Category

Security

Old Mac malware gets a facelift

By | Apple, Managed Service, Managed Technology, MSP, Security

In yet another sign that Apple computers are no longer being ignored by hackers, a successful piece of Windows-based malware has been rewritten for MacOS. Instead of encrypting data and holding it for ransom, OSX.Dok skips the extortion and simply steals your bank account information. Read on to learn what you can do to prevent an infection.

OSX.Dok isn’t new, but it has been improved

Originally, this Mac-based malware looked very different. When OSX.Dok was first reported several months ago, it could infect only older versions of the Apple operating system. Besides being relegated to OS X, it didn’t do much more than simply spy on the internet history of its victims. More recently, however, OSX.Dok was updated to target the newer macOS and to steal banking information.

How does it work?

Like so many malware programs today, this particular threat is distributed via phishing emails. Because the end goal is to acquire private financial information, these emails pretend to have pressing information about taxes or bank statements stored in attachments that actually contain malicious software.

Once any of these attachments are opened, OSX.Dok secretly broadcasts information about the computer and its location to the malware’s authors. Based on that information, hackers can redirect victims that visit banking websites to copycat URLs tailored to their language and location. Almost everything on the copycat sites looks exactly the same, but when you submit your user ID and password, they go straight to hackers.

Worst of all, the latest version of this malware seems to be incredibly advanced. It actively changes the way it hides itself and even modifies system settings to keep the computer from checking for operating system and security updates.

What can I do?

Security experts are still working on a way to combat OSX.Dok, but believe that it will remain a problem for some time to come. For now there are a few things you can do:

Never open attachments from people you don’t know personally, and even then be wary of anything you weren’t expecting.
Pay attention to little details. For example, copyright dates at the bottom of fake banking sites only went to 2013.
Look closely at the lock to the left of URLs in your address bar. Fake websites may have security certificates with names slightly different from those of the sites they mimic.

The best way to stay ahead of threats like OSX.Dok is by partnering with a capable IT provider. That way you can be sure that you have all the latest software and hardware to keep you safe. Even if something managed to slip through, regular audits are sure to find infections sooner than an overburdened in-house team would. Call Simpatico today at 855-476-6347  to find out how we can protect you!

Published with permission from TechAdvisory.org. Source.

What you need to know about malware

By | Managed Service, Managed Technology, MSP, Security

You’ve all heard of viruses, spyware, ransomware and trojans. But did you know that they’re all types of malware? They’re all designed to ruin your digital life, but different types of malware put your computer at risk in different ways. Understanding what sets them apart can keep your business guarded.

Viruses

Once created to annoy users by making small changes to their computers, like altering wallpapers, this type of malware has evolved into a malicious tool used to breach confidential data. Most of the time, viruses work by attaching themselves to .exe files in order to infect computers once the file has been opened. This can result in various issues with your computer’s operating system, at their worst, rendering your computer unusable.

To avoid these unfortunate circumstances, you should scan executable files before running them. There are plenty of antivirus software options, but we recommend choosing one that scans in real-time rather than manually.

Spyware

Unlike viruses, spyware doesn’t harm your computer, but instead, targets you. Spyware attaches itself to executable files and once opened or downloaded, will install itself, often times completely unnoticed. Once running on your computer, it can track everything you type, including passwords and other confidential information. Hackers can then use this information to access your files, emails, bank accounts, or anything else you do on your computer.

But don’t panic just yet, you can protect yourself by installing anti-spyware software, sometimes included in all-purpose “anti-malware” software. Note that most reputable antivirus software also come bundled with anti-spyware solutions.

Adware

Are you redirected to a particular page every time you start your browser? Do you get pop ups when surfing the internet? If either situation sounds familiar, you’re likely dealing with adware. Also known as Potential Unwanted Programs (PUP), adware isn’t designed to steal your data, but to get you to click on fraudulent ads. Whether you click on the ad or not, adware can significantly slow down your computer since they take up valuable bandwidth. Worse still, they’re often attached with other types of malware.

Some adware programs come packaged with legitimate software and trick you into accepting their terms of use, which make them especially difficult to remove. To eradicate adware, you’ll need a solution with specialized adware removal protocols.

Scareware

This type of malware works like adware except that it doesn’t make money by tricking you into clicking on ads, but by scaring you into buying a software you don’t need. An example is a pop up ad that tells you your computer is infected with a virus and you need to buy a certain software to eliminate it. If you fall for one of these tactics and click on the ad, you’ll be redirected to a website where you can buy the fake antivirus software.

Scareware acts more like a diversion from the other malware that often comes with it. A good antivirus solution will help scan for scareware too, but you should patch your operating systems regularly just to be safe.

Ransomware

Ransomware has become increasingly common and hostile. It encrypts your computer files and holds them hostage until you’ve paid a fee for the decryption code. Because ransomware comes with sophisticated encryption, there aren’t many options unless you have backups of your data.

There are some tools that can protect against ransomware but we recommend that you backup your data and practice safe web browsing habits.

Worms

Similar to viruses, worms replicate themselves to widen the scope of their damage. However, worms don’t require human intervention to replicate themselves as they use security flaws to transmit from one computer to the next, making them far more dangerous than your typical virus. They often spread via email, sending emails to everyone in an infected user’s contact list, which was exactly the case with the ILOVEYOU worm that cost businesses approximately $5.5 billion worth of damage.

The easiest ways to protect your network from worms is to use a firewall to block external access to your computer network, and to be careful when clicking on unknown links in your email or unknown messages on social media.

Trojans

Usually downloaded from rogue websites, Trojans create digital backdoors that allow hackers to take control of your computer without your knowledge. They can steal your personal information, your files, or cause your computer to stop working. Sometimes hackers will use your computer as a proxy to conceal their identity or to send out spam.

To avoid trojan attacks, you should never open emails or download attachments from unknown senders. If you’re skeptical, use your antivirus software to scan every file first.

In order to keep malware at bay, you need to invest in security solutions with real-time protection and apply security best practices within your office. If you have any questions or concerns, or simply need advice on how to strengthen your business’s security, just give Simpatico Systems a call at 855-476-6347 and we’ll be happy to help.

Published with permission from TechAdvisory.org. Source.

How to secure your IoT devices

By | Hardware, Managed Service, Managed Technology, MSP, Security

More firms are using the Internet of Things (IoT) to create new business opportunities. For instance, companies that install smart sensors can automate data entry and monitor their inventory. However, if left unsecured, IoT devices also give hackers an opportunity to breach your network. In order to keep attackers at bay, we advise you take the following precautions with your IoT devices.

SET PASSWORDS

Many often forget they can set passwords for IoT devices. When this happens, they tend to leave their gadgets with default passwords, essentially leaving the door open for hackers. Make sure to set new and strong passwords — preferably with a combination of upper and lower case letters, numbers, and symbols — for each device connected to your network. Then, use a password manager to securely keep track of all your passwords.

Disable Universal Plug and Play (UPnP)

UPnP is designed to help IoT gadgets discover other network devices. However, hackers can also exploit this feature to find and connect to your IoT devices. To prevent them from getting to your network, it’s best to disable this feature completely.

Create a separate network

When you’re dealing with IoT devices, it’s wise to quarantine them in a separate network unconnected to your main office network. By doing this, user gadgets will still have access to the internet but won’t be able to access mission-critical files.

You should also consider investing in device access management tools. These allow you to control which devices can access what data, and prevent unauthorized access.

Update your firmware

If you want to keep your devices secure against the latest attacks, then you need to keep your IoT software up to date. Security researchers are always releasing security patches for the most recent vulnerabilities, so make it a habit to regularly check for and install IoT firmware updates. If you have several gadgets to secure, use patch management software to automate patch distribution and set a schedule to check for updates monthly.

Unplug it

Disconnecting your IoT devices from the internet (or turning them off completely) whenever you don’t need them significantly reduces how vulnerable you are to an attack. Think about it, if there’s nothing to target, hackers won’t be able to make their move. Turning your IoT devices on and off again may not seem like the most convenient strategy, but it does deny unauthorized access to your router.

Unfortunately, as IoT devices become more commonplace in homes and offices, more hackers will develop more cunning ways to exploit them. Getting into the above mentioned security habits can protect you from a wide variety of IoT attacks, but if you really need to beef up your security, then contact Simpatico Systems today at 855.476.6347. We have robust security solutions that keep your hardware safe.

Published with permission from TechAdvisory.org. Source.

Wikileaks details router vulnerabilities

By | Security

When we write about how antivirus software isn’t enough to keep you safe from malware, it’s not just scare tactics. There are so many ways hackers can break into your system that antivirus solutions will never catch. For a real-world example, look no further than the router exploit kit recently leaked from the CIA.

The Wikileaks CIA documents

For several months, the notorious website famous for leaking government data has been rolling out information it obtained from the Central Intelligence Agency. The documents detail top-secret surveillance projects from 2013 to 2016 and mainly cover cyber espionage.

In the most recent release, documents describe government-sponsored methods and programs used to exploit home, office, and public wireless routers for both tracking internet browsing habits and remotely accessing files stored on devices that connect to compromised networks.

Is my router one of them?

According to the documents, 25 models of wireless routers from 10 different manufacturers were being exploited by the CIA. They weren’t off-brand budget devices either; the list includes devices from some of the biggest names in wireless networking:

  • Netgear
  • Linksys
  • Belkin
  • D-Link
  • Asus

Those brands account for over a third of wireless routers on the market, which means there’s a good chance you’re at risk.

After WannaCry used a previous CIA leak to fuel its global spread, you need to worry about more than just being a target of government espionage too. Over the past few years, almost all of these leaks have quickly made their way into criminal hands.

Patching vulnerabilities

Fixing security gaps in hardware is tricky business, especially when they’re mainly used to monitor rather than corrupt. In most cases, there will be no visual cues or performance problems to indicate your hardware has been infected. As such, you should plan on regularly updating the software on your hardware devices whenever possible.

Accessing your router’s software interface isn’t a user-friendly experience for non-IT folks. Usually, to access it, you need to visit the manufacturer’s website and log in with the administrator username and password. If these are still set to the default “admin” and “password” make sure to change them.

Once logged in, navigate through the settings menus until you find the Firmware Update page. Follow the instructions and confirm that the firmware has been properly installed.

The CIA’s router leaks were vague, so we’re not even sure how recent they are. We are fairly certain, however, that all of the manufacturers have since patched the vulnerabilities. Regardless, updating your router’s firmware will protect from a number of cyber security risks. If you’re unable to finish the task on your own, one of our technicians can fix it, as well as any other firmware vulnerabilities, in a matter hours. All you need to do is call us, 855-476-6347!

Published with permission from TechAdvisory.org. Source.

Bandwidth – What is it, what does it do and why do I need more of it!

By | Business, Google, Managed Service, Managed Technology, MSP, Security, Uncategorized, Web & Cloud
Post by:  Fabienne McGeever

Bandwidth refers to the amount of information that something, like a connection to the internet, can handle in a given time.  Bandwidth calculations consider both theoretical ratings and actual throughput.  It also measures speed for what is being sent out (upstream) and what is being brought in (downstream), explained today as up and down, from each workstation.  Both up and down have a separate and unique speed measurement.  Typical scenarios that are especially sensitive and are noticed around a networked company and is felt throughout include issues like:

  • time to establish a new connection
  • time to load a Web page, and basic browsing
  • time to download an app, patch, or other files
  • ability to stream video content for long periods uninterrupted
  • Processing day to day functions in your specific software package including systems software and application software. Systems software includes the programs that are dedicated to managing the computer itself.  Application software includes personal and business that keep employees and your company running).

Let’s use an analogy to help make bandwidth clearer. In this example, the bandwidth is the number of tables in a restaurant, and web traffic is diners. The math is simple: The more tables in the restaurant, the more patrons can dine there at any one time.  The service however will be affected when there is an overabundance of patrons and not enough service, or a particular patron is over demanding; insistent that he deserves more attention.

Network connections each possess a bandwidth rating according to the maximum data rate it is physically capable of supporting.  Examples are:  wired, WiFi, DSL, (VPN) Virtual Personal Network, (RDP) Remote Desktop Protocol and Ethernet connections are examples.  Fast Ethernet or Higher level network protocols like (IP) Internet Protocol use links at 100 Mbps (megabits per second).  Each of these connections have a distinctive speed rating.  All networks can easily be extended to link entire businesses or office buildings using network bridge devices.  Being cognizant of what ports, switches, routers, tunnels and adapters are also important, but that’s another article!  These devices do play a part in a networks performance.  In the IT world, this can explain why things are not working the way or as fast as you are expecting.  Whether proactive, reactive or both, maintenance is king!  Equipment makes a huge difference and letting your hardware become obsolete is never a good idea.

So how much bandwidth does one need?  Internet usage doubles every 12 months. If you need 10Mbps of bandwidth service right now, next year you’ll probably need 20Mbps.  Businesses need 100Mbps per 1,000 users or 100Kbps (kilobits per second) per user.  Mbps is over 1000 times faster than 1.0 Kbps. Reports project users will require 1Gbps per 1,000 seats or 1Mbps per user.  There are only a few things to consider in purchasing bandwidth through your (ISP) Internet Service Provider.  Who is using the Internet, what are they using the Internet for and when are users actually using it.  Unfortunately, traffic is not a steady trickle of bytes it comes in bursts.  Cost and availability from your provider both limit the bandwidth provisioned to you.  Your ISP will let you know what is available in your area.  Even more important is how your internal network bandwidth is allocated throughout the building.  Throttling is recommended to help prioritize who needs what and how much.  If a few are utilizing all the bandwidth, you can evaluate the necessity and make a business decision to control or purchase more bandwidth and/or put parameters in place for bandwidth distribution.  Setting up this regulator lets you know who is monopolizing your bandwidth.  This doesn’t preclude your ISP throttling you. They may be allowing full speed traffic to benchmarking sites while artificially squeezing anything else to slower speeds.  “Unmetered bandwidth” is also an option; however, unmetered means a hosting plan with unmetered traffic… But unmetered does not mean unlimited.   Unmetered hosting plans are often very limited in the amount of data you can send and receive.  Data is often transferred between your servers and the public web at a lower speed.  Some easy, low cost fixes to increase your speed might include just changing up your web browser, updating your operating system, changing out hardware like your network card, RAM and of course making sure your network is secure!

Fiber optic cable is now replacing copper cable, raising the standard in broadband speeds  from the world of megabit into gigabit speeds .  Your network condition is directly related to production and plays a critical role in the success and growth of your business.

Simpatico Systems, LLC is able to perform a network assessment and advise you on how to get your network in the best condition, in addition to being compliant for best practices and performance.  Call us today – 855.476.6347 opt 1.

About the Author: Fabienne McGeever is a middle child/twin in a family of ten children.  She gained the unique perspective to see both sides and get along with most. She loves snow skiing, the beach “in any form,” and glamping. Fabienne lives in Santa Clarita, CA and serves as a Corporate Admin/Client Relations Liaison for Simpatico Systems.  Contact her directly:  fabienne.mcgeever@simpat.co

The most advanced Gmail phishing scam yet

By | Security

As the technology that recognizes and thwarts malware becomes more advanced, hackers are finding it much easier to trick overly trusting humans to do their dirty work for them. Known as social engineering, it’s a dangerous trend that is becoming increasingly prevalent. Read on to educate yourself on how to avoid the most recent scam and those that came before it.

Broadly defined, “phishing” is any form of fraud in which an attacker tries to learn information such as login credentials or account information by masquerading as a reputable entity or person in email, IM or other communication channels.

These messages prey on users who click links, images and buttons without thoroughly investigating where they lead to. Sometimes the scam is as simple as an image with a government emblem on it that links to a website containing malware. Just hovering your mouse over the image would be enough to see through it. But some phishing schemes are far more difficult to recognize.

The Google Defender scam

Recently, an email spread to millions of Gmail accounts that almost perfectly imitated a message from Google. The text read:

“Our security system detected several unexpected sign-in attempts on your account. To improve your account safety use our new official application “Google Defender”.

Below that was a button to “Install Google Defender”. What made this scheme so hard to detect is that the button actually links to a totally legitimate site…within Google’s own framework. When third-party app developers create a Gmail integration, Google directs users to an in-house security page that essentially says, “By clicking this you are giving Google Defender access to your entire inbox. Are you sure you want to do this?”

Even to wary users, the original message looks like it came from Google. And the link took them to a legitimate Google security page — anyone could have fallen for it. The Gmail team immediately began assuring users that they were aware of the scam and working on eradicating it and any potential copycats.

There’s no happy ending to this story. Although vendors and cybersecurity experts were able to respond to the crisis on the same day it was released, millions of accounts were still affected. The best way to prepare your business is with thorough employee training and disaster recovery plans that are prepared to respond to a breach. To find out how we can protect your business, call Simpatico Systems today – 855-476-6347.

Published with permission from TechAdvisory.org. Source.

IMPORTANT – Intel’s Manageability Firmware Vulnerability

By | Business, Hardware, Managed Service, Managed Technology, MSP, Security

According to a recent email received by Simpatico Systems from a trusted manufacturer, systems utilizing Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM) or Intel® Small Business Technology (SBT) may have a vulnerability in the firmware.  A potential attack could compromise security, allowing access to business PC’s, sensitive data or devices using the affected Intel® product.

Intel® is reacting appropriately, providing information, proactively identifying individual devices and implementing validated firmware updates.  In most cases, consumer class products with consumer firmware and data center servers using Intel®’s Server Platform Services are not part of the vulnerability.  Below are some helpful links to better understand the issue, how to find out if you are vulnerable and how to mitigate the firmware vulnerability.

Press Release – Click Here.

Technical Summary – Click Here.

INTEL-SA-00075 Detection Guide – Click Here.

Simpatico Systems’ partners … fear not!  While you were sleeping, we solved the problem.  If you would like to sleep better and need a proactive technology partner, call Simpatico today – 855-476-6347.

The phishing craze that’s blindsiding users

By | Security

Most phishing attacks involve hiding malicious hyperlinks hidden behind enticing ad images or false-front URLs. Whatever the strategy is, phishing almost always relies on users clicking a link before checking where it really leads. But even the most cautious users may get caught up in the most recent scam. Take a look at our advice for how to avoid the newest trend in phishing.

What are homographs?

There are a lot of ways to disguise a hyperlink, but one strategy has survived for decades — and it’s enjoying a spike in popularity. Referred to as “homographs” by cybersecurity professionals, this phishing strategy revolves around how browsers interpret URLs written in other languages.

Take Russian for example, even though several Cyrillic letters look identical to English characters, computers see them as totally different. Browsers use basic translation tools to account for this so users can type in non-English URLs and arrive at legitimate websites. In practice, that means anyone can enter a 10-letter Cyrillic web address into their browser and the translation tools will convert that address into a series of English letters and numbers.

How does this lead to phishing attacks?

Malicious homographs utilize letters that look identical to their English counterparts to trick users into clicking on them. It’s an old trick, and most browsers have built-in fail-safes to prevent the issue. However, a security professional recently proved that the fail-safes in Chrome, Firefox, Opera and a few other less popular browsers can be easily tricked.

Without protection from your browser, there’s basically no way to know that you’re clicking on a Cyrillic URL. It looks like English, and no matter how skeptical you are, there’s no way to “ask” your browser what language it is. So you may think you’re clicking on apple.com, but you’re actually clicking on the Russian spelling of apple.com — which gets redirected to xn—80ak6aa92e.com. If that translated URL contains malware, you’re in trouble the second you click the link.

The solution

Avoiding any kind of cybersecurity attack begins with awareness, and when it comes to phishing, that means treating every link you want to click with skepticism. If you receive an email from someone you don’t know, or a suspicious message from someone you do, always check where it leads. Sometimes that’s as simple as hovering your mouse over hyperlink text to see what the address is, but when it comes to homographs that’s not enough.

In the case of homographs, the solution is unbelievably simple: Manually type in the web address. If you get an email from someone you haven’t heard from in 20 years that says “Have you checked out youtube.com??”, until your browser announces a fix, typing that URL into your browser’s address bar is the only way to be totally sure you’re safe.

For most, this trend feels like yet another development that justifies giving up on cybersecurity altogether. But for small- and medium-sized businesses that have outsourced their technology support and management to a competent and trustworthy IT provider, it’s just another reason to be thankful they decided against going it alone. If you’re ready to make the same decision, call Simpatico Systems today @ 855.476.6347.

Published with permission from TechAdvisory.org. Source.

Some ransomware strains are free to decrypt

By | Security

Ransomware is everywhere. Over the last couple years, dozens of unique versions of the malware have sprung up with a singular purpose: Extorting money from your business. Before you even consider paying for the release of your data, the first thing you must always check is whether your ransomware infection already has a free cure.

The state of ransomware in 2017

It’s been almost 30 years since malware was first created that could encrypt locally-stored data and demand money in exchange for its safe return. Known as ransomware, this type of malware has gone through multiple periods of popularity. 2006 and 2013 saw brief spikes in infections, but they’ve never been as bad as they are now.

In 2015, the FBI estimated that ransomware attacks cost victims $24 million, but in the first three months of 2016 it had already racked up more than $209 million. At the beginning of 2017, more than 10% of all malware infections were some version of ransomware.

Zombie ransomware is easy to defeat

Not every type of infection is targeted to individual organizations. Some infections may happen as a result of self-propagating ransomware strains, while others might come from cyber attackers who are hoping targets are so scared that they pay up before doing any research on how dated the strain is.

No matter what the circumstances of your infection are, always check the following lists to see whether free decryption tools have been released to save you a world of hurt:

Prevention

But even when you can get your data back for free, getting hit with malware is no walk in the park. There are essentially three basic approaches to preventing ransomware. First, train your employees about what they should and shouldn’t be opening when browsing the web and checking email.

Second, back up your data as often as possible to quarantined storage. As long as access to your backed-up data is extremely limited and not directly connected to your network, you should be able to restore everything in case of an infection.

Finally, regularly update all your software solutions (operating systems, productivity software, and antivirus). Most big-name vendors are quick to patch vulnerabilities, and you’ll prevent a large portion of infections just by staying up to date.

Whether it’s dealing with an infection or preventing one, the best option is to always seek professional advice from seasoned IT technicians. It’s possible that you could decrypt your data with the tools listed above, but most ransomware strains destroy your data after a set time limit, and you may not be able to beat the clock. If you do, you probably won’t have the expertise to discern where your security was penetrated.

Don’t waste time fighting against a never-ending stream of cyber attacks — hand it over to us and be done with it. Call 855.476.6347 option 3 to find out more.

Published with permission from TechAdvisory.org. Source.

What exactly is preventive cyber-security?

By | Security

There has been a movement among technology providers to promise “proactive” cyber security consulting. Small- and medium-sized businesses love the idea of preventing cyber-attacks and data breaches before they happen, and service providers would much rather brainstorm safeguards than troubleshoot time-sensitive downtime events. But it’s not always clear what proactive cyber-security means, so let’s take a minute to go over it.

Understand the threats you’re facing

Before any small- or medium-sized business can work toward preventing cyber-attacks, everyone involved needs to know exactly what they’re fighting against. Whether you’re working with in-house IT staff or an outsourced provider, you should review what types of attack vectors are most common in your industry. Ideally, your team would do this a few times a year.

Reevaluate what it is you’re protecting

Now that you have a list of the biggest threats to your organization, you need to take stock of how each one threatens the various cogs of your network. Map out every device that connects to the internet, what services are currently protecting those devices, and what type of data they have access to (regulated, mission-critical, low-importance, etc.).

Create a baseline of protection

By reviewing current trends in the cyber-security field, alongside an audit of your current technology framework, you can begin to get a clearer picture of how you want to prioritize your preventative measure versus your reactive measures.

Before you can start improving your cyber-security approach, you need to know where the baseline is. Create a handful of real-life scenarios and simulate them on your network. Network penetration testing from trustworthy IT professionals will help pinpoint strengths and weaknesses in your current framework.

Finalize a plan

All these pieces will complete the puzzle of what your new strategies need to be. With an experienced technology consultant onboard for the entire process, you can easily parse the results of your simulation into a multi-pronged approach to becoming more proactive:

  • Security awareness seminars that coach everyone — from receptionists to CEOs — about password management and mobile device usage.
  • “Front-line” defenses like intrusion prevention systems and hardware firewalls that scrutinize everything trying to sneak its way in through the front door or your network.
  • Routine checkups for software updates, licenses, and patches to minimize the chance of leaving a backdoor to your network open.
  • Web-filtering services that blacklist dangerous and inappropriate sites for anyone on your network.
  • Antivirus software that specializes in the threats most common to your industry.

As soon as you focus on preventing downtime events instead of reacting to them, your technology will begin to increase your productivity and efficiency to levels you’ve never dreamed of. Start enhancing your cyber-security by clicking contact us. Or call 855-476-6347.

Published with permission from TechAdvisory.org. Source.