Posted on

PHISHING: Know Your Technology!

I received a call today from a bot reporting itself as Amazon and alerting me that a $1,000+ charge had been made on my Amazon account for a new iPhone 11 and to press “1” for a rep to discuss this charge. Naturally, I pressed “1” to play along and see where this went.  I was transferred to an agent purporting to be an Amazon customer service rep.  He asked me if I wanted to receive the phone and was surprised when I answered “hell yeah” since they’re expecting you to be shocked by this order and to scare you into giving up personal information or remote access to your computer.

When I answered yes, he proceeded with shipping information.  Is this going to “Ken Carmack?”

ME:  “Yes”.

REP:  “ Is the address 167…”

ME:  “No, that should be 167 Main Street”

REP:  “OK, is that going to Raleigh?”

ME:  “No, it should be Wilkesboro”

By then, he knew that he was being played and disconnected.

The bottom line here is that phishers are constantly whipping up new schemes such as this one, to scare you into thinking that you’ve been charged for a TV, iPhone, Norton antivirus or similar. In your panic, they hope that you will divulge personal information or provide access to your computer which they can then exploit.

A common tactic that I’m seeing lately are emails with an invoice or payment confirmation stating that your account has been debited $389.99 for McAfee or Norton renewals and to call their 800 number if you need assistance or have questions. One client of mine was scared into action by this, dialed the 800 number and provided remote access to his computer to an “agent”. BOOM! A win for the attacker!

Another common tactic is an email from “Microsoft” warning that the password to your Microsoft account is expiring in short order. The goal here is for you to click on the link, proceed to a page that looks like Microsoft where you enter user credentials which they can then use to login in to your actual Microsoft account. These emails sometimes look like they originated from Microsoft but are often sent from an email account or domain that bears no resemblance to Microsoft, such as billy@wescammedyou.com.

So how to spot/avoid phishing  tactics? There are several red flags or rules of thumb to keep in mind:

  1. KNOW YOUR TECHNOLOGY! Are you using McAfee or Norton, such that a renewal is in order? If not, don’t take the bait.  Most of my clients use BitDefender so be aware of your security suite.  I never use McAfee or Norton unless a client has purchased that on their own. Nevertheless, you should be aware of what is protecting your computer, not only to ensure you’re protected, but also as a defense against phishing.
  2. Does the sender’s email address resemble the soliciting company? For example, one McAfee renewal that I reviewed came from an @gmail.com account which raised a red flag. If the sender’s address is hidden, hover over the sender name/address to see the underlying sender’s account. If the sender presents as Microsoft, see if the underlying email address is actually @microsoft.com.  While this is not foolproof, you can quickly rule out many bogus emails that arrive in your inbox.
  3. Does the invoice address you by name or company name? If the renewal is addressed to “Dear Customer”, then they probably never had the original subscription.
  4. Is your address or last 4 digits of your credit card referenced? Once again, vague invoices/confirmations with scant specific details are a red flag.
  5. When in doubt, send the items to your IT department to verify for legitimacy.
  6. Under no circumstances should you reply to the email or call their 800 number. If you’re legitimately concerned that you’ve been charged, then log in to your banking or credit card account and scan for pending or completed charges. If the caller or email claims that the purchase was made in your Amazon account, log into that account and review your orders. When accessing financial or online accounts NEVER, EVER click a link in an email. Always open your web browser and navigate to your accounts as you normally do. Links in emails can send you to web pages that look like the real website but are designed to collect your user credentials. Also, enable 2 factor/multifactor authentication on accounts that contain financial or sensitive information.

One more phishing story and I will get back to work.  A few months ago a client called and stated that their company’s president’s (let’s call him “Fred”) phone had been hacked. A young employee (call him “Jimmy”) in the company received texts from the president asking him to run an errand and buy 15 @ $100 Apple gift cards to distribute to the staff as performance awards.  Oh, and don’t bother calling Fred because he’s in meetings and using someone else’s mobile phone since his battery is dead. Long story long, Jimmy followed the instructions to the tee, purchased the cards, scratched off the backing, shot photos and texted the images to “Fred’s” phone.  BOOM!

Bottom line, Fred’s phone was never hacked.  It was probably a burner phone that got trashed immediately after the successful caper. Further, my client contacted Apple to deactivate the gift cards.  I suppose that’s possible, but the hacker knew that time was on his side and wasted no time spending them. Jimmy was out $1,500 at the end of the day.

A few key rules of thumb that could have prevented this hack:

  1. Verify the sender using a different communication method. Don’t text Fred back to ask if it’s really him since the attacker will respond affirmatively. Call Fred on his landline or send an email. I have seen successful attacks where the hacker emailed the victim, the victim verified via the same email channel and the attacker confirmed “yeah, this is legit!”
  2. Run a smell test: Does this make sense for the president to reach out to a new employee for an errand like this?  If you don’t have the experience/context to answer that question, check with your peers.  If Fred is really in a meeting, what’s a few minutes to ask around to confirm that. Remember, these hackers use fear to kick you into quick action, which always works in their favor.
  3. Avoid mobile numbers on your company website. If you want to post phone numbers, add landlines that cannot receive texts. You can config most landlines to forward to a mobile phone so that you don’t miss calls. Many phishing attacks are via text message, so posting your mobile number on the web provides a very easy target.
  4. When in doubt: DON’T!

Over the years, we’ve all learned to ignore and delete emails from Egyptian pharaohs, lottery winnings, and all the other too-good-to-be-true trickery.  However, scammers are getting more clever, so it pays to be cautious and dial up your BS detector.

Be careful out there!

Additional resources on phishing methods, prevention and remediation:

Federal Trade Commission:  How to Recognize and Avoid Phishing Scams

PC Mag:  How to Avoid Phishing Scams

NC Department of Justice:  Phishing

Posted on

Fake Tech Support Scam

The phone conversation always starts the same way:

Me:  Hey, this is Ken.

Joe:  Hey Ken, it’s Joe. I think my computer is infected by a virus.

Me:  Oh man, what are the symptoms?

Joe:  Well, I was just browsing the web and suddenly I got a pop-up that said my computer was infected.

Me:  OK, then what?   (inside voice:  please tell me you didn’t call the 800 number)

Joe:  Well, I tried to close the browser, but it wouldn’t close and there was a voice playing through the speakers stating that the computer is infected and not to shut down.

Me:  So what did you do?  (inside voice:  please tell me you didn’t call the 800 number)

Joe:  There were these pop-ups that I couldn’t close, with a message to call Microsoft Tech Support at this 800 number.  Oh, and the recording told me to call Microsoft.

Me:  Yeah, this is a pretty common scam and it’s not really Microsoft (inside voice:  please tell me you didn’t call the 800 number)

Joe:  So I called the 800 number….and I got this Microsoft technician who barely spoke English …. who asked me a bunch of questions and walked me through some steps to see if my computer was infected.

Me:  Mmmm…..Did you provide remote access?  (inside voice:  please tell me you didn’t give them remote access)

Joe:  Yeah, he had me install this remote access tool and took control of my computer and showed me more viruses and infections.  

Me:  (Actual voice) Please tell me you didn’t give him your credit card number……

Joe:  So I gave him my credit card and he cleaned up the viruses and offered 2 years of support for $400.  Is this OK?

Wow!  Nailed again.  I have had this exact conversation a dozen or more times with clients and friends, each of whom have received shiny brand new credit cards or checking accounts as a result. That’s right. Not only is your computer security compromised, you have also given a scammer access to your credit card or checking account.

This is a very common scam and has various attack vectors. For a while, the most common approach was via phone call.  I used to receive a couple of calls a week from overseas callers claiming to be from Microsoft stating that they had noticed dangerous virus activity on my computer.  I typically strung them along long enough to find my trusty sports whistle, which I blew loudly into the phone.  This usually resulted in a prompt dropped call.

I also tried providing access to a virtual machine just to see what they would do but they usually got wise to me when I strung out the call.  Here’s a very entertaining fake support “technician” that called a seasoned security researcher at Malwarebytes who turned on his recorder and had some fun with the caller. This is a very long audio session, but is worth your time.  Heck, some readers will recognize the script from their personal experience. Ultimately, he angered the caller, who attempted to delete stuff off of his computer which is yet another reason that you should simply hang up on these guys.

My first exposure to this type of scam was a very bright friend of mine who ended up with 2 compromised machines and a new credit card!

Another attack approach is via email. However, the most common vector today seems to be via “drive by attacks” where the user either clicks a link, such as an ad, or clicks on a rogue search result and lands on a malicious website.  For example, say you search for WRAL and the top result is wral.net (a bogus link), and you inadvertently click on it, instead of WRAL.com.  Instead of seeing today’s headlines you get a gnarly web page:

browlockThese are extremely intimidating alarms, even for seasoned web users. Not only do they lock the browser, preventing you from closing Chrome, Firefox, Safari, or IE, but they also have a recorded message that seemingly cannot be silenced. The warning purports to come from Microsoft or another trusted tech company and provides a support phone number.  The user is warned NOT to close the browser without calling the number, as bad things will happen.  The secret here is that closing the browser will swiftly defeat the scam.  If you cannot close the browser by conventional methods or by using Task Manager, simply save and close your work in Word, Excel, AutoCAD, etc. and then reboot your computer. This solves the problem if you don’t navigate back to the same rogue website.

Now, once the computer reboots, you should run a virus scan using whatever virus protection suite is installed on your computer.  As a safety net, download and run Malwarebytes just to be sure.

These scams are more bark than bite, unlike the ransomware attacks that have monopolized headlines over the last year.  But, they are extremely profitable for hackers and a massive headache for victims. 

Remember:  Don’t be intimidated by these scary pop-ups, and never, never, never give your credit card or banking information to random callers.  When in doubt, call your trusted tech provider as we have seen these scams time and time again.

Oh, and one more thing:  Be safe out there.

 

Additional resources:

NC Attorney General Office alert

Malwarebytes article

Posted on

Your Secure Wireless May Not Be Secure

News of a new vulnerability surfaced this week in an issue that will affect ALL users that access the internet using WiFi, whether on your laptop, desktop, tablet, phone, etc.  The vulnerability, named KRACK, is a weakness identified in the WPA2 protocol which, until now, has been deemed virtually bulletproof.  The WPA2 wireless protocol is configured on nearly every single home wireless device and a vast majority of small and medium business wireless devices.

The vulnerability allows hackers unauthorized access to your network without the WiFi password and can allow strangers to eavesdrop on your wireless connection, obtain passwords, credit card info, etc. Now, with that said, as long as you’re accessing secure websites (i.e. those that show https:// in the URL) your information should be safe.

The good news is that the hacker needs to be physically close to the wireless network that you’re using to exploit the vulnerability.  Thus, public WiFi is inherently more dangerous than your home’s wireless.  The bad news is that virtually every single WiFi device that you have is using WPA2 to secure your connection.   Thus, everyone needs to pay attention to this problem.

This is mostly a client-side attack, meaning that it’s most important to update your wireless endpoints than your wireless router.  Thus, keep Windows and Mac OS X updated on your laptop/desktop; download/apply updates on Android phones and iPhones, iPads and other tablets as well as readers such as Kindles.  While all of these endpoint makers are scurrying to update their software, manufacturers of wireless routers and access points are in the process of pushing out updates, many of which must be manually applied.  Check the BleepingComputer link for updates on your equipment.

How to Protect Yourself:

The best way to protect yourself is not breaking news, as we’ve heard this for years:   make sure that you install all updates and security patches on all of your devices.  Many manufacturers have already pushed out patches. In fact, Windows was patched in Microsoft’s October 10th Patch Tuesday release.  Other devices are reliant on their manufacturer’s software release schedules. For a list of updates by major manufacturers, take a look at BleepingComputer’s list.  

Other steps you can take:

  • Avoid public WiFi at all costs:  this is nothing new, but it is even more imperative with the KRACK vulnerability.  I have not used public WiFi for years, opting instead to use my Verizon hotspot.  Public WiFi includes coffee shops, hotels, free municipal WiFi, etc.

 

  • Only connect to secure sites:  as discussed above, avoid sites that begin with http:// and NEVER EVER enter your credit card info, social security numbers, passwords or any other sensitive information on websites that are not secure.  And if you encounter a website that shows a red slash through https:// , close the page and check back later.  9780789739735 3-11 4.16.9
  • Continue using the WPA2 wireless security protocol:  despite the vulnerability, it’s still the safest security profile for home and small business users and should be patched very quickly.
  • Use a wired connection if you can:  if your wireless router or switch is accessible and you can connect you laptop via ethernet cable, do this until the WPA2 protocol is fixed.  Devices that are connected via ethernet are not susceptible to this problem.  This is not always convenient, but it’s better to be safe than sorry.
  • Use a VPN if possible:  if you absolutely must use public WiFi, connect to your workplace using a VPN and send all of your internet traffic through the secure tunnel.
  • Changing your WiFi password will not help, unless your password is weak to begin with.  In the case of a weak password, strengthening that is never a bad idea.

Updating your wireless router’s firmware is not a simple task, so contact me or your network administrator for assistance in installing these updates.  

In summary, there’s really nothing new here needed to protect yourself as long as you’re keeping your systems/devices updated, avoiding public WiFi, only accessing sensitive information on secure (https://) sites, etc.  As long as you remain vigilant and get to know your technology a little better, you should be able to safely navigate the world wide jungle.

Stay safe out there!

****************************************************************************************************
Please feel free to pass this along to friends and co-workers.

For more information, please link to my sources for this article:

CNET Article:

https://www.cnet.com/news/krack-microsoft-windows-amazon-frequently-asked-questions/

 

CNET Article:  Steps to Take:

https://www.cnet.com/how-to/krack-affects-everyone-heres-what-to-do-now/

 

Hardware Vendor Updates:

https://www.bleepingcomputer.com/news/security/list-of-firmware-and-driver-updates-for-krack-wpa2-vulnerability/

Posted on

Ransomware / Wanna Cry: Staying Safe in an Unsafe World

I attended a Technology Roundtable last week and one of the topics was “What keeps you awake at night?” My immediate response was “Ransomware”.  Two days later, news broke about the massive ransomware attack dubbed “Wanna Cry” which was wreaking havoc on computers and servers around the globe.

This is truly the kind of attack that keeps IT professionals up at night.

Many viruses, rootkits, and malware are annoyances and can be removed by tools that are readily available on the internet.  While some can be removed pretty quickly with killer apps like MalwareBytes, others may be more tenacious and require a recovery of your files and reinstallation of your operating system, a process that will take hours or days and cost a pretty penny. However, at the end of the day, all of your files can be safely restored either from your hard drive or a recent backup (you ARE backing up, right?)

The most devastating malware affecting users today is different.  It’s called Ransomware and it will ruin your day, week AND year.

Ransomware has been around for a decade or more. You may recognize some of the variants, including CryptoLocker, Locky, and most recently Wanna Cry .

Here’s what it does:

The infections search for and encrypt important files on your computer using common encryption algorithms. When the  file encryption process completes, the program displays a payment message prompting the user to send a ransom of $300+ to purchase the decryption keys to recover your files. The ransom frequently increases with time until you pay up.  Failure to pay the ransom results in  deletion of your encryption key and permanent file loss.

Ransoms must be paid using MoneyPak vouchers or Bitcoins which are not easily traceable by law enforcement to an organization or individual. Once you send the payment and it is verified, the program will send you the key to decrypt the files that it locked. (thanks to Lawrence Abrams on BleepingComputer.com for this summary)

How you Become Infected with Ransomware:

The infection is typically spread through infected email attachments.  In the past, the emails have posed as customer support notices from Fedex, UPS, DHL, etc. and the attachment was typically named Form_102213.pdf or Form_102213.pdf.exe (or some variant of these), but might also be disguised as a ZIP or other file type.  A key difference between prior infections and Wanna Cry is that once a computer was infected on a company network, it exploited a vulnerability in Windows that allowed it to spread from computer to computer on local networks.  Thus, it had a devastating impact within large organizations.

What if you get infected:

The first thing to do is disconnect your computer from the internet and power it off– QUICKLY! This will prevent encryption of additional files.  If you’re working wirelessly, disable wireless on your PC.  If connected via Ethernet cable, pull the plug. Next call your IT pro and start deciding how important your encrypted files are to you. Also, figure out where your most recent backup is and how recently it ran.  Most cloud-based backup services provide file versioning for a period of time.  For example, Carbonite saves previous versions of files for 3 months which could be your saving grace.

Removal of the malware is fairly straightforward.  However, without the decryption keys it is absolutely impossible to decrypt your files. Thus, if you cannot recover the files from a recent backup and need them restored, your only option is to act quickly and send the ransom money. There is currently no tool available (or IT Pro) that can decrypt your files.

How to protect yourself:

1.   Be vigilant about opening email attachments – never open an attachment originating from unknown/unexpected sources (i.e. if you’re not traveling anywhere, don’t open a travel itinerary from Delta!).  Also, be careful when opening unusual attachments from trusted sources as their email may have been hacked.  EDIT:  I rarely open email attachments even from known senders unless I am absolutely expecting it (i.e. a friend/client has explicitly stated that they are sending over an Excel spreadsheet on Monday — i will probably open this;  however, if I receive an attachment from a friend that I’m not expecting, I will text or call them to verify its authenticity.  NEVER send an email to verify the doc).  Further, do not open unexpected file shares through DropBox, Google Drive or other sync services unless you expect them. Even then, proceed with caution.

2. Keep all programs updated and Windows Updates applied.  The recent Wanna Cry ransomware exploited a security vulnerability in Windows.  Microsoft issued a patch for the issue in March, so if you’re keeping Windows updated then you should be safe. Windows 10 forces download/installation of updates, so unless you have “hacked” Windows 10 to deny the updates, you should be safe.  In fact, most accounts report that Windows 10 was not targeted by the most recent attacks.

3. Choose a reputable antivirus software and keep it updated. I recommend BitDefender.

4.   Backup, backup backup… and then Backup! to an external hard drive ($85 for 1TB) and disconnect it from your computer or use an online service that provides versioning.  I am a partner/reseller for BackBlaze and can help you get this up and running quickly.   When all other protections fail, a good/current backup will get you back in business without having to pay up to the bad guys!

5. Be very careful about free software you download from the internet.  Many seemingly useful programs such as PDF writers or video downloaders come with malicious “baggage”.

6.    Make sure you’re running System Restore on your PC.  This can help recover previous versions of files that have been encrypted.  While this is not a fail safe, it’s still a good idea to make sure this feature has not been disabled in Windows.

7.   Apply the Software Restriction Policies outlined in this article using Local Security Policy or Group Policy (domain computers) to disable the malware’s ability to execute on your system.  This is fairly advanced, so please let me know if you want assistance applying these policies to your PC.  Also, keep in mind that these policies will block the malware in its current form. As hackers modify the code to install from another location on your computer, these policies will not protect you.

8. Train your users to be vigilant about the emails they open, the links they click and the email attachments they open.

Is There any GOOD News?

As a matter of fact, yes.  Most of the recent attacks occurred overseas, mostly European computers and servers.  Further, a security researcher reviewed the code during the attacks and located/activated a “kill switch” which dramatically slowed the spread of Wanna Cry.  However, it was slowed, not stopped. The BAD news, though, is that this was a variant on a common malware attack pattern.  As long as there is money to be made in malware there will be plenty of future attacks to come.   AND, as any user of Windows knows,  there are plenty of security holes in the operating system as evidenced by the nearly constant interruption of Windows Updates.

If you want to geek out on more technical details about the threat, take a look at these articles posted on BleepingComputer.com, MalwareBytes and Microsoft.  Another good read comes from the blog of Marcus Hutchins who found the kill switch in the Wanna Cry code.

Stay safe out there!

Posted on

Internet Explorer Is Not Safe (AGAIN!)

Here we go again.  Microsoft’s Internet Explorer (IE) browser is on the hit list once again.  The Department of Homeland Security has warned computer users not to use Internet Explorer until Microsoft patches the vulnerability.  A timeline for the patch is not yet available.

If you want a faster, more stable and more secure browser, install and use Google Chrome.  Other options include Mozilla Firefox, Apple Safari and the little-known Opera browser.  Don’t know which to choose?  Download them all and see which one you like.  I have used Chrome exclusively for years and find it to be fast, stable and secure.  Plus, it’s built by Google so naturally works well with all of my Gmail and Google services.

If you absolutely must use Internet Explorer, due to company security policy or proprietary web-based databases such as Yardi or NetDocuments, disable the Adobe Flash plug-in since that is how the problem is exploited in IE.  You can also download a patch from Microsoft called the Enhanced Mitigation Experience Toolkit 4.1 which hardens systems against malicious attacks.

If you’re still hanging on with Windows XP, you’re stuck.  Microsoft is feverishly working on a patch for this vulnerability for Windows Vista and Windows 7 users.  However, following XP’s support sunset on April 8, 2014, there’s no relief in the future for XP holdouts.

Your best bet is to dump Internet Explorer for good and move on to a “big boy” browser!

Be safe out there.

 

Posted on

HeartBleed Bug

By now you have heard news about the Heartbleed / OpenSSL vulnerability that is sweeping the internet. Since getting wind of the problem many programmers, website owners, and other security professionals have been working around the clock to secure their websites.

It’s still very early in the process and as of 4/10/2014 many operators have not yet addressed publically whether their sites were safe or affected. Lists are popping up that show safe and vulnerable websites.  However, the status of the website is as of a snapshot in time.  Thus, if a website operator was vulnerable but patched their website on Wednesday morning and the test was run on Wednesday afternoon, they may give you a false sense of security. Thus, it is not safe to rely on these lists to assess whether or not your accounts were affected since this vulnerability has been present for 2 years.

What is the issue?

This is not a virus or a hack.  This is a vulnerability in the programming code that allows intruders to get through the security “wall” that protects many websites.  This hole allows hackers to compromise the digital keys used to identify websites and encrypt the info.  It also provides a look at unencrypted data as it passes over the internet onto web servers.

Think of it this way:  You moved into a new house 2 years ago. You always lock your doors whether you’re home or away and have 24/7 alarm system. However, while you were painting your front door, you noticed a secret latch on the outside that releases the locks and allows strangers to walk in your front door. While in, they can grab your wallet, social security numbers, usernames, passwords, etc. as if they have a key to the house.  There’s no way to tell if anyone has accessed the house, but the opportunity has always been there.  Thus, the problem is not “backdoor” access to secure websites… hackers can waltz right in the front door.

I have told people for years never to log into a website, provide credit card numbers or any other sensitive information unless the URL address is preceded by https://. The https://, the padlock and the green color indicate that several things have happened behind the curtains, including:

  1. Verification that the website is really who they say they are – your browser verifies digital certificates to confirm that www.gmail.com is really Gmail.
  2. Encrypts the data as it passes across the internet – thus, if someone intercepts your username, password and credit card as it passes across the internet to a web server, it’s scrambled and completely useless to a hacker.

Unfortunately, this vulnerability compromised that security, leaving your passwords, usernames & credit card numbers vulnerable on affected web servers. With that said, you should still follow these rules going forward. They just have not provided the security that we all expected for the last 2 years.

Am I affected?

At this point, it’s not entirely clear which sites are affected – the development is so new that many web site owners are still scrambling to assess and apply patches.  While you can check the lists referenced above, they are as of a point in time. Your best approach is to either check in with your online providers (banks, shopping sites, email providers, etc) to find out whether they were affected, whether they have corrected the problems and what course of action you should take to protect yourself.

Is this a virus?

NO. Despite the subtitle of an Associated Press news article I read Wednesday morning, this is not a virus, but a security hole. According to a Google search

 Virus:  a piece of code that is capable of copying itself and typically has a detrimental effect, such as corrupting the system or destroying data.

 

Thus, running antivirus software or active scans will not detect or remove the problem.

What should I do? 

The first step in securing your accounts is to change passwords for all of your online accounts. But don’t jump out there and do it yet.  As of this writing (7AM EST on 4/10/2014) many websites have not applied the patches to OpenSSL so your changes would be made in vain.

You should already be in the habit of changing your passwords to critical sites every 3-6 months.  You’re not?  Neither is the rest of the world.  As such, use this as a wake-up call to freshen up your passwords.  Be sure they’re complex and use the following guidelines as minimum:

  1. Do not use your name, your user name, family names or familiar numbers, like your birthdate or home address.
  2. Avoid dictionary words.
  3. Use a passphrase instead of a password.
  4. Passwords should be at least 8 characters long.
  5. Employ characters from at least 3 of the 4 following groups:
    1. Uppercase letters;
    2. Lowercase letters;
    3. Numbers;
    4. Symbols;

A brief list of the internet’s most popular sites and whether or not they were affected is available here.

As always, feel free to contact me if you have questions about this problem.  If you want additional information on the bug, check out these articles:

Associated Press

The Register

CNET

DigitalTrends

Business Insider

Be safe out there!

Posted on

CryptoLocker

If you saw me right now, you would probably ask if I had just seen a ghost.  After reading several articles about a new extremely dangerous and destructive form of ransomware, I feel like I’m facing Freddy Krueger!

This is the kind of attack that keeps IT professionals up at night.

Most viruses, rootkits, and malware are annoyances and can be removed by tools that are readily available on the internet.  While some can be removed pretty quickly with killer apps like MalwareBytes, others may be more tenacious and require a recovery of your files and reinstallation of your operating system, a process that will take hours or days and cost a pretty penny. However, at the end of the day, all of your files can be safely restored either from your hard drive or a recent backup (you ARE backing up right?)  

This one is different.  It’s called CryptoLocker and it will ruin your day.  Here’s what it does:

CryptoLocker is a ransomware program that was released around the beginning of September 2013. This infection will encrypt certain files using a mixture of RSA & AES encryption. When it has finished encrypting your files, it will display a CryptoLocker payment program that prompts you to send a ransom of either $100 or $300 in order to decrypt the files. This screen will also display a timer stating that you have 96 hours, or 4 days, to pay the ransom or it will delete your encryption key and you will not have any way to decrypt your files. This ransom must be paid using MoneyPak vouchers or Bitcoins. Once you send the payment and it is verified, the program will decrypt the files that it encrypted. (thanks to Lawrence Abrams on BleepingComputer.com for this summary)

How do you become infected with CrptoLocker:

Currently, the infection is spread through emails pretending to be customer support notices from Fedex, UPS, DHL, etc. and the attachment is typically named Form_102213.pdf or Form_102213.pdf.exe (or some variant of these), but might also be disguised as a ZIP or other file type.

What if you get infected:

The first thing to do is disconnect your computer from the internet – this will prevent encryption of additional files.  If you’re working wirelessly, disable wireless on your PC.  If connected via Ethernet cable, pull the plug. Next call your IT pro and start deciding how important your encrypted files are to you. Also, figure out where your most recent backup is and how recently it was completed.  Most cloud-based backup services provide file versioning for a period of time.  For example, Carbonite saves previous versions of files for 3 months which could be your saving grace.

Removal of the malware seems to be straightforward according to the articles.  However, without the decryption keys it is absolutely impossible to decrypt your files. Thus, if you cannot recover the files from a recent backup and need them restored, your only option is to act quickly and send the ransom money. There is currently no tool available (or IT Pro) that can decrypt your files.

How to protect yourself:

1.      Be vigilant about opening email attachments – never open an attachment originating from unknown/unexpected sources (i.e. if you’re not traveling anywhere, don’t open a travel itinerary from Delta!).  Also, be careful when opening unusual attachments from trusted sources as their email may have been hacked.

2.      Be very careful about free software you download from the internet.

3.      Backup to an external hard drive ($85 for 1TB) and disconnect it from your computer or use an online service that provides versioning.

4.      Keep all programs updated and Windows Updates applied.

5.      Make sure you’re running System Restore on your PC.  This can help recover previous versions of files that have been encrypted.

6.      Apply the Software Restriction Policies outlined in this article using Local Security Policy or Group Policy (domain computers) to disable the malware’s ability to execute on your system.  This is fairly advanced, so please let me know if you want assistance applying these policies to your PC.  Also, keep in mind that these policies will block the malware in its current form. If the hackers modify the code to install from another location on your computer, these policies will not protect you.

The above tips can help mitigate the risk but the best tip is not to open suspicious files.  Tip #6 is the best available protection in the event that you accidentally open a file and obtain the infection in its current form.

One last comment on updates:  Don’t forget that Microsoft is ending support for Windows XP in April, 2014.  Expect threats like this on XP machines to heat up following the support sunset.

If you want to geek out on more technical details about the threat, take a look at these articles posted on BleepingComputer.com, MalwareBytes and Microsoft.

Stay safe out there!

 

Posted on

Shop Safely This Holiday Season!

BREAKING NEWS FLASH:  Microsoft’s Internet Explorer Has a Security Flaw! 

As Yogi Berra famously said, “It’s déjà vu all over again”.

This is not the first time and certainly will not be the last that Microsoft issues critical security bulletins and patches. This warning is particularly timely in light of the upcoming holiday shopping season.  According to comScore, online purchases during the 2011 holiday season topped $37 billion, a 15% increase over the previous year.  Forecasters are projecting growth of 12% or more in 2012.

One of the security bulletins released on November’s Patch Tuesday addressed multiple vulnerabilities in Internet Explorer (IE). For those of you who have not followed my recommendation to dump IE in favor of Google’s Chrome browser, it is absolutely critical to apply this update as soon as possible.   This is even more urgent if you plan to shop online next week and enter your credit card information.

To make sure that Windows (and IE) is completely up to date, take a look at my September post.  It outlines the steps to verify whether Windows Updates are current and how to ensure they are installed automatically going forward.

While you’re at it, take a look at my March 2012 blog post about staying safe online. There I touch on public wireless networks, antivirus software, applying Windows Updates and utilizing strong passwords.  I also discuss the importance of ensuring that a website is secure (https://) before entering credit card information.

If you want more details on the current batch of Microsoft Updates (or simply need help sleeping), take a look at the article in PC World or Microsoft’s Security Bulletins.

Stay safe out there.  Please contact me if you need assistance securing your system.

Posted on

The Problems with Free Email

You finally made the jump from DSL to your cable internet service provider (ISP) and they offered a pile of “free” email addresses.  Awesome, right? Not so fast!

Before changing your address to billybob@coyotecable.com, there are a few things you should consider.

I work and communicate with a lot of people who took advantage of free email addresses provided by their ISP.  I always wonder what they will do when they decide to switch ISPs again to save a few bucks, improve their TV channel line up or escape a bad customer service situation.

Most of the free addresses in my area are with Time Warner Cable (TWC) or Bellsouth / AT&T.  In the last few years, AT&T’s U-Verse (TV/Internet/phone) has made a big splash in our market and lured away many long time cable and DSL customers.  So what happens with your Roadrunner email address when you jump ship?  I called the cable company to find out.  Unfortunately for cable customers, the email address goes away when you cancel cable.  Suddenly those free email addresses don’t look so free anymore!

Here are a few good reasons that using your provider’s free addresses is a bad idea:

  1. Portablility – as mentioned above, you frequently cannot take your email address with you when you leave the cable company for a new ISP.  A buddy of mine has moved from Chicago to New Orleans to California.  Each time he moves, his email address changes to the local cable company. I never know where to find him.
  2. POP – most cable companies offer very basic POP3 services.  In its most basic setup, any messages downloaded to Outlook or Outlook Express are removed from the email server.  Thus, if you want to look at your messages from another computer (at work) then you’re out of luck.
  3. Lack of features – many cable services offer email only.  While they have limited contact management features on their webmail portal, contacts don’t sync up well with Outlook or other mail clients. In the unlikely event that an online calendar is offered, it’s not very robust.
  4. SPAM – keep your email address long enough and you will eventually get so much spam that it’s tempting to abandon the account.
  5. Capacity – while some ISPs now offer larger email boxes, they have traditionally not provided a whole lot of capacity.  I recently looked at a business-class client whose ISP only allocated 100 MB to each mailbox.  That’s only about 20-25 photos of your newborn niece.
  6. Cost – “free” addresses are included in your monthly internet service bill.  However, if you jump ship to another company, be prepared to pay a monthly fee to maintain your old email address so friends, family and online retailers can find you. This, of course, assumes that you can keep your address at all. This happened to me when I left Mindspring a few years back.  I was able to keep the address for a monthly fee.
  7. Relay – Have you ever taken your laptop to a coffee shop or hotel and tried using Outlook or Windows Live Mail to answer your emails?  Incoming messages work fine. However, outgoing messages get stuck in your outbox and cannot send until you’re back at home.  This is because many POP3 accounts require authentication when a user is connected to a network outside of their home network.  This can be fixed with the right configuration.  Good luck setting it up so that it works right every time.

Back in the early days of the internet and email, I signed up for new dial up services every few months depending on who sent me floppy disks and a free trial.  I jumped from AOL to Prodigy to Infinet to CompuServe to WorldCom… It wasn’t a big deal because no one used email for important correspondence – just for forwarding jokes.

Changing your email address is not so easy today.  When you change your address, you not only have to notify friends and family, but also your customer accounts with Amazon, iTunes, ABC Bank, etc.  Changing addresses and logins tied to an email address can be a monumental hassle. As such, plan to transition to a new address over the course of several months.

What to use?

There are a variety of web-based email providers that are not tied to your physical connection.  Players include Gmail, Hotmail (now Outlook.com), Yahoo!, Netscape, AOL, Netzero, MSN, etc., etc., etc.  These are all free and will not change when you jump internet providers.

 Folks that know me and my love for all things Google will not be surprised to hear me recommend Gmail. There are a variety of reasons that I recommend Gmail including:

  1. Portability – since Gmail is web-based and not tied to your physical connection, there’s no need to change if you move your internet service.
  2. Web/cloud based – while it is possible to use an email client such as Outlook or Outlook Express, there’s no compelling reason to install anything onto your PC. Simply launch your browser and navigate to Gmail.com. If your hard drive crashes, there’s no need to worry about losing years of email, hundreds of contacts or your calendar. All of this information is stored safely in the cloud.
  3. Features – Gmail includes your email platform (complete with folder capabilities), a robust calendar system (allows multiple calendars and shared calendars) and a good contact manager. Additionally, Google Docs provides a web-based alternative to costly MS Office applications (Word & Excel).
  4. SPAM Filters – Google’s SPAM filters are phenomenal.  I have seen Yahoo accounts that receive SPAM 5:1 over legitimate messages.  On the rare occasion that SPAM gets through Google’s filters, I can flag it as SPAM and Google learns and prevents it in the future.
  5. Large capacity – the standard free account now offers 10GB of space – FREE.  That’s tremendous capacity.  I have used my Gmail account for almost 5 years and have only filled 31% of their generous allocation.  If that’s not enough space, purchase Google Apps for $50/year. They give you 25GB of space and a few other bells & whistles.
  6. FREE – yes, that’s correct.  It costs nothing.
  7. Relay – since Gmail is web-based you never have to worry about outgoing messages getting stuck in your outbox when you’re away from your home network.
  8. Mobile Sync – if you’re using an Android phone or tablet, simply link your device to your Google account and your email, calendar, contacts, cloud documents, etc. all seamlessly sync between Google’s cloud and your device. Apple’s devices sync well with your Google account too, once you configure the account properly.  Plus, when you delete or file messages on your portable device, they are synced with your inbox back at the computer and vice versa.  Blackberry?  Maybe.  Google has cooled to the BB platform, so support may be lean going forward.
One last thing to consider: Several free providers, including Yahoo and AOL, are tired of losing accounts to Gmail and have made it difficult to walk away from your account.  The most notable methods they use is to disable forwarding to another address and disable POP3 access.  This removes your safety net, since many people would simply keep the old account and forward it to the new account indefinitely. Yahoo will enable forwarding and POP3 if you pay them $20/year for a Premium account.

If you have an existing ISP email address and are thinking about jumping to another internet provider, it’s probably a good time to begin the process of closing your existing account and migrating to a new online account. I usually advise 3 months.

If your business is seeking branded email, we can help set that up as well.

Ready to make the jump but unsure where to start? Contact PartnerTechs for guidance and we will launch you painlessly into the 21st century.