of hackers that prey upon the absent-minded employee downloading a video or song file by hiding a piece of malware within the download. Once the malware makes it into your network, there’s no telling what damage it can cause.

As for non-work related use of the company network and Internet, make sure your employees know there is no expectation of personal privacy when using the company’s network and Internet connection.

Make it well-known that the network and Internet are in place to be used for work purposes only. Improper use of the network can reduce bandwidth throughout the company network.

This includes all mobile devices owned by the company. This way, your employees know that no matter where they are they still must follow the guidelines of the IUP.

Make sure all of your employees sign the IUP and fully understand what it is they are signing. Make sure you answer any and all questions they may have.

This will help clear up any confusion your employees may have. This way, there can be no excuses as to why the IUP was broken.

Whenever you update the IUP, make sure you have all of your employees sign and understand the new additions and/or changes to the IUP. It may seem like overkill, but you’ll be glad you did if you ever run into any violations of your company’s IUP.

For assistance in creating Internet Usage Policies or if you have any questions, call the experts at Tech Experts: (734) 457-5000.

Top Seven Network Attack Types So Far In 2015

June 30, 2015

There’s no doubt that small businesses are under attack from hackers and cyber-criminals. Typically, small companies have less secure networks and looser security standards, making them easy targets.

The latest Threat Report from McAfee Labs details the types of attacks against small businesses. The chart shows the most common network attacks detected in Q1 2015.

Denial of service attacks – 37%
A denial of service (DOS) attack attempts to make a resource, such as a web server, unavailable to users. These attacks are very common, accounting for more than one-third of all network attacks reviewed in the report.

A common approach is to overload the resource with illegitimate requests for service. The resource cannot process the flood of requests and either slows or crashes. [Read more…] about Top Seven Network Attack Types So Far In 2015

Data Breaches And The Building Blocks Of Cyber Security

May 27, 2015

The data breaches at Target, Home Depot, Staples, Michaels, Anthem, and Sony Pictures Entertainment are just the tip of the iceberg and the stakes are very high. They’re costly for both businesses and customers and once the breach is announced, customers often terminate their relationship with that business.

You may ask, “What constitutes a data breach?” It is an event in which an individual’s information, including name, Social Security number, medical record and/or financial record or debit card is potentially put at risk. This can be in either electronic or paper format. The data set forth in this article is based on Ponemon Institute’s “2014 Cost of Data Breach Study.” Ponemon conducts independent research on privacy, data protection and information security policy.

New methodologies developed by the National Institute of Standards and Technology (NIST) and other industry standards bodies, such as the Department of Health and Human Services (HHS), are being implemented by many organizations, but best practices for addressing cyber security threats remain vague.

So what can be done to minimize cyber security threats? An effective starting point is to focus on the following essential building blocks of any cyber threat defense strategy.

Most organizations rely on tools like vulnerability management and fraud and data loss prevention to gather security data. This creates an endless and complex high-volume stream of data feeds that must be analyzed and prioritized. Unfortunately, relying on manual processes to comb through these logs is one of the main reasons that critical issues are not being addressed in a timely fashion.

Implementing continuous monitoring, as recommended by NIST Special Publication 800-137, only adds to the security problem as a higher frequency of scans and reporting exponentially increases the data volume. Data risk management software can assist organizations in combining the different data sources, leading to reduced costs by merging solutions, streamlining processes, and creating situational awareness to expose exploits and threats in a timely manner.

One of the most efficient ways to identify impending threats to an organization is to create a visual representation of its IT architecture and associated risks.

This approach provides security operations teams with interactive views of the relationships between systems and their components, systems and other systems, and components and other components. It enables security practitioners to rapidly distinguish the criticality of risks to the affected systems and components. This allows organizations to focus mitigation actions on the most sensitive, at-risk business components.

Effective prioritization of vulnerabilities and incidents is essential to staying ahead of attackers. Information security decision-making should be based on prioritized information derived from the security monitoring logs. To achieve this, security data needs to be correlated with its risk to the organization. Without a risk-based approach to security, organizations can waste valuable IT resources mitigating vulnerabilities that, in reality, pose little or no threat to the business.

Lastly, closed-loop, risk-based remediation uses a continuous review of assets, people, processes, potential risks, and possible threats. Organizations can dramatically increase operational efficiency. This enables security efforts to be measured and made tangible (e.g., time to resolution, investment into security operations personnel, purchases of additional security tools).

By focusing on these four cyber security building blocks, organizations can not only fulfill their requirements for measurable risk reporting that spans all business operations, but also serve their business units’ need to neutralize the impact of cyber-attacks.

These methodologies can also help improve time-to-remediation and increase visibility of risks.

Security Tips To Keep Your Mobile Phone Secure

May 27, 2015

We’ve all seen the stories about celebrities getting their mobile phones hacked and having their private photos splattered all over the web.

Although you may think there is nothing of real interest on your phone, you are still at risk of security invasion. Any number of people could have motive to do so from exes to a colleague who perceives you as a threat, and even innocuous content on your phone can be taken out of context to reflect negatively on you in general.

Use some of these simple tips to protect your mobile phone and reputation:

Passwords
Your passwords are your primary defense against would-be hackers – from your lock code to email account password. Don’t share your passwords with others. Also, make sure your passwords aren’t easily guessed, such as your pet’s name or child’s birthday.

A secure password may not be as easily remembered, but it is far harder to hack. Finally, shield your phone’s screen when entering passwords in public lest onlookers take note of which buttons you push.

Clear Out the Cobwebs
In addition to creating more storage space on your mobile phone, it is just wise to remove old text conversations, photos, and other data periodically.

Back up the things you want to keep onto other devices, so you can access them later. With all of the excess stuff you don’t use on a regular basis gone, you leave less for hackers to work with if the security of your mobile phone is breached. In the event of being hacked, you would also likely lose all of those things, so backing such info up protects you twofold.

Beef Up Security
Take advantage of the lesser-known security features of your mobile phone. For example, turn off the Discoverable mode on your Bluetooth.

Look on your phone under Security to see if there are already included options, such as an automatic lock screen that activates after a certain period of inactivity.

There are also applications you can download to increase the level of security on your phone, including apps that allow you to access and control your phone remotely in the case of loss or theft.

Major Microsoft Windows Vulnerability Discovered

May 27, 2015

Microsoft recently released details about the newest vulnerability (MS15-034) in the Windows HTTP stack’s armor. With other recent problems in Microsoft patches, the problem may have been downplayed a bit to save face. This vulnerability, however, is more serious than it initially seemed.

The MS15-034 vulnerability is widespread. Although Windows servers are most at risk, this problem affects most products that run Windows. The chink in question lies in the HTTP.sys component, which is a kernel-mode device driver that processes HTTP requests quickly.

This component has been an integral part of Windows since 2003 and is present in all versions up to Windows 8.1. This means that any device running Windows without up-to-date patches is at risk.

It isn’t difficult to exploit this vulnerability. The only thing Microsoft is divulging about how MS15-034 can be used to compromise devices is that it requires “a specially crafted HTTP request.” It seems that this information is deliberately vague.

All one has to do is send an HTTP request with a modified range header, and access to data is granted, although sometimes limited. A similar attack was documented in 2011 on the Apache HTTPD Web server that was later patched.

There is good news though. As in other areas of life, prevention is far more effective than trying to deal with a problem’s aftermath. It isn’t difficult to protect your devices from the MS15-034 vulnerability.

The first step is to ensure that your server has the latest updates that include the patch to fix the problem.

If your server hosts a publicly accessible application, you can verify your server’s vulnerability by going to https://lab.xpaw.me/MS15-034, enter your server’s URL, and press the Check button for an instant report on your site.

If you then see the report that the website has been patched, you’re safe; otherwise, that particular system will need to be patched.

« Previous Page