MacOS vulnerability gives any user full admin rights without a password

We all want to believe that the technology platforms we use are invincible. But, the reality is, software flaws exist. And some of these flaws don’t even require sophisticated hacking to exploit – they’re just sitting ducks, waiting to be found. Unfortunately, that’s the current challenge for Apple.

Apple is usually in the news for their latest innovations and new products, but recently an easily exploitable vulnerability in Mac’s High Sierra Operating System (OS) has made headline news. The security flaw enables a root superuser account without a password, giving attackers full access to all parts of a Mac machine.

The Background: How the MacOS Security Flaw was Detected and How it Works

High Sierra’s “root” bug was first revealed by Turkish software developer Lemi Orhan Ergin‏, who says security staff at his company happened to stumble upon the issue while trying to restore account access for a user. The issue was then made public by Ergin, who demonstrated the flaw in a Tweet to Apple’s tech support account.

The flaw is made possible any time a user encounters a prompt in High Sierra asking for a username and password. This includes logging into a machine with multiple users, installing an application, or changing settings. Users are then able to simply type “root” as a username, leave the password field blank, click “unlock” twice, and immediately gain full administrator access.

In other words, the bug allows any rogue user that gets their hands on a Mac computer to gain the deepest level of access to a computer, known as root privileges. Malware designed to exploit the flaw could also fully install itself deep within the computer, with no password required.

Even worse, is that the flaw can be exploited even when it’s not possible to enter a username at the main MacOS login screen. Users can still take advantage of the flaw via the system preference settings. For example, an attacker could enter the root as the username in the Users and Groups preferences setting, leaving the password field blank, and clicking on the unlock button.

After that, it’s possible for an attacker to wreak havoc on a business network. They can add new accounts with full administrative rights and could also turn off MacOS security features such as FileVault disk encryption, install malware, not to mention the ability to steal, copy or delete data.

Dangerous Access: Why the MacOS Flaw is Especially Scary

News of the security vulnerability spread like wildfire across Twitter and other social media platforms, with many security researchers confirming that they were able to replicate the flaw exploit. Security researchers Patrick Wardle and Amit Serper posted that they had been able to gain unauthorised access by exploiting the root flaw. WIRED also independently confirmed the bug.

What’s terrifying is the fact that the attack could be used on a logged-out account. This raises the possibility that someone with physical access could exploit it just as easily as malware, meaning the threat is both internal and external. Users could, for instance, use the attack to gain root access to a logged-out machine, set a root password, and then regain access to a machine at any time. This means if someone did this to any company machine sitting on a desk, they could come back later and do whatever they wanted.

Wardle explained the external threat as well. He noted the flaw can also be exploited remotely if the target MacOS system has resource sharing services enabled.

“Attempting to log in creates the root account with a blank password,” said Wardle, a security researcher with Synack. “If the root account is disabled, logging in remotely re-enables it.”

This creates a huge threat to MacOS systems and leaves devices vulnerable to potential threats within and outside business organizations.

How to Patch the Flaw: Setting a Root Password to Prevent Unauthorised Access

Unfortunately, despite suggestions that the flaw can be mitigated by disabling the computer’s guest account, this doesn’t work. It simply restarts the computer with Safari as the only application running.

It is possible to mitigate against the flaw, however, by adding a password for the root user. Here are the directions for adding a root password:

• Access the Users and Groups preferences pane.
• Select the Login Options
• Select the Join Network Account Server
• In the dialog box that pops up, click on Open Directory Utility.
• From the tool’s menu bar, select
• Here, you’ll be able to assign and change the password for root privileges.

IMPORTANT NOTE: Simply disabling the root account in the Open Directory utility tool does not work, as the root account becomes re-enabled when entered into the username field upon login

However, the safest fix is to install Apple’s newly released update. About 18 hours after the vulnerability was made public, Apple released a patch for the ‘root privileges’ flaw. If you haven’t yet applied the latest update, you should do so asap. Apple blamed the flaw on a logic error in the validation of account credentials. They improved credential validation strategy with the patch and accepted responsibility for leaving users vulnerable to threat.

“Security is a top priority for every Apple product, and regrettably we stumbled with this release of MacOS,” the company said in a statement. “We greatly regret this error and we apologize to all Mac users, both for releasing the OS with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.” 

Frightening Patterns: MacOS Security Flaws Becoming More Common

“We always see malware trying to escalate privileges and get root access,” says Wardle. “This flaw is the best, easiest way ever to get root, and Apple has handed it to them on a silver platter.”

And unfortunately, the root access bug isn’t an isolated event. The flaw is only the latest in a disturbing series, that has plagued the High Sierra OS. On the day the operating system launched, Wardle determined malicious code running through the software that left data up for grabs. Another reported bug apparently showed the user’s password as a password hint when trying to unlock an encrypted partition on their machine known as an APFS container.

Wardle argues that flaws could be identified and stopped quicker if Apple launched a “bug bounty” for information about security vulnerabilities in its desktop software. Bug bounties are becoming an increasingly popular way for tech companies to proactively mitigate threats and identify system vulnerabilities. Apple already has a bug bounty for iOS, but still nothing for MacOS.

“A bug bounty program is a no-brainer. Maybe this is something that will encourage them to go down that path,” claims Wardle “It’s crazy these kinds of bugs keep blowing up. I don’t know if I should laugh or cry.”

Despite the efficiently released patch from Apple, this latest security flaw should leave Mac users on high alert. Staying in tune with the latest Mac product line is great, but it’s even more important to stay in tune with Mac security updates and potential software flaws. You can only protect your business data if you know the latest threats to combat.

If you have questions about the MacOS security flaw or need a hand making sure you have it patched, reach out to our team of technology experts. Trying to mediate a wide variety of cyber threats can be time-consuming and stressful – sometimes checking in a team of professionals makes all the difference.

Online shopping is something many are becoming increasingly familiar with in the digital age. From Amazon Prime to special online-only sales, anything one could ever want, or need can be bought online. However, an aspect of online shopping that is often overlooked is security. This means being aware of what sites you are visiting as well as what information you are providing. There are several steps that are easy and effective in ensuring online safety that anyone can and should work on implementing into their everyday lives.

Don’t Shop on Public Wi-Fi

Inputting your personal information on any site while on public Wi-Fi or a hot spot is just asking for that information to be stolen. These Wi-Fi spots are not secured and allow anyone access to them. Everyone can see what everyone else is doing, including shopping. You wouldn’t want to type out your Amazon password with a stranger looking over your shoulder, but that’s essentially what you’re doing when on a public network.

You also want to be wary of stores that use Wi-Fi or Bluetooth to track your movements within their stores or websites. This could be another potential avenue for hackers to get into your device and steal your data.

Password protection dos and don’ts

You’ve probably heard this a thousand times before, but protecting passwords is the easiest thing you can do to safeguard your information. You should have a different password for each site or app. Using a password manager can be helpful with this. You also want to make sure that you are changing your passwords on a regular basis, at least every thirty to ninety days.

Unique passwords or sentences as passwords are also a good idea. The more complicated the password is the better. It’s also a good idea not to share your passwords with too many people. Is it really secure if ten people know it?

Virtual account numbers

Virtual account numbers are special cards with a set time and amount to spend, and after they expire the card and money on it are no good. This is a safe alternative to using your debit card online. If someone gets access to your debit card, they have access to your bank account and could end up costing you plenty before the transactions are sorted out.

If you don’t have access to this type of card a standard credit card is still more secure than a debit card. Most credit card companies give you 60 days to report theft, while some banks only give you 2 business days for reporting debit card fraud.

Beware of links in emails and on social media

The days when you could safely click a link on Facebook and buy that new amazing thing safely and securely are gone. Today hackers are using links and attachments to deliver malicious malware and ransomware to your system. It is always best to type in the address to your address bar manually, rather than clicking the link. Always make sure that the site you think you are going to is actually the site you end up on. You can verify that the link is legit by hovering your mouse over it, which will display the address it links to. This way you can see where the link takes you before clicking it.

It doesn’t hurt to follow the old adage, “if it’s too good to be true, it probably is.” So, if that post on Facebook for the $20 iPad seems like too good of a deal, it most likely is. Stick to reputable sites and places you have shopped before. Losing your money to thieves is not worth saving money on a tablet.

Beware of what info is asked for

Would you enter your social security number on Amazon if they suddenly asked you to provide it to make a purchase? Of course not. Be wary of what information the site is asking for. If it seems strange or out of place, it’s probably not legit. Things like name, phone, email, and address are all pretty standard things for a shopping site to ask for. Social security numbers, bank account numbers, or driver’s license number however are not standard practice for shopping online.

You also want to make sure that what the site is doing with your information is legit and that they aren’t selling it or stealing it for themselves. Always know the privacy policy and terms of service, especially when you aren’t sure about the site. Also, make sure that the site is protected and secure before entering any personal information.

Look for the https

When you visit a webpage look for the https in the address. The difference between http and https is how secure the site is. The extra “s” means that the site is secure and safe. It encrypts the message so that only the intended recipient sees the information. If you’re shopping there it should have https in the address bar. If it doesn’t, don’t shop there.

Beware shopping on mobile devices

We all do it. We hit up Amazon or some other shopping app on our phone or tablet because it’s easy and convenient. We like shopping from our couches or chairs without going to the computer. But the potential for identity theft or the theft of your payment information is far greater from a mobile device than the family desktop.

Beware of shortened URLs. It is common to see them on a phone or mobile device, but could also be a trick to get you to click on them. Use the full address and avoid these shortened ones. Another thing to remember is to download a virus protection app for your device. Most devices don’t natively come with one, but the device is just as prone to hackers and malware as your PC. You want to keep them clean and safe, especially if this is your primary means of shopping or browsing.

Understanding how online security works is a valuable skill that can help prevent implications in the future. By being aware of your online presence and who can see your information you can better protect yourself from identity theft or credit card fraud. Implementing these techniques into your online life is easy, simple and could save you a number of headaches in the future.

How to Optimize Compatibility Between Google Chrome and Microsoft Office

Microsoft continues to be at the forefront of business technology optimization. From Windows operating systems to Office 365 and SharePoint platforms, Microsoft has a huge collection of tools and services that help business owners get work done more efficiently.

However, one place Microsoft falls short is with their browser solution. While Internet Explorer was one of the first consumer web-browsers on the market, tech innovation has seen competitors come to market that offers speedier and better functioning alternatives. Undoubtedly, one of the most popular web-browser’s today is Google Chrome.

For Microsoft-loving business owners, using Google Chrome instead of Internet Explorer is an incredibly common scenario. Additionally, there are new strategies available that allow Google’s speedy Chrome browser to be optimized for increased compatibility with Microsoft Office applications.

Office Online: A Browser Extension Designed by Microsoft for Chrome Compatibility

So, let’s assume you’re a Windows loving business. Chances are, even if all your business software is from the Microsoft camp, you and your team definitely prefer Google Chrome over Internet Explorer. We don’t blame you – Chrome it’s quite simply one of the best web-browsers on the market – and it’s definitely head and shoulders above Explorer.

However, you’ve probably noticed that since Chrome is designed by Google, many of the built-in features have a Google bias. For business owners who use a variety of Cloud-based Microsoft Office apps, Google defaults can be a real nuisance.

Luckily, Microsoft has given in and answered the call. Microsoft users who have their heart set on Chrome for web-browsing can now download Microsoft’s Office Online extension for Google Chrome. The Office Online extension allows users to supplement Chrome with an Office-first mandate and streamlines access to all Office documents.

Using Office Online: The Key Ways Microsoft’s Chrome Extension Optimizes Compatibility

With the Office Online extension for Chrome, users can open and create documents using Office Online apps. Without leaving the browser window, users are able to launch new documents or open and view existing documents stored in OneDrive or locally on their machine. Using the extension, users are able to sign into their Microsoft account to open and edit files using all the most familiar Office apps like Word, Excel, and PowerPoint.

Beyond the basics, the Office Online extension also offers a unique drag-and-drop feature. This feature allows users to drag-and-drop files directly from their machine into an open Chrome window, which automatically uploads them to OneDrive. This makes it easier than ever to grab a document from your desktop and seamlessly transport it to the Cloud.

Finally, when a user runs across Office document formats on a web page, such as resumes or academic papers, they will automatically open in Office Online instead of the Chrome file viewer. However, it should be noted that PDF files will continue to open in Chrome’s native viewer.

Sign Me Up: How to Add and Navigate the Office Online Chrome Extension

The Office Online extension can be added to your Chrome browser by accessing and installing it from the Chrome Web Store. It’s incredibly easy to add and once installed the extension will appear as the Office Online logo in the top right-hand corner of the browser window, next to the address bar. Once, installed, click on the logo to sign into the extension using your Microsoft account.

Once signed in, users can click the Office logo at any time to display recent documents. At the top of the extension’s drop-down window, users will find the option to create a new document using Office Online apps. The extension supports all the major Office file types including Word, Excel, PowerPoint, OneNote, and even the latest app from Microsoft, Sway. The extension drop-down menu will also give users the option to open existing documents saved to OneDrive or a local drive.

IMPORTANT NOTE: To take advantage of the drag-and-drop feature, users must manually activate it. Once your Office Online extension is installed, type chrome://extensions into the address bar of your browser window and scroll down until you see the listing for Office Online. To activate the drag-and-drop feature, select the box that says, “Allow access to file URLs”.

Smooth Sailing: Navigating Chrome with the Office Online Extension

Once these steps are complete, users are ready to go. Chrome browsing for business purposes becomes easier than ever and compatibility with business apps is optimized. Depending on the unique needs of every business, this can result in a streamlining of processes, a decrease in wasted time and an increase of resourcefulness among employees.

Somewhere down the line, Microsoft may introduce a browsing solution that rivals Chrome’s popularity. In fact, the new Edge browser in Windows 10 shows some improvement. For now, though, most business owner would agree that the Office Online extension offers a dynamic way to make use of Chrome while avoiding the annoying Google bias.

If you need a hand implementing the Office Online extension for Chrome, use this outline as a guide. If you have questions about Chrome compatibility or Microsoft’s Office Online extension, reach out to a local team of technology professionals. The team of experts at Inspired IT has extensive experience providing Microsoft optimization services in Perth. Get in touch with their experts anytime at (+61) 08 6142 8221.

Recently, headlines have been dominated by reports of broadband users across Australia getting less than they paid for. National Broadband Network (NBN) customers across the country have been experiencing less than stellar broadband speeds. In fact, speeds were far less than promised by Internet Service Providers (ISPs) and far less than customers paid for.

Since the news broke, the Australian Competition and Consumer Commission (ACCC) has come forward to warn retail ISPs like Optus and TPG. Head of the consumer watchdog organization, Rod Sims, has urged internet providers to implement refunds for overcharged customers and claims they face potential litigation if not.

Understanding the Problem: Telstra First Identifies Over-Charge Issue in Late Spring 2017

In short, certain telcos across Australia have been accused of knowingly selling broadband packages to customers using fibre-to-the-node (FTTN) NBN connections, that we’re simply incapable of offering any top-tier bandwidth speeds over 50 Mbps.

Leading ISP, Telstra first went public in May, announcing that it was aware of customer overcharges and would start a process to identify, contact and refund eligible customers. Following suit, ISP Optus claimed that they too would undertake the same process. However, ACCC head Rod Sims claims that while Optus made an effort publicly to right the wrong, they’ve offered limited plans for action since.

“We are pleased that Telstra proactively reported this serious problem to the ACCC and has co-operated in creating a remediation plan for affected customers,” said Sims.

“Optus were more engaging publicly than they were with us,” added Sims. “They were saying things in public about what they will do, but the ACCC will start engaging directly with them right now. I think most of the other ISPs are in a similar position but you think given those statements, Optus should have no problem providing a similar undertaking [to Telstra].”

Most of the customers eligible for a refund will likely be connected to the NBN via the most common fibre-to-the-node connection (FTTN). FTTN connections help to provide broadband connection and other data services through a common network box, which is often called a node.

Who’s to Blame? Understanding How Australian Telco’s Obtain Broadband Capacity from NBN Co.

The failed promises on broadband speeds have left many customers wondering who their disappointment and anger should be directed at. While they purchased broadband packages from ISP’s like Telstra and Optus, fingers were initially pointed at the National Broadband Network Corporation for failing to provide adequate speed to providers.

However, to better understand the problem and ensure blame games don’t cloud the issue, let’s explore the process for how Australian ISPs purchase broadband capacity from NBN and what that means for consumers.

• NBN Co. is the company responsible for building and implementing a wholesale broadband network to service the entire country.
• Retail ISPs like Telstra and Optus are required to purchase necessary amounts of bandwidth from NBN to adequately serve their customers.
• Retail ISPs are required to purchase enough NBN bandwidth to match the service agreements and promised download speeds they offer to customers.
• When promises of lightning-fast download speeds are made, but an ISP hasn’t bought enough NBN capacity to support it, the service package simply will not live up to the hype.
• Simply put, NBN serves as the on-ramp and various Internet Service Providers are the highways.

Solving the Problem: Putting Activation Processes in Place to Avoid Future Rip-Offs

Widespread warnings to ISPs by the ACCC come in response to Telstra’s submission to the consumer watchdog, outlining how it will provide refunds or special offers to roughly 42,000 customers who over-paid for unattainable speeds on their NBN service.

With Telstra setting the bar high, Sim’s claims that remaining Australian ISPs should follow suit quickly if they want to avoid direct legal action.

“We’ve been warning [ISPs] for some time that we were concerned about this kind of behaviour,” said Sims. “Now that we’ve got this undertaking from Telstra, we’ll be approaching most other ISPs to say we’d like an undertaking in similar terms and if we don’t get it, there’s a very real chance there will be litigation to follow.”

In part of Telstra’s submission to the ACCC, the ISP said from now on, when connecting new customers, hard-line policies will be in place to test the connection and ensure end-users can reach and maintain the download speeds they paid for. If the test fails, Telstra will know right away that something must be remedied.

Ending the Blame Game: Getting to The Bottom of Broadband Speed Issues to Protect Consumers

Sims and the ACC claim that Telstra’s new policy will be a critical force in ending the blame-game between NBN Co. and the various ISP’s across Australia.

“For example,” says Sims. “If you can’t get 25 Mbps download speeds on your service, you’ll be almost certain it’s because the retailer didn’t buy enough capacity. Fibre-to-the-node has difficulty supporting 100 Mbps or even 50 Mbps. But 98% of the time, it can support speeds of 25 Mbps.”

“So it will become very likely that if you’re on a connection speed of 25 Mbps – even if its fibre-to-the-node – if you’re having problems it’s very likely your retailer hasn’t bought enough capacity from the NBN.”

With Telstra leading the charge, the ACCC is strongly urging other Australian ISPs to be transparent, identify customers eligible for a refund and get policies in place for remedying the issue. As mentioned, without swift and deliberate action on the part of all relevant ISPs, retailers could leave themselves open to litigation, not to mention damaged reputations.

For Australian broadband consumers, voicing your dissatisfaction is critical. If you’ve recently purchased a broadband package from any of Australia’s Internet Service Providers, make sure that your connection and download speeds have been living up to what you paid for. If you’ve experienced less-than-promised speeds, you should contact your service provider directly and ask them what’s being done to remedy the bandwidth issue.

Consumers have rights. In an increasingly technology-driven consumer landscape, it’s critical that these rights are protected and that customers are getting exactly what they paid for.

If you’re confused by the technical jargon or would just like an expert’s perspective on the issue, reach out to a local technology firm for consultation and guidance. Technology should make your life easier – it should never rip you off.

Construction companies, be they large or small, have some unique aspects of their business that make them a different kind of business from others that rely on a managed service provider.  With programs like CAD, construction project planning and procurement of materials are unique to that industry and would require an MSP that is dedicated to the construction industry.

Construction companies do use typical IT software and hardware for standard office tasks and accounting functionality.  What really sets this industry apart, however, is how collaborative it is.  Workflow does follow traditional paths such as design, construction, and testing.  There is also a role played by industry compliance and security in all aspects of the industry.

But success is dependent on collaboration between architects, engineers and the actual foremen and workers at the on-site level.  An MSP must be able to manage this team and collaboration in real time.  This is why many larger construction companies use an internal IT team rather than outsourcing to an MSP that isn’t fluent in CAD or certain planning software.

When it comes to construction companies, not all MSP’s are created equal.  You need one that can specialize in the construction industry and has your best interests at heart.  Some things to look for are:

• Access to highly trained and specialized staff.
• Supporting the technologies that run your critical core applications such as estimating, accounting, project management, document management and scale management.
• Extensive experience with supporting software such as Sage, JD Edwards, Quickbooks and Autocad Solutions.
• An MSP that provides Mobile Device Management (MDM) and remote access solutions that allow your team to have access to anything, anytime and from anywhere.
• Affordable and comprehensive services, such as standard IT solutions, to go along with the specialized services.

Any good MSP will do a few basic things for every type of industry, but these things are just as important to the construction industry as any other industry.  You want one that will be available when you need them as well as one who is up-to-date with current technology.  Hiring an outside IT company will save you money.  Having IT in-house means paying them a salary and possible benefits and 401k.  Hiring an outside company negates the salary and 401k, which becomes the problem of their company not yours.

The MSP will perform monthly updates and preventative maintenance, keeping your software and hardware running at peak efficiency, cutting down the probability of failure at critical times.  When the system is running efficiently and smoothly, that equals peace of mind and best of all, profits.

By using a third-party IT provider, you are more likely to stay ahead of new cyber threats and viruses.  An MSP makes it their business to stay up to date on new cyber threats and hackers so that they can keep your business ahead of these threats and running smooth.  Should something get through or hardware breaks down, you have an experienced and dedicated team you can call to fix the problem.  Most MSP’s are available 24/7.

The MSP can run an analysis of your IT environment to prevent issues such as having to add equipment and up the budget given.  This also serves to give your business a deliverable, comprehensive executive summary of your company.  The summary shows any vulnerability in your system as well as the pros and cons of your current network.  It will also give you the MSP’s recommendations for any adjustments to your current technology.

Never one to rest on their laurels, tech giant Google started a project that could revolutionize the construction industry.  Beginning as a project for Google X it has spun off into its own company, Flux.io.  Essentially a cloud-based platform, Flux is a collaborative platform that allows architects and construction engineers to work together in real time on a project.  It sports an advanced analytic engine and state of the art simulators.

With the ability to translate data from multiple programs such as Excel, ACAD, and Rhino into a single platform, various collaborators could work simultaneously rather than one at a time.  All computations are done in the cloud, so no worries that your system will slow down or cause it to freeze.  Flux.io is touting that it will save 30% to 50% in manufacturing and construction costs.  Overall, Flow has the potential to save the construction industry over $120 billion a year.

As technology gets better and new software makes the collaboration process more streamlined and easier to communicate with members of your team, the need for dedicated IT grows even bigger.  Whatever IT service provider that you choose to go with, make sure to get the system analysis to check for any vulnerability in your network.  The MSP will be able to tell you what is essential and what isn’t while saving you money.

Whether in business, at home or out at play we are connected to the internet all day, all the time.  

We check our smartphones every five seconds.  As a business, it’s much of the same thing.  We are connected with the office, with clients, and with vendors.  You might store your important data on the cloud such as client information and employee records.

Even your devices are now potential targets.  A hacker could try and get into your smartphone and steal from your Apple Pay.  Any device connected to the internet now could be a target:  smartphone, tablet, Fitbit, or even your cars are all targets for cyber attacks.

RANSOMWARE

An email can be all a hacker needs to take over your system.  Ransomware has been a popular means of getting into your network or computer and restricting access to files then making you pay to get them back.  The “Locky” version of ransomware has been in the news as recently as early August 2017.  Users are tricked into opening attachments such as DOCX, PDF, ZIP and JPG files.  The attachment is really hiding the ransomware virus that immediately infects your system and hijacks files with a specific extension.

It changes the file names to a specific 16 letter and number combination file name with the “locky” file extension.  Users get instructions to download a torrent browser where they must go to a site on the dark web.  Here the hacker agrees to give the files back for money, usually up to one bitcoin (over $4,000).

ELECTRONIC MEDICAL RECORDS & DEVICES

Another real cyber threat pertains to the Healthcare industry.  Electronic medical records (EMR) and smart medical devices are new technology that is at high risk for cyber attacks.  According to Health IT News and HIMSS Analytics, 75% of hospitals surveyed have been or could have been hit by a ransomware attack.  As the Healthcare industry adjusts to the benefits of having data online and at their fingertips, it comes with inherent challenges as well.

Connecting more devices to hospital networks can make the sensitive data more vulnerable than ever.  Patient medical records contain such a wide range of information that they have become enticing to hackers.  While the industry continues to get a handle on protecting such data, hackers will continue to exploit this.

Another real threat is devices that are attached to patients.  Anything that uses Wi-Fi or Bluetooth could be vulnerable to hacker attacks.  A hacker could change a patient’s insulin dose, send electrical signals to a patient or alter important monitoring data.  Many devices in the Healthcare field have little to no monitoring that will continue to be a problem.  And with much of it being regulated by the Food & Drug Administration (FDA), patching the software could be a lengthy process.

THIRD PARTY

Another increasingly common hacker attack victim is a third-party such as vendors and contractors.  Securing important business data through a reliable MSP gives you peace of mind that you are doing everything you can to protect your business.  But what about that construction foreman and his smartphone, or that vendor that has you sign for things on an iPad?  Anyone of these could be vulnerable to a cyber attack and not even know it.

Hackers in 2013 stole the information of 110 million Target customers after exploiting a vulnerability in the chain’s refrigeration vendor.  Similarly, Wendy’s was the victim of a cyber attack in 2015 when a third-party vendor was hacked, resulting in 1,025 Wendy’s locations being affected.  Third-party vendors and contractors are a normal part of a modern business that is unlikely to go away, and as business becomes more reliant on them, then there needs to be more accountability across third-party vendors.

MOBILE PAYMENTS

How many of us use our phones to pay for stuff?  It is so easy now to pay using Apple Pay, Samsung Pay, MasterPass, Wal-Mart Pay and more.  This is a new frontier for hackers who work to find a way to crack into this form of payment. The number of companies offering these RFID (radio frequency identification) and NFC (near field communication) mobile payment platforms is increasing every day.

Some common ways hackers could try and gain access to your mobile payment information could be:

Man in the Middle Attacks – A third-party disrupts the connection between the customer and the merchant.  This is usually another app trying to pose as the actual payment app.

Data Breaches – The merchant’s customer database is hacked and all the customer information is stolen.  This data can then be used for identity theft or other malicious attacks.

Loss or Theft of Your Device – Your device is lost or stolen.  Your payment information, as well as other data, is found by an unsavory character.  This can result in the thief using your payment information for malicious purposes.  They could also sell your data on the dark web.

If a hacker could gain access to this form of payment, imagine how much they could get from payment information to financial details.  Plus, once they have hacked into your payment app, the next logical step is getting into your phone. For some, that’s game over.

Working globally has never been easier, even for small and mid-size businesses.  Find out how to make Microsoft 365’s Multi-Geo capabilities work for you.

Amazon doesn’t want you or your business to call a number, provide a code, and verify your identity, and if you receive an email claiming that they do, you’re the target of a phishing scam. A phishing scam occurs when someone uses what might seem like legitimate phone calls or emails to get you — or someone in your organisation — to respond with sensitive information.  If the scammer can trick you out of usernames, passwords or identifying information, they can engage in hacking, identity theft, and other cyber crimes.

The Risks of the Amazon Phishing Scam
The recent Amazon phishing scam, which is reaching in-boxes in October 2017, is a prime example of a common fear tactic scammers user to target individuals and businesses.  The email warns you that someone tried to reset your password and asks you to call a number and provide a code when speaking to the customer service rep.  The number routes you to a non-Amazon call centre where operators attempt to get you to provide information regarding your Amazon log-in.

Many businesses and individuals keep their payment card information stored on Amazon’s servers — along with data such as names, addresses, and phone numbers.  It’s convenient and makes it easy to order things quickly; SMBs might load a single payment card into the system and allow numerous people to purchase supplies via the account, for example.  If your Amazon account is breached, that means all that data is breached too.  It also means that hackers can use that information to potentially breach other accounts or your business network.

One of the dangers of the Amazon phishing email is that it looks quite authentic.  It includes Amazon’s logo, and it’s well written and sounds authoritative.  It even includes a short warning paragraph about phishing emails and tells you that Amazon won’t ever ask you to email your password to them.  It’s so legitimate looking, many people have fallen for it already.

If your company uses cookies or password storage software, then consider including multiple forms of authentication on machine and network log-in screens
By engaging in proactive cyber security, you can reduce the risks your business faces from phishing scams.

Other Types of Phishing Schemes & How to Combat Them

The ability to pass as legitimate, even under some basic scrutiny, is making these types of phishing schemes more dangerous.  These schemes have targeted people with emails or phone calls from agencies such as the IRS, numerous banks, various online retailers, and sites such as PayPal.  One of the common threads that are seen through phishing emails and calls is that they play on anxieties, worries, and fears consumers and businesses already have.  Today, many people are already worried that their accounts may be hacked. They’re already worried their money isn’t safe.  Businesses have to deal with potential cyber attacks and threats every day.  When you receive a seemingly legitimate email regarding a danger, your immediate reaction may be to jump into damage control.  Before you do anything, though, take a few minutes to do some research and consider the communication.

Conduct a quick Google search.  In just a few minutes, you can see if anyone else is receiving these communications and if a known scam has been reported.

Look at the email address source.  Some elaborate spoofs look like they originate from the internal network of the company in question, but some fakes are easier to spot.  For example, an email that looks like [email protected] didn’t come from PayPal.

Hover over any links in the email without clicking on them to preview them.  Do they go back to the agency in question, or a spoofed site?  It’s best not to click on links in these emails at all; you can always navigate to the site via your browser bar.

Call the agency’s customer service number (the one from their web page, not the one in the email) to find out if the email is legitimate.

Protecting Your Business Against Phishing Scams

Procedure and training are two of the best ways to protect your business from damage associated with phishing scams.  First, create a procedure for responding to any of these types of emails.  Put someone, such as internal IT staff or an administrative assistant, in charge of receiving reports of these emails or phone calls and doing the research to determine what type of response is needed.  That person will begin to recognise phishing scams and may even see the same ones repeatedly, and they can assure other staff that there is no real threat and no response required.

You should also train your entire staff on good password and security protocol.  Requiring staff to change passwords every 60 to 90 days across all sites, platforms, and tools help reduce the chance that a successful phish endangers all of your accounts or networks.  Some tips for strong password management include:

• Don’t use the same password for multiple platforms, sites, and tools
• Don’t use words or easy strings of text or numbers (such as ABC or 123) in passwords
• Passwords should be at least 8 characters — longer passwords are better than shorter passwords
• Passwords should incorporate letters, numbers, and symbols when possible
• Workers should not share passwords or write them down

If your company uses cookies or password storage software, then consider including multiple forms of authentication on machine and network log-in screens

By engaging in proactive cybersecurity, you can reduce the risks your business faces from phishing scams.

As if the threat of a data breach isn’t bad enough, Australian business owners now need to be aware of enhanced legislation around notifications in the event of a data breach.

Data breaches are a serious threat to businesses throughout the world, but Australia has lagged behind states in the U.S. and other parts of the world when it comes to data breach notification laws.  However, that time is coming to an end, as the Australian Senate passed February’s Privacy Amendment Bill.  This Notifiable Data Breaches Bill will go into effect 22 February 2018 and has the potential to dramatically change what a business is required to do in the event of a data breach.  This bill has been quite a while in the making, as several false starts in 2013 and 2014 ultimately ended without bringing an updated legislation to fruition.  See the impact on your organisation and how you can prepare for this new regulation before it takes full effect.

Damages from a Data Breach

The damages caused by a significant data breach can be far-ranging:  both for the organization that suffered the breach as well as for the individuals whose personal data was impacted. Cybercriminals are always looking for new and creative ways to make money by leveraging the PII, or Personally Identifiable Information, of individuals.  However, the largest damage done is often to the business from which the data was stolen, as the business can be impacted by negative press, massive drops in consumer confidence and additional remediation costs such as attorney fees and notification fees.  These serious damages include public scrutiny, especially from vendor partners or investors, as well as the need to spend considerable time, effort and energy reviewing current security procedures and looking for changes that can be made that will add to the overall security of the business in the future.  On top of all of the upheaval, it’s not unusual for a business who suffered a data breach to lose up to 20 percent of their overall client base in the near term as a byproduct of reduced consumer confidence.

Barriers to Security

Chief Security Officers are quick to note that there are significant challenges associated with maintaining adequate security postures.  Increasingly complex systems with a great deal of interoperability can cause integration teams to take shortcuts with security, such as not applying patches quickly due to the concern about potential system outages.  Another oft-cited difficulty is keeping the number of security protocols under control.  More is not always better, especially when it comes to the number of security products in play.  When there are a dozen or more unique platforms, you’re leaving significant room within the infrastructure for gaps and mistakes. The speed that business leaders require may allow systems to be launched without adequate hardening, or abandoned without being fully depreciated and disconnected from all other systems.

Malware and Ransomware

With the extensive complexities in systems that are all targeted towards preventing cyber attacks, hackers are going back to the classic attacks that have worked for years, such as malware and spammy email links.  These simple yet highly-effective attacks are dependent upon convincing a well-meaning employee to click a link, open a file or take another action that provides either damage to the account or access to the network for hackers.  There is not always a need for cybercriminals to craft a sophisticated attack when a basic click-ad that launches malware will do the job of getting them into the system just fine!  Security protocols on the technology side can be supplemented by extensive training on the business side of the house, as knowledge and awareness are shown to be the most effective ways of combating these types of attacks.

What Constitutes a Data Breach

The updated legislation defines a data breach as a situation where:

• Unauthorized access to the personal information of one or more individuals has been obtained by cybercriminals
• There is a strong likelihood that the information obtained can be used in a detrimental way
• Individuals who are affected by the breached information are likely to incur serious physical, psychological, financial or other harm as a result of the disclosure

Information that is considered personal includes such items as tax file numbers, personal health data, and credit information.

Actions to Take in the Event of a Breach

Should your organization be the target of a data breach, there are actions that you should be prepared to take immediately, such as the new compulsory regulatory notification.  The Office of the Australian Information Commissioner (OAIC) requires that notification is made “as soon as practicable after the entity is aware that there are reasonable grounds to believe that there has been an eligible data breach” — an important change from previous notification requirements. Previously, organizations were encouraged, but not required, to take this step, but failed to notify the proper authorities now carries a stiff penalty.  This is particularly onerous as the legislation requires that notification is completed if even a single record is compromised.  With fines starting at $360,000 for individuals and $1.8 million for organizations, this isn’t a requirement that can be taken lightly.

The cost of data breaches and the high potential for loss, it’s more important than ever that businesses look for ways to enhance cybersecurity.  Want to learn more about how your organisation can improve security measures?

Want to learn more about how your organisation can improve security measures?

Contact us and speak to a security professional today and determine if there are remediation measures that you can take immediately to support your current security posture.

Small to mid-size businesses around the country are considering how to maintain data security in the aftermath of one of the largest data breaches in history at Equifax.  How can you ensure that your business has critical patches covered while still staying focused on operational effectiveness?

Recent national news regarding big data breaches in organizations such as Equifax has small business owners scrambling to understand what went wrong — and how it can be prevented at their organization. The reality is that the potential of a data breach can’t be eliminated completely from your organization, but there are plenty of ways you can minimize the threat and make plans to come back up to full speed quickly after a breach.  Possibly the worst thing that you can do is start looking around in all directions in the hopes of shoring up your defenses. See how data security can become part of your ongoing strategic technology planning so you can skip the scramble.

Small Business Impact

Small businesses are every bit as vulnerable as enterprise-scale businesses to hack or data breaches, and sometimes even more vulnerable.  The thought of having the personal and financial data of 143 million Americans stolen is enough to cause any business owner to get a bad case of the hives.  Equifax’s security was violated due to the failure to correctly install a software patch, something that many small business owners can relate to as their internal IT departments are increasingly stretched in a variety of different directions.  Installing patches and keeping software up-to-date is one of the first lines of defense for organizations attempting to reduce the possibility of a cybersecurity attack.

Dealing with Long-Delayed Issues

Many business owners find that there are hidden pockets of issues that could be exploited by cybercriminals, such as that one workstation that didn’t get updated from Windows XP or a proprietary platform that kept system administrators from applying a Windows patch, for instance.  These risks may not seem significant by themselves, but allowing them to continue simply compounds the issues facing security professionals.  Small businesses rarely have access to the same level of technical support as a larger enterprise, leading them to lag behind in both learning and application of ever-changing security principles.  Unfortunately, this doesn’t stop cybercriminals from targeting small businesses — a recent Verizon survey indicated that more than 60 percent of the breaches that occurred in 2016 happened in organizations with fewer than 1,000 employees.

Split Priorities

Staying focused on patching potential security breaches is challenging with IT departments in a constant state of damage control due to user needs and other ongoing, operational issues.  This split priority provides the ideal breeding ground for security problems in businesses of any size. When there are not enough staff hours available to focus on creating a truly secure infrastructure and data privacy policies — along with ongoing training for business users and technology teams alike — businesses can find themselves in trouble.  When IT teams shift their focus to security for the near term, they are often able to catch up on critical patches but will take heat from internal business units and leaders who feel that the technology team isn’t pushing forward critical business initiatives.  It’s literally a lose-lose situation for understaffed mid-size business technology teams.

Dangerous Endpoints

Nearly everything today is an endpoint for your network:  cell phones, laptops, tablets and WiFi hotspots are all crucial parts of your network as well as being at risk of infiltration by nefarious parties.  While security concerns around these items are nothing new, the complexity of ensuring that you grant appropriate access to individual devices is growing as BYOD (Bring Your Own Device) becomes a more widely accepted practice.  Endpoint security solutions continue to morph and grow, with a great deal of misconceptions and misunderstandings surrounding best practices.  Any smartphone that can attach to your corporate network is essentially an endpoint, and must be secured — and that is true for VPN access from unsecured devices as well.  The true danger of endpoints is not necessarily the technology; instead, the problem often lies in the lack of training, policies, and procedures being followed by business users.  Simple antivirus and anti-malware protection are no longer enough.

Ongoing Training

Training around endpoints isn’t the only required training for business users.  Every employee in the organization needs to be explicitly shown the dangers of clicking on links in questionable emails or online and how these actions can open the organization up to malicious actions.  This proactive security training has been shown to reduce the risk of malware and ransomware being introduced by employees or contractors — which is important as phishing attacks are often launched on internal assets in an effort to get business people to click on a link or provide personal information.  Simulated phishing attacks run within the organization may not get your technical team any popular votes, but they are incredibly effective in demonstrating how truly legitimate attacks can look in today’s world.

Backup and Disaster Recovery

Having a proactive training and patching plan in place are solid first steps, but a truly holistic strategy includes backup and disaster recovery plans that you can trigger instantly in the event of an attack or physical harm to your location such as fire or flood.  As Equifax has shown us, even the largest enterprise organizations can be caught off-guard and make decisions that later come into question during an emergency stop-gap situation.  Having a backup and disaster recovery plan in place can allow your business to quickly react to a negative situation, minimizing the impact to customers and employees alike.

Ready to learn more about protecting your {city} organization from cyber attacks?  Contact {company} today at {phone} or via email to {email}.  Our cybersecurity team will walk through your current data security plans and see where we can make adjustments to shore up your overall security strategies.