You may have heard that 68 million Dropbox users were recently told by the company that they needed to change their passwords due to a general hack of their database. The hack occurred in 2012, but it was only after years of persistent rumors by Netizens and cybersecurity mavens that Dropbox finally came clean about the hack. Dropbox completed performing a forced password reset for 68 million people just last week. Dropbox is merely the latest Web-based startup or organization that has faced having many millions of their customers affected by a single data breach. 5GB of files were obtained by Motherboard via Leakbase, a data breach notification service. The hacked cache of files includes email addresses and hashed user passwords, but, interestingly, almost half (32 million) of the passwords are secured by bcrypt, a strong hashing function, leaving the rest hashed by the hashing algorithm known as SHA-1.

Dropbox Speaks

Head of Trust and Security for Dropbox Patrick Heim told the world that his company had successfully completed the password reset process, and all affected users of his popular service were covered. Says Heim, “We initiated this reset as a precautionary measure, so that the old passwords from prior to mid-2012 can’t be used to improperly access Dropbox accounts. We still encourage users to reset passwords on other services if they suspect they may have reused their Dropbox password.”

No Illegal Access?

According to a Dropbox spokesperson, the company has found no evidence that any Dropbox account was illegally accessed, although Tech News journal FossBytes reports that, “The Dropbox dump also hasn’t appeared on any major dark web marketplace” which sounds suspiciously like damning with faint praise for yet another outfit that has unwittingly exposed millions to an account and data breach – as well as a breach of inherent trust. Leave it to a third party (FossBytes) to take it upon themselves to advise Dropbox users to change their passwords immediately, and also choose strong passwords that are changed “from time to time,” a.k.a. every few months. This is probably a habit everyone should get into for any website containing personal data they can’t afford to have hacked.

The Argument for Better Cloud Security

The Dropbox debacle underlines the need for better cloud storage security, as that’s what type of platform Dropbox is and was at the time of the hack of their database in 2012. Some may argue that cloud security has advanced significantly in the intervening four years, but – has it advanced enough? The company claims that those passwords that were reset or accounts that were created after 2012 have no chance of being affected, but how can the Web-buying and online-using public be 100% secure in that notion? Lightning doesn’t often strike twice, that’s true. But, there are demonstrable patterns of malicious behavior by hackers, combined with a Web-using public that tends to let down its guard that should bring a rallying cry from IT experts and cybersecurity specialists everywhere: “Encrypt, reset, and be ever-vigilant out there.”

Consult an IT Pro About Passwords and Data Encryption

{company} is the leader in providing managed IT services in {city}. Contact our expert IT staff at {phone} or send us an email at {email} if you have any questions or concerns regarding data encryption, passwords, or protecting your valued data online, and we will be happy to answer any and all your questions.

There is no doubt that the internet has made doing business across the street or across the world easier. Borders and barriers don’t exist for the most part (except in certain totalitarian countries). You can reach customers around the world 24/7. Now that the internet is firmly entrenched as a major tool for business for communications, marketing, data storage and information sharing; risk is involved with usage, and criminals seem to always be a step ahead of virus and malware protection using a basic online protection source.

So, let’s take a look at some of the most popular ways that small- and medium-sized businesses are hacked and how your business can protect itself from them.

Popular Hacker Schemes

Literally hundreds, if not thousands, of schemes exist for stealing data such as personal financial information (PFI) and personal identifying information (PII). In addition to stealing your data, a newer scam has come into play against businesses of all sizes called ransomware. Let’s get started.

Phishing Scams

Email phishing has been around as long as email has, but phishing expeditions have migrated from exclusively attacking individuals to include businesses too. The most common ways that this type of scam works is that you receive an enticing email with an attachment to open. These emails are sent out by the thousands from criminals that want to access your stored data so they can use any PPI and PPF you have about your customers. Generally, the email looks legitimate, has no grammatical errors, and often includes the legitimate logo of the company for which the email purports to come.

Industry experts have estimated that only 0.4 percent of people receiving these fake emails fall for the criminal’s ploy. Sure, it doesn’t sound like a high risk, but it is extremely powerful for criminals who send out hundreds of thousands of these emails; with just a 0.4 percent response rate, they have entrapped data from 400 businesses.

Buffer Overflow

This scheme works when a black hat hacker responds to an online form. The hacker inputs more data than your business system can handle; included in the excess data is code that is complex and designed to:

• Steal your data;
• Cause harm to your system; or
• Provide the hacker with a backdoor into your network

Ransomware Attacks

First used against individual computer owners, ransomware also has become a huge income source for the black hat gangs. They gain access to your system by sending a member of your company an email that offers a free download or newsletter. People that open this kind of email also open the floodgates for cybercriminals to take control of your system. Another point of entry is from an infected website offering downloads. Once your system is breached, all your data is encrypted, and to get it back, you must pay a ransom.

Prevention of Cyberattacks

You can do a lot to prevent cyberattacks from succeeding. Following are some tips to help your business stay secure.

1. When individual passwords are needed, have employees create random passwords, including upper and lower case letters, numbers and some symbols. Never use an actual word as programs can easily hack them. The longer the password, the more secure it is.
2. Educate employees at all levels of your organization about the dangers of opening emails from strangers or downloading items from unknown sources on the internet.
3. Invest in the best antivirus and anti-malware protection available.
4. Patch all software as soon as a patch arrives. Update software too when updates become available.
5. Consider using an outside managed services security provider to help keep your system safe and secure.

{company} is the trusted choice when it comes to staying ahead of the latest information technology tips, tricks and news. Contact us at {phone} or send us an email at {email} for more information.

If you had to make a list of the most pressing threats that Internet users face today, ransomware would undoubtedly be right at the top. Now, thanks to a massive zero-day attack by a particularly tricky group of hackers, Microsoft Office 365 users in particular need to be incredibly careful moving forward.

What is Ransomware?

At its core, ransomware operates a lot like a traditional computer virus with a particularly sinister twist. When a rogue piece of software is downloaded and executed on a user’s computer, it snaps into action and actually encrypts the contents of that drive almost immediately. Encryption essentially “scrambles” information, making it impossible to get at a particular block of data without the appropriate encryption key.

Because only hackers have the encryption key, this essentially locks a user out of their own data. Their only choice is to pay a predetermined “ransom” to get access to the keys and to get their information back, but even this is not a guarantee.

Why Office 365 Users Should Care

Previously, ransomware only targeted files stored locally on a computer’s hard drive – meaning that anything that was stored in Microsoft Office 365 or another cloud-based service would be unaffected. According to a new report published by Avanan, however, this is no longer the case. Even though Office 365 has a number of sophisticated security tools built-in designed to prevent exactly this type of thing from happening, new variants of the “Cerber Ransomware” strain are now going after Office 365 email users in particular.

This means that if you were previously counting on Office 365 to alert you to any vulnerabilities and to prevent this type of thing from occurring, you’re out of luck. It is now more important than ever to follow Internet safety best practices and, if you’re a business owner, to educate your own employees of the same.

By far, one of the best ways to avoid becoming a target of ransomware is to avoid downloading files from senders that you are not already familiar with. If you get a random email out of the blue that has a file attached, do NOT download it and execute it on your computer. Also be on the lookout for clear signs of phishing and other types of SPAM email that could have these files hidden inside.

Regular backups to a secure, off-site location are also important as if you DO fall victim to a ransomware attack, these could be your only way to get things back up and running again when you come out safely on the other side. Even if your entire hard drive is encrypted, you can still wipe the entire operating system and start from scratch. You can then restore your system using the most recently available backup copies, circumnavigating the ransomware’s encryption and picking right back up where you left off.

This will only work, however, if the backups are stored in a secondary location NOT connected to the host computer. If they are only stored in a separate location on the same hard drive, they too will be compromised during the attack.

At {company}, we’re incredibly proud that you’ve chosen us as your go to source for all of the technology tips, tricks, news and other information that you need to run the type of business you’ve always wanted. If you’re looking for more information about this or any of the other important industry topics that we’ve covered, please feel free to send us an email at {email} or to give us a phone call at {phone} today to speak to someone in more detail.