There are viruses that can be implanted on a computer in 2017, and lie in wait until a network becomes vulnerable before attacking. Unfortunately, viruses have come a long way from 20 years ago. The term virus was coined early on in computer history, but it’s every bit as relevant today as it was then. Just like biological viruses adapt to Purell and antibiotics, so too have viruses learned to adapt to new security measures.

Brain in 1986

Brain was the first reported computer virus on DOS, and was announced in January of 1986. It spread via floppy disk, and spawned generations of hackers with its ability to move from computer to computer. Brain appeared to be little more than a prank (courtesy of two developers in Pakistan), a joke in which the hackers actually revealed their real location in the text of the virus. Because the virus did little to harm people’s data or machines, it often went entirely unnoticed by users.

The Evolution

Today we refer to viruses as a specific kind of malware, one that can self-replicate and continue its destructive path indefinitely. While Brain may be one of the famous early viruses because it came about when computers were experiencing more ubiquity, self-replicating programs date back to the 1940s. Programs in the early days might slow down processing time, taunt users with cryptic messages, or severely impact performance. Once Brain was no longer a news items, new forms started to pop up. The ones that followed famously infected files from Yale University, destroyed files in Jerusalem, and exploited computers that were known to have buffering vulnerabilities. Viruses could be the product of hackers, or sometimes of legitimate company’s software.

Viruses Today

Viruses have gotten faster and more efficient to make them a force to be feared. They can delete photos, files and entire storage libraries. They’re developed to target Word, Outlook, Windows OS, Mac OS — nothing is safe. They can be designed to affect Facebook or Twitter users, or programmed to steal credit card information straight for the source. Hackers may be out for pure destruction or chaos, or potentially for ransom. The more the average person understands them, the faster hackers create new tricks to get in. Viruses can come in the form of a pop up, an email from a coworker, or a completely undetectable program that waits until the time is right.

Protection for Everyone

The physical world will never provide total safety, and the same holds true for the virtual world. But there are preventative measures you can take to safeguard your company from viruses that go beyond anti-malware and perimeter protections. Security needs to have layers to fend off the intelligent viruses of 2017.

{company} is the trusted choice when it comes to staying ahead of the latest virus developments and can provide you with tips, tricks and news. Contact us at {phone} or send us an email at {email} for more information.

Why Lenovo is telling users to remove an application because of a dangerous loophole.

Lenovo has been urging its users to remove one of its applications after the discovery of a serious vulnerability. Let’s look at the definition of the vulnerability and what it does and how it works. Here’s why Lenovo is advising users to remove a certain application.

The Security Flaw in Question

The Chinese Multinational Technology Company discovered a serious RCE vulnerability in Lenovo, which resulted in a publication of a security advisory covering the flaw. The flaw identified was found in the Lenovo Accelerator Application software, which made it possible to exploit a user with “man-in-the-middle” tactics.

The reasons why the Accelerator application is used is because it speeds up Lenovo applications for launch. This application is installed on some desktops and notebooks using the Windows 10 operating system, but it does not affect ThinkStation or ThinkPad devices since it was never installed on these products.

Why Man-in-the-Middle Attacks Are an Issue

A man-in-the-middle attack can pose a serious threat to anyone who values his personal information. These attacks often occur on vulnerable web browsers with an infected server or a malware variant (on an infected machine) that has surveillance capabilities. Man-in-the-middle attack campaigns are utilized on an individual to steal and intercept personal information, financial data and their login credentials. Sadly, many users don’t even realize that they’re being attacked until it’s too late.

How to Avoid a Man-in-the-Middle Attack

A good way to avoid a man-in-the-middle attack is to look into the programs pre-installed on your computer after you initially purchased the machine. Many computers (whether desktop or laptop) come with installed “bloatware,” which are programs that claim to add value but actually do little when helping a computer initially boot up.

Free software trials, vendor support, applications or vendor hardware — and many more — all add a shortcut that launches your browser to a specific website. The end result is that these shortcuts leave opportunities for hackers, so removing the links may be the best way to prevent an attack.

It’s important for a business to understand the applications and programs it works with. {company} is the trusted choice when it comes to staying ahead of the latest information technology tips, tricks and news. Contact us at {phone} or send us an email at {email} for more information.

Malware can affect anyone and everyone – no matter what continent you hail from.

This was made clear earlier this spring when security officials in Australia and New Zealand began spreading the word about a malware attack taking place through Android devices that tried to convince phone owners that it was official information from one of 20 banks in the region.

When the user logged in with their normal credentials through what they thought was their legitimate mobile banking app, they allowed cyber criminals to not only see their personal information but access their financial data.

Though potentially millions of online banking customers were affected, the attack was called minor in the greater global security picture. Follow-up surveys indicated that many Aussies received the message and began to be more aware of malware, the importance of being careful what apps are downloaded, the risks of unlicensed software and being suspicious of online communications from their banks.

The same Android malware also was observed to take the form of other regularly visited sites, including eBay.

However, in June, the malware activity continued for Aussies and Kiwis, when new warnings went out to both countries about a new piece of malware called “Zero-day” which takes the form of a Windows Office document that is emailed to users of Office 365 via Outlook.

It appears to be an invoice, but when users try to open it, they’re informed that an earlier version of Office is required. However, they are provided with a button to click to enable the “older” content, but it actually activates something called ransomware. They’ll receive a message that their files and even their operating system will be locked, or at least heavily encrypted and not able to be accessed until they pay a certain amount of money.

This type of malware is becoming increasingly popular, especially since users are often so scared they pay quickly – although it’s never guaranteed that the ransomers will actually keep their word and unlock the files. In some cases, they may even re-contact people who have paid them and try to create opportunities for future ransom actions.

While security experts suggest strong preventative measures to keep your systems from getting to this point, especially cautious with any unknown files, there are remedies that can be tried if you believe you’ve become ensnared by malware, especially the ransomware variety. You can try to close the document, and then delete the email and any suspect files. You can also try restoring a locked system from a back-up, perhaps even from an off-line machine. (You do back up, don’t you?)

In a corporate environment, with multiple employees, workstations, mobile devices and networks, security is even more critical.

Anti-virus and anti-malware programmes continue to evolve to combat new threats, and Microsoft also has been looking for ways to block or disable malicious document macros. Office users are also encouraged to update their security settings when possible.

However, one of the biggest defences Australian companies can focus on is better security practices, which comes through training employees what looks good and what looks suspicious.

Companies can come up with clear policies on downloading software, opening emails, and even accessing hardware, such as an unknown thumb drive. Australian employees that use mobile devices for work can take extra precautions such as making sure they’re always secure, and that only licensed and approved apps are permitted.

{company} is the trusted choice when it comes to staying ahead of the latest information technology tips, tricks, and news. Contact us at {phone} or send us an email at {email} for more information.

The Project Zero team at Google looks for defects in various software products. A researcher named Tavis Ormandy takes part in this effort. He recently identified serious security weaknesses in an assortment of Symantec and Norton utilities. The company quickly corrected these vulnerabilities after he reported them.

Problems

Ormandy has found security flaws in antivirus programs from several developers, such as McAfee and Trend Micro. Nonetheless, he was particularly critical of Symantec. The researcher noted that its utilities allowed links and files to infect PCs even if users didn’t open them. This made computers especially vulnerable to “worm” viruses.

He went on to accuse Symantec of failing to adequately examine its software for weaknesses. Ormandy pointed out that the company used open-source code that wasn’t updated for seven years. Back in 2014, a vice president at Symantec termed antivirus utilities “dead” and called them “no longer… a money-maker in any way.”

Repairs

The above-mentioned quote might explain why some security companies need help from other organizations to secure their software. Google’s researcher developed an exploit that fixed the problems in affected Symantec and Norton products. Ormandy described it as “100 percent reliable.” Users can activate it via the Web or email.

The fix patches vulnerabilities in Symantec Endpoint, Norton Antivirus and various other utilities. It works on Windows and Macintosh systems. In some cases, administrators may need to activate updates before the problem is corrected. The good news is that most of these programs install patches automatically.

Prevention

This situation highlights an important fact: Antivirus software doesn’t always succeed in protecting your PC. When programming flaws exist, it could even create additional risks. Businesses may maximize security by taking steps to completely avoid viruses. They can accomplish this by regularly installing software updates and securing any Wi-Fi networks.

• Prohibit unnecessary activities
• Promote virus and phishing awareness
• Password-protect wireless Internet

When employees needlessly use torrents, instant messaging or social media, they put the entire office at risk. Businesses may minimize such problems by configuring firewalls to block unnecessary ports. They can also establish clear policies regarding appropriate use of the Internet.

“Phishing” attacks often compromise passwords and other credentials, making it possible for criminals to hack into company systems. Staff members need training to avoid this type of deception. TechTarget notes that numerous phishing attacks may be prevented if employees simply never click on email, blog or chat links.

Criminals can more easily gain access to passwords when they learn specific details about important staff members. Hackers might trick these individuals with personalized “spear phishing” campaigns. Companies should discourage key employees from sharing too much information about themselves on public webpages, such as blogs and personal websites.

Downloads

Malware frequently infects business computers when staff members use software from little-known developers. Companies ought to create policies that only permit employees to download and install vital programs. Such applications should always come from reputable software firms via major websites or professionally manufactured CDs.

Employees must know the signs of a malware infection. When all websites load slowly or programs repeatedly malfunction, they should report the problem to IT personnel and avoid entering sensitive data. It’s crucial to inspect a potentially infected computer and take action as soon as possible. Otherwise, malware could steal passwords and inflict much greater harm.

It’s not realistic to believe that you can successfully prevent or remove every virus. Regular backups will make it feasible to eliminate any malware by reinstalling the operating system and safely restoring data. Businesses depend on {company} to keep them up-to-date on today’s IT news and tips. Please dial {phone} or contact {email} for further details.

The ecosystem of Apple’s Mac OS has long been heralded as a safe haven from the world of digital threats, and while its users were never immune to common phishing scams, they were largely in the clear from infiltration by most malware.

In reality, the supposed invulnerability in Macs had less to do with anything unique about their software than their relative rarity on the market. When hackers or malware experts seek to infect computers and allow their code to spread from machine to machine, they focus their efforts on the operating systems with the widest reach. In the early 2000s, when Apple put renewed vigor into their marketing and advertising campaigns, their computers had such a fractionally small percentage of worldwide market share that they simply weren’t an attractive target. Even today, with all the emphasis on Microsoft losing market share to Apple, 2016 data still indicates that Apple has sold only 7.4 percent of the computers in 2016. As such, they historically haven’t been an especially lucrative target for hackers and are still a bit away from the mainstream.

Recently, that immunity may have begun changing as a new bit of malware was discovered. Named “Backdoor.MAC.Eleanor,” it’s installed while hidden within the seemingly innocuous Easy Doc Converter program that helps change Microsoft Office documents into other file formats. While it’s not uncommon for friendly software to have an unannounced stowaway, this file converter is available through otherwise reputable sites, allowing its creators to prey on unsuspecting individuals who let their guard down while browsing.

Once installed, Eleanor exploits a tool called “wacaw,” which grants access to the computer’s webcam, allowing it to capture images and videos of users and their surroundings without their knowledge. What the hackers plan to do with these images is largely unknown. But it’s safe to assume that the results would be similar to other blackmail-esque ransomeware scams, in which the hackers wait for a compromising photo to be taken and threaten to release it — or other private information — in exchange for money.

While this isn’t the first time Mac users have been exposed to potential threats, the relative simplicity of this sort of exploit is what makes it so effective. Rather than scanning drives or logging keyboard entries for financial information, the real danger here is in what the camera captures. While many computer owners have opted to proactively cover their camera when not in use, those with Apple’s Gatekeeper security package should remain unscathed as well, as the file converter program doesn’t possess a digitally signed certificate from Apple.

{company} is the trusted choice when it comes to staying ahead of the latest information technology tips, tricks and news. Contact us at {phone} or send us an email at {email} for more information.

Satana Demands Payout and Warns Against Recovery Attempts

With ransomware attacks making headlines nearly every day in 2016, it seems that IT security professionals and the cybercriminals that try to outsmart them are in a constant battle for lead position—and lately, it seems that the cybercriminals are winning.

Recently, yet another strain of ransomware was discovered in its early sample form. Satana, (“Satan” in Italian) is a Trojan that encrypts files and corrupts the Windows’ Master Boot Record (MBR), which halts the Windows boot process and injects its own code into the MBR. Unlike sister-malware Petya which relies on help from tagalong Trojan Mischa, Satana doesn’t mess around with the Master File Table (MFT), it goes straight for the jugular—and manages to conduct both processes of injecting code and encrypting PC files all by itself. So, Satana seems to be an evolved version of Petya in that it doesn’t need anyone’s help—except for the human on the other end of the reboot function—in order to infect and encrypt a user’s computer.

Once Satana has successfully installed itself on its victim’s computer, it will launch its ransom note, which reads, in part:

“You had bad luck. There was crypting of all your files in a FS bootkit virus<!SATANA!> To decrypt you need to send on this E-mail: [email protected] your private code: C98F4DEC6A….”

…and so on. Eventually, the ransom note gets to the point where it instructs victims to pay a bitcoin equivalent to $340. The note, which blasts itself in bright red text against a sinister black background, ends with a call to action that tells users where to enter their decryption code to regain access to their files. The malware signs off with, “Good luck! May God help you! <!SATANA!>”

Kaspersky Lab has dubbed the Russian-linked Satana the “ransomware from hell.” According to Kaspersky Lab, researchers have identified six email addresses that serve as contact information for Satana’s victims, who must request payment and other instructions in order to receive the decryption key to unlock their files.

In order to fulfill the ransom and unlock encrypted files, the cybercriminals behind Satana demand that victims pay around 0.5 bitcoins, or approximately $340.

For the advanced and technically apt victims of Satana, there may be a light at the end of the tunnel. Experts have revealed that there is a way to at least partly bypass the MBR to gain access to the infected operating system and restore it—but be forewarned, this solution is only meant for experienced victims with very advanced technical skills.

Problematically, while you may be able to restore your OS, researchers have yet to figure out a solution that will give Satana victims access to their encrypted files. It seems that, at least for now, victims have only one option in order to decrypt their stolen files—and that is to pay up.

The good news, for the time being, is that Satana is currently in its infancy stages; it is not widespread, and researchers have uncovered errors and weaknesses in its code. On the flip side, it appears that Satana is positioned to evolve over time, and with its comprehensive method of attack, it has the potential to become the next major threat in the ransomware world.

To stay vigilant against ransomware threats, remember to always:

1. Backup your data on a regular basis.
2. Don’t open suspicious email attachments.
3. Use trustworthy anti-virus software and keep it updated.
4. Consult a professional if you need to bolster your security or you suspect you’ve been compromised.

{company} your local IT security solutions provider, keeping your business’ IT assets safe from ransomware, hackers, and other cybersecurity threats. For the most advanced IT security solutions in business, contact us at {phone} or send us an email at {email} for more information.

A piece of malware targeting Mac computers named Backdoor.MAC.Eleanor is making the rounds. While it may still come as news to some users that Macs can get infected, Mac OS X — Apple’s flagship operating system — is just as vulnerable as Microsoft Windows. And as Apple’s share of the personal computing market grows, so too does its appeal to hackers.

Eleanor Gives Hackers Total Control

The Eleanor “backdoor” malware was discovered by security analysts earlier this month, but they believe it has been in the wildsince at least April. It was found hidden in a fake application named EasyDoc Converter on legitimate websites that host Mac app downloads. It has since been removed.

The Eleanor program inside EasyDoc Converter installs a hidden Command & Control (C&C) portal on a Mac that gives hackers the ability to edit and delete files, download programs, and stop your Mac’s core services. It even allows hackers to record audio and video from your Mac’s microphone and webcam.

Given this level of control, the consequences of catching the Eleanor backdoor are serious. Your Mac could become part of a remotely controlled botnet and used to attack outside businesses. Or the hackers could attack you by holding your files for ransom.

Macs Are Just as Vulnerable as PCs

The common computing myth persists that Macs do not get viruses, but security vulnerabilities exist in all software applications and operating systems. The more complex a piece of software is, the greater the risk for a vulnerability. In fact, OS X has the most publicly disclosed security vulnerabilities of any software product on the market today, surpassing Microsoft Windows and other popular operating systems.

This is not an indictment of OS X — not every single vulnerability on every platform is a critical risk — but it is a warning for business users not to assume that Apple’s history of fewer compromises is proof that they’re more secure. Currently, Macs make up just under 5 percent of the desktop computing market, but that market share is growing. That means their appeal to hackers is growing as well.

Best Practices for Securing Your Business’s Macs

Given this increasing risk of compromise, Mac users should make sure to follow the established best practices for securing any personal computer.

• Apply Regular Security Updates. Usually, as soon as a vulnerability is found, developers start fixing it. Installing security updates as soon as possible can help keep you ahead of the hackers.

• Limit Use of Administrator Accounts. Most day-to-day business operations will not require a computer account that has full administrator access.

• Disable Automatic Login. For PCs in public areas or where you’re concerned about physical security, this feature is a liability.

• Configure OS X’s Time Machine Backup. The best defense against ransomware or file corruption from other malware is to have a backup available.

• Use Reputable Endpoint Protection Software. Most of the major endpoint protection vendors have security software for Macs. Speak to your trusted IT expert about which application makes sense for your business.

If you suspect you have an infected Mac, speak to an IT security expert for servicing. While many security applications clean simple infections, more complex infections like the Eleanor malware can leave behind hidden components that could still damage your computer.

Get Further Advice on Business IT Security

Do you want further advice on how to handle the Eleanor malware or other IT security matters? Our team has years of experience to offer you. {company} is the trusted choice when it comes to staying ahead of the latest information technology tips, tricks and news. Contact us at {phone} or send us an email at {email} for more information.

While Apple malware isn’t unheard of, it is less often found in the wild. The illusion of perfect security entertained by many Apple users gets easily shattered when a new bug appears on the horizon. Eleanor is the latest of these OS-specific malware applications; it opens a backdoor into the computer it infects, allowing total control of the system through a hidden Tor service, a PasteBin client and a PHP Web Service. These three elements allow the attacker to gain access to the entire system and even use it without alerting the user to his presence.

How Does Eleanor Propagate?

Eleanor, apparently so-named by its creators, installs itself on its victims’ computers through an otherwise inoffensive application, EasyDoc Converter. This application, available through MacUpdate, converts Apple file formats to Microsoft Word formats. However, at the same time, it installs a backdoor for cybercriminals to access the computer.

What About Apple App Certification?

Apple users know that the company certifies every application available on its App Store. Apple is known to reject apps that don’t meet its high standards, and definitely wouldn’t allow such a disruptive piece of malware through its fingers.

EasyDoc Converter, however, is not certified with Apple. Mac OS X will show this to any user who attempts to install it, requiring the user to bypass this measure of protection by enabling the installation of unsigned third-party applications. Not every unsigned app is malicious, but every malicious app is unsigned.

As a result, while you may breeze through the warning pop-ups that occur when downloading and installing an application off the internet, you may want to double check those and make sure you’re only installing signed apps downloaded from the Apple App Store.

Enable GateKeeper On Your Mac

Another measure of protection that you should verify on your mac is called Gatekeeper. To enable this application, go to System Preferences and click on the Security & Privacy pane. From there, you should see whether Gatekeeper is enabled or disabled. Earlier versions of Mac OS X do not use Gatekeeper, but have similar settings available on the same page.

However, one of the best ways to protect your computer from malware is by keeping it updated. If you are not using the latest Mac OS X, you should download it and install it on your system. Also, make sure all of your applications are up to date as well. You may not have caught Eleanor, but you could easily catch the next one that comes around.

{company} is the trusted choice when it comes to staying ahead of the latest information technology tips, tricks, and news. Contact us at {phone} or send us an email at {email} for more information.