Not so long ago, if your organization had a robust security suite that included a firewall and antivirus, you could feel reasonably secure. The antivirus vendors spent a lot of time and manpower keeping up with the software code, or “signatures,” that identified malicious code trying to enter your network. As long as your IT group kept the signatures updated according to the vendor’s recommendations, and your firewall access parameters were fairly stiff, you were doing just about all you could do–or needed to do.

We are constantly learning new ways to defend against exploits, because the exploiters never stop learning new ways to try and gain access to our resources. With the latest wave of threats, however, it is no longer safe to leave cyber security entirely up to your IT/IS team. Your office staff, and, in fact, everyone who uses a networked computer, needs to be trained on the latest wave of serious threats. Everyone who uses a networked computer will be a weak link in the chain, until they accept and internalize their role in protecting the infrastructure. That’s the bad news. The good news is that the training need not be extensive nor expensive.

One of the most prevalent new exploits is entering networks entirely invited by an email recipient. A user on your network gets an email with an attachment labeled “Order Update List for June 2016” (this is a fictitious example). The user, who normally wouldn’t receive such a document, opens the attachment out of curiosity. The attachment has a malicious payload embedded in it that –BOOM–is now on your network.

What would a criminal hope to achieve on your network? Data–lots of it–is stored on your servers. Names, birth dates, Social Security numbers, business account information, every piece of data you store has a value to you, or you wouldn’t store it. It also has value outside of your perimeters. Stolen data is a lucrative operation, and these programs may provide access to it. Alternatively, these payloads can contain an encryption program that will start encrypting the files on the computer on which it is run. It also moves out to mapped network drives and starts encrypting files on your server shares. It only takes one of these to bring your organization to a grinding halt. If your IT/IS team hasn’t been diligent on backups, and/or doesn’t know how to restore from the backups, your data is held for ransom by this crypto-malware until you pay the ransom.

As unsettling as that is, your users can be quickly trained not to open mail attachments if they don’t understand why they received them. Even expected attachments, if received out of cycle, should be considered suspect. The recipient should call the sender and ask for an explanation. Macros can be helpful in calculating financial transactions, but documents you receive from external sources should not contain macros. Ask senders to send a version of the document with only the data, not the macros. Every business is fighting the same battle against cyber criminals, and we all have to cooperate and work together.

On the sending end, your staff should not be sending documents containing macros outside of the network. If you are sending something out of cycle, be proactive in providing an explanation.

Do you need some more information on this topic? {company} is the trusted choice when it comes to staying ahead of the latest information technology tips, tricks, and news. Contact us at {phone} or send us an email at {email} for more information.

If you’re currently unfamiliar with the concept of ransomware, consider yourself lucky – it is by far one of the most dangerous threats that Internet users and businesses all over the world face today. Ransomware viruses actually encrypt either certain files on a user’s hard drive or the entire drive, completely blocking access unless the victim pays a “ransom” to their attacker. The amount of the ransom tends to increase as time goes on, giving people an incentive to pay sooner rather than later – especially if they find themselves unable to fix the issue on their own.

Should you become the victim of a ransomware attack, knowing how to identify the particular strain you’ve been hit with is one of the most important parts of being able to fix this problem once and for all.

Cerber

One of the most common types of ransomware that Internet users face today is called Cerber, officially classified as RANSOM_CERBER.A. What makes Cerber unique is that it actually has a voice feature that reads the on-screen ransom note out loud, as opposed to other strains that make the user read it as plain text. Cerber is also unique because it doesn’t encrypt an entire hard drive, just files it believes will be particularly valuable to the victim. These include files with extensions like DOC, DOCX, PDF, MP3, MOV, MP4, JPG, JPEG and more.

CryptXXX

CryptXXX, officially classified as RANSOM_WALTRIX.C, is another common type of ransomware that is regularly updated to make it more difficult for experts to combat. Not only does CryptXXX encrypt a user’s hard drive, but it is unique in that it actually has the ability to lock a user out of their hard drive altogether. When the user boots their affected computer, they are greeted by a screen that prevents their operating system’s desktop from loading at all.

Jigsaw

Jigsaw, officially known as RANSOM_JIGSAW.I, is certainly one of the more colorful types of ransomware in existence. In addition to display a message indicating that all photos, videos, documents and other files on a hard drive have been encrypted, Jigsaw displays a graphic of the main villain from the “Saw” series of movies – also appropriately called Jigsaw. Jigsaw also has a built-in timer that counts down the seconds until the ransom is increased, instilling a sense of urgency in the owners of infected computers.

Mircop

Mircop, also officially classified as RANSOM_MIRCOP.A, uses a particularly unique tactic to scare its victims into paying as much money as possible for the ransom. When the ransom note is displayed on an infected computer, it also displays an image of a hooded figure in a Guy Fawkes mask – similar to the imagery used by the hacker group Anonymous. Even though there is no confirmation that Mircop is affiliated with that group, the implication is there and people tend to react accordingly.

Most interestingly is the fact that in June of 2016, the Mircop strain demanded one of the biggest ransoms for any ransomware attack seen at any point up until now. The ransom note on one victim’s computer demanded 48.48 Bitcoins, which roughly translated to $32,239 at then-current exchange rates.

Sound Hacking: A Potentially Big Problem in The Tech World

The act of hacking something simply implies the object, either a computer or other device, is accessed without the owner’s permission or a program or software therein is altered in some way without consent. Although more and more technological advancements are being made every day to keep our devices and computers save, it seems that hackers are always one step ahead of software developers, consistently figuring out a way around any safety features that might have been implemented. Unfortunately, this seems to be an issue that has no reliable or effective solution.

How Bad is The Problem of Hacking?

If you have ever wondered how bad the problem with hacking really is, take a look at these statistics/facts to get an idea of the scope of the problem at hand:

• By December of 2016, there had been over two billion records stolen within the year’s time.
• The career site LinkedIn had 117 million records stolen and accounts affected from a hacker, eventually caught in the Czech Republic.
• Social media site Tumblr was hacked, which led to 65 million accounts being leaked.
• Hundreds of point-of-sale terminals (card machines) located in retail outlets were compromised through the installation of malware. This breach allowed hackers access to username and passwords.

Did You Know Hackers Might Not Stop With Security Breaches Affecting Your Personal and Financial Information?

More than likely, you already knew about some of the above hacking incidents. However, you probably didn’t know that even devices like Fitbits have been found susceptible to hacking. That’s right. According to recent research done in collaboration by teams from the University of South Carolina and the University of Michigan, these devices can be hacked. However, the fact that they can be hacked isn’t the most surprising element of the research findings. The fact that the researchers successfully hacked these devices utilizing sound was even more surprising.

More About The Sound Hacking Research Findings:

Researchers were able to manipulate accelerometers in devices like Fitbits through acoustic attacks. They simply added extra step counts and the like. However, getting credit for a step you didn’t take is far from the most worrisome issue with this research. The fact that researchers were able to use sound to do so presents a new potential problem that will need to be dealt with in the future.

The Dangers of Acoustic Hacking:

Hacking via acoustics is obviously not the most commonly employed way of data manipulation. Kevin Fu, who is the associate professor of electrical engineering and computer science at the University of Michigan, explained how it works:

“It’s like the opera singer who hits the note to break a wine glass, only in our case, we can spell out words.”

These words are entered as commands that manipulate the device, altering data. As was stated earlier, although changing a Fitbit to show more steps than were actually taken is trivial, the ability of researchers to do so shows a potential weakness in all such devices. This weakness is one that has not previously been considered that being the danger or acoustic or sound hacking. Thankfully, now that this research has taken place, software and device developers will be aware of the potential issue and will most assuredly create protections against it if it becomes a security issue.

Call {company} in {city} today at {phone} or contact us via email at {email} to learn more about potential new security threats like sound hacking.

The number of security issues and malware risks that your company must contend with continues to grow every year, but one of the most potentially devastating threats that your business faces is surprisingly low-tech in nature. Spoofed emails don’t rely on complex ransomware or sophisticated keystroke loggers. Instead, your company’s bank account and sensitive information are at risk simply by your employees attempting to perform their job duties. Training your team to spot spoofed emails is key to avoiding falling victim to common scams.

What types of spoofed e-mail scams are out there?

Examples of two common types of spoofed email scams played out in recent weeks. The first, an instance of the CEO fraud, involved an Internet criminal passing himself off as the head of a small Kansas construction company. The fraudster pretended to be the CEO of Cornejo & Sons and emailed the finance department of Sedgwick County to request $566,000 in payment. Because the county actually owed the construction company money for services rendered, they submitted payment as directed–only to later find out that the payment request hadn’t come from Cornejo & Sons and the construction company never received any funds.

A similar scam aimed at a Wyoming hospital system sought to obtain employees’ W2 forms. In this case, the Internet fraudster posed as an internal executive at Campbell County Health and requested the W2 files for all staff from the hospital group’s finance department. The finance department complied, exposing the hospital’s 1,300 employees to potential tax return fraud.

Can you and your staff spot a spoofed e-mail?

No longer completely confident that your employees won’t fall victim to one of these commonly spoofed e-mail scams? Luckily, there are steps that you can take to train your staff to spot a spoofed e-mail. Conducting training sessions to alert your employees to the existence of such scams is an important first step. Putting in place internal practices to verify the veracity of any request before responding will also help your employees understand how to deal with any potential scam emails that your business receives.

However, some employees don’t understand the real threat that accompanies spoofed emails until they have actually been the recipient of a fake request. For this reason, some businesses choose to initiate a simulated attack to reveal to their employees firsthand how easy it is to become the victim of a spoofed email. Some services exist that make it easy to carry out a pretend to attack. Some of these services such as PhishMe allow you to target the attack to match the real threat each of your employees is likely to face, such as an email sent to marketing asking them to provide their SharePoint credentials. Experts assert that it is fundamental to follow any simulated attack with further training as your employees will be particularly receptive to in-depth lessons on avoiding spoofed emails after falling for your staged attack.

Concerned that your employees might be vulnerable to spoofed emails? The security experts at {company} can help you discover your business’ weak spots. Contact us today at {phone} or {email} to learn more.

Contact us today at {phone} or {email} to learn more.

Every day, businesses and individuals send over 205 billion emails all over the world. Though many of these messages contain valuable information, a significant portion of them are spam. Receiving or sending spam exposes your business to a variety of risks, including:

Ruined Reputations

Many firms are unaware that their email accounts have been compromised, sending spam to current and future clients and partners. This can quickly ruin your company’s reputation and make it harder for you to succeed in the long run. If clients and customers think you’re sending them spam intentionally, they will view you as untrustworthy. Even when they realize your accounts were hacked, they may conclude that you do not understand IT issues or take them seriously. Thus if anyone reports that you have been spamming them, you must promptly apologize and put a stop to the problem.

Malefic Malware

Be wary of spam messages that you receive, as they could harbor viruses, trojans, and other harmful programs. Malware can lock you out of vital programs, provide unauthorized access to sensitive information, or even crash your entire computer system. You should thus never open messages you suspect to be spam. If you don’t realize an email is spam until you have already opened it, do not reply to it or click on its links— not even to unsubscribe from the mailing list. The more you engage with spam, the more opportunities it has to transmit critical programs.

Subtle Scams

In addition to infecting your computer systems, spam writers also use more subtle tactics to cheat you. Junk mail may come in the form of a fake business offer, using the name and writing style of a real company that could be a potential supplier or partner. The scammer will try to convince you to pay them, supposedly for a service or venture that will help your business; if you comply, they will take your payment and leave you with nothing. To separate scams from real business propositions, look up the companies that claim to be sending the emails and contact them independently. If a company has no record of sending the message, the offer is not real.

Data Deliverance

Besides stealing money, scammers can also use spam mail to get you to hand over sensitive information. Phishing scams involve sending you mail under the name of a company or individual you trust, such as your bank, your health insurer, or one of your employees. The message will ask you to send over sensitive information that the company or individual would have access to.

In general, you should never send sensitive information over email, to begin with. If you do receive a message from a trusted entity demanding such information, contact them at a different address or meet with them to confirm their request. Never expose your business to phishing scams.

{company} strives to protect businesses throughout {city} from spam and all other risks. To learn more, call us at {phone} or contact {email} today!

Spam emails are nothing new. Your junk folder is routinely home to a handful at a time, and at this point, spam is more of an annoyance than anything else. And cyber criminals know it. Which is why today’s scam emails don’t always look like spam on the surface.

More and more, users are receiving emails from what appear to be legitimate senders, but with odd timing or information. These unexpected emails should be raising a red flag when you spot them in your inbox.

The scenario generally looks something like this:

You receive an email from Amazon, letting you know that there has been a delay with your recent order. The email helpfully provides a link you can click for tracking information. The problem is, you don’t remember placing an order with Amazon recently. This email could just as easily be from a financial institution advising you of a problem with your account, or from Facebook asking you to update your information, or even from a business associate asking you to verify or send sensitive information.

The one thing they all have in common? They’re fake.

Clicking on the link embedded in one of these emails will lead to your system being infected with something nasty, your data or identity being stolen, or the account tied to the company or institution the hacker is posing as being compromised.

The best way to protect yourself and your business from potentially dangerous consequences are to only proceed with caution. Instead of clicking the link provided, go the website directly in question to check your recent account activity, or call your bank using a contact number from their website, not the contact information included in the email.

Phishing scams continue to be a favorite method of hackers because they continue to have a high success rate. Taking an extra moment to re-read an email that feels just a little off, and double-checking the message’s legitimacy can save you from one tremendous headache.

Want to learn more about protecting yourself and your business against email scams? Contact us at {email} or {phone}. We’re the IT professionals businesses in {city} trust.