ALERT:  

 

Number of Manitoba Ransomware Victims Increasing

For those of you that still think that ransomware, viruses, or malware doesn’t happen here, or that your business is too small or insignificant to warrant CyberCriminals’ attention…I’ve got news for you!  The number of Manitoba businesses being hit with ransomare, malware, viruses, spyware, and just about anything else that CyberCriminals can dream up, has exploded in recent weeks.  AND the methods that CyberCriminals are using to trick computer users into opening scam emails, infected files and/or attachments, or providing personal/financial information are getting more and more advanced.

What Is Ransomware?

Ransomware is a serious security threat that basically kidnaps your data.  It limits access to files and/or system functions, sometimes even renders systems completely useless.  They then force their victims to pay ransom to regain access to their files and/or systems.

How to Protect Yourself & Your Business:

1.  Admit You’re a Possible Target:  The #1 step to stepping up your defenses, is to admit that your business could be a target.  If you are still in denial about this, you’ve probably already stopped reading, and there is nothing more I can do to help you.
2. EDUCATION.  EDUCATION.  EDUCATION.  The #2 key to avoid becoming a victim is, you guessed it…education.  Most new scams are being spread by social engineering and phishing scams, which are designed to trick people into thinking the emails are legit, and into opening the emails, and links or attachments.  The links and/or attachments then infect the workstation, and usually quickly spread through the network to other workstations.  Educate yourself and your employees about the dangers out there, and what to look for!  This means anyone in your business that even looks at a computer should be informed what scams are currently out there, what to look for, and how to avoid them.
3. Know How to Recognize a Scam Email:  Read our ‘Red Flag Emails‘ for clues on what to look for in suspect emails.  The general rule of thumb is:  If it looks suspect, and you can’t confirm that it’s the real deal…DELETE IT. 
4. Install Updates:  In spite of knowing the importance of installing software/hardware updates, a lot of people either put them off or skip them all together.  Either the re-boot that your computer needs after installing the updates is ‘inconvenient’, or there are always ‘glitches’ after installing updates, etc etc.  We’ve heard all the excuses.  The bottom line:  Is a 3 minute inconvenience to re-boot your computer, or putting up with potential glitches, or any other potential ‘inconveniences’ worth plugging any security holes in your computer system.  I say yes, but that’s just me…
5. Keep Hardware and Software Up-to-Date:  Outdated hardware and software is often no longer supported by the manufacturer.  You’re thinking, “So what?  I don’t need their support!”.  This is a frequent misconception.  Periodically, a manufacturer decides that it will no longer “support” older software and/or hardware, in favor of concentrating on newer, better releases.  When a manufacturer no longer supports a piece of hardware/software, this means that they are no longer releasing the updates to plug known security holes.  This means HUGE security risk for your company!  This could also mean litigation, if you handle client information, payment information, etc.
6. Do Not Click Links Within Emails:  If you receive an email that has a link to a website and/or webpage on it, especially if the link does not match the tone of the email, or if it is to something that this person (if you know them) would normally send you — DO NOT CLICK!  A good trick:  hover the mouse over the link (Do NOT Click!!).  If the ‘box’ that appears does not match what the link states — it’s a fake and will cause you & your business some trouble if you click on it.  
7. Do Not Call Companies From Phone Numbers in Emails:  If you receive an email asking you to contact ‘Tech Support’ (or anything else for that matter!), get the phone number to call directly from their website.  Lots of scams involve fake phone numbers directing you to a legit-sounding department, then proceed to ask for personal information, credit card information, log in info, etc.
8. Spam Filter:  Tens of trillions of spam email is sent every year, to inboxes across the globe.  A spam filter stops 95% of spam emails from ever reaching your employees’ inboxes in the 1st place…for less than a cup of coffee..  Because all it takes is one careless click, and your business could be compromised.
9. Backup, Backup, Backup.  If everyone had reliable backups, ransomware wouldn’t even be an issue.  If you have a reliable backup, you don’t have to pay the hundreds or thousands of dollars in ransomware (and put an even bigger target on your business, because CyberCriminals now know that don’t have backups!) to get your own files back.  Instead, your files can be retrieved from your last backup, and you’re up and running!  

Not sure how secure your network is?  Ask us about our Network Security Assessment!  Mention this post & get it FREE!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  ‘Locky’ Gaining Momentum…and Victims

 

This new CryptoLocker strain isn’t more sophisticated than any of the other versions of the malware, but it is spreading rapidly.  The FBI has released a statement in a recent Wall Street Journal article, stating that the threat from ransomware is expected to grow exponentially.

Forbes claims that ‘Locky’ CryptoLocker is infecting approximately 90,000 computers per day, and is costing victims approximately .5-1 Bitcoin (approx. $420US) to unlock their systems.

Locky is spread through phishing emails containing Microsoft Word attachments.  The last few days, Locky creators has sent at least 4 million phishing emails with a zip file as the attachment.  The zip file contains a JavaScript file which downloads and installs Locky.  

How to Protect Yourself:

1. Block any and all emails with .zip extensions and/or macros at your email gateway level.
2. Disable Adobe Flash Player, Java, and Silverlight if possible.  These are all used as attack vectors.
3. Educate your employees and coworkers to the danger, so they can recognize the red flags related to ransomware attacks.
4. Check out our Red Flag Emails for clues on how to spot a spam email.  Print it, and pass it out to all employees and coworkers so they can post it at their workstation as a reminder.
5. Ask us about a Spam Filter for your company.  More affordable than you think, and a very reliable way to eliminate 90% of spam from ever entering your inbox!
6. Back up your data!  Now, more than ever, backups are an everyday essential for every business!  Ask us for a FREE quote!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:

Netflix At No Charge

 

With their recent globally launched streaming service, Netflix’s popularity is gaining steam.  

Unfortunately, in today’s world popularity equals hacker target.

There are active malware and phishing campaigns targeting Netflix users with several scams:

1.  One scam claims you need to update your payment information

2.  Another claims that there has been “unusual” or “unauthorized activity on this account”

3.  Still others try to trick you into downloading software for a cheaper version of Netflix

These are just a few of the scams currently circulating.  

How To Protect Yourself:

1. If you receive an email that looks like its from Netflix, and claims you need to update payment information, DO NOT CLICK on any links or open any attachments.
2. Do not download anything from a MMS or a email.  Only download Netflix software directly from the Netflix website or official app stores.
3. ALWAYS go to the websites yourself, instead of clicking on a link in an email.
4. If you want to be 100% sure, call their customer service directly, using the 1-800 number you find on their website.

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:

MS Word Ransomware

 

 

Over 400,000 workstations were infected within a few hours of it being released.  

24 hours after being released, only 3 very specialized AntiVirus detected the ransomware.  

Now, most major AntiVirus products now detect the ransomware

…but only if the user is updating their AntiVirus.

It was only a matter of time before some CyberCriminal figured out how to insert ransomware into a MS Word document.

Some professional CyberCriminal finally did it.

The new ransomware called “Locky”, was first reported in the UK by Kevin Baumont, is causing major headaches for companies all over the globe, and have been received by companies in Canada, and even here in Manitoba.

Emails contain the subject line “ATTN: Invoice J-98223146”, and a message like “Please see the attached invoice (Microsoft Word Document) and remit payment according to the terms listed at the bottom of the invoice”, or something similar.  The email looks similar to the one below:

When opened, the attachment is a MicroSoft Word document that looks like the content of the document is scrambled.  The document will display a message stating that you should enable the macros if the text is unreadable.  The attachment will look similar to this:

Once the victim enables the macros, the macros downloads an executable file from a remote server.  This file will be stored in the “%Temp%” folder and, when executed, will encrypt the files on the workstation, then both mapped and unmapped network drives.

Once this has happened, you receive the message below:

Similar to CryptoWall, Locky also completely changes the filenames for encrypted files to make it more difficult to restore the right data.  At this time, there is no known way to decrypt files encrypted by Locky.

How to Defend Yourself:

Have your I.T. person hunt for this Group Policy Setting, and set it to “Disable all except digitally signed macros”.

Now check out Trusted Locations:  User Configuration/Administrative Templates/Microsoft Office XXX 20XX/Application Settings/Security/Trust Center/Trusted Locations

Set your shared folder location URL in here, e.g. //blah.local/public/office

More details at Microsoft Tehnet here.

The user won’t see a prompt to enable the macro, nor can they from the Office options.

There is a still a small risk that the user will save the malicious email attachment to the network and open it.  However, it is a much smaller risk than before.

Here is a very small sample of how far & fast Locky has spread:

Not sure if your company is safe?  Ask us for a FREE Network Security Assessment!

Check out our “Email Red Flags”  for what to watch for in suspicious emails. 

Ask us about our “Core Security Solutions” package!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  WordPress Website Hack

 

An alarming number of websites built with popular website-building tool, WordPress, have been hacked, and are delivering the TeslaCrypt ransomware to unsuspecting victims.  

Malware researchers from Malwarebytes and other security firms have reported that a massive number of legit WordPress sites have somehow been compromised, and are silently redirecting visitors to sites with Nuclear Exploit Kit.  As of press time, it is unclear how the WordPress websites are getting infected, but is highly likely that there is a new vulnerability that is being exploited in either WordPress, or one of its plugins.

Malwarebytes Senior Security Researcher Jérôme Segura stated in a blog released last week:

“WordPress sites are injected with huge blurbs of rogue code that perform a silent redirection to domains appearing to be hosting ads.  This is a distraction (and fraud) as the ad is stuffed with more code that send visitors to the Nuclear Exploit Kit.”

The attack tries to conceal itself, and the code forces visitors to be redirected through a series of sites before dropping the ransomware payload.  Once a WordPress server is infected, the malware also installs a variety of backdoors on the machine.

 

What to do if You Run WordPress:

1. Update server Operating Systems (OS).
2. Update WordPress.
3. Delete any plugins you are not actively using, and update patches on any plugins you currently use.
4. Update all your WordPress instances at the same time to prevent cross-infections.  
5. Lock down all WordPress instances with a very strong password, as well as the WordPress 2-factor authentication

How to Protect Your Website Visitors:

1. Keep workstation Operating Systems (OS) and 3rd party apps updated at all times.
2. Backup your data and keep daily off-site backups.  TEST your backups, and if your restore function actually works (this is often overlooked).
3. Provide end-users with the 64-bit version of Google Chrome if possible.
4. Run the latest V5.5 of Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) on workstations.
5. Provide Security Awareness Training.

Not sure if your company is safe?  Ask us for a FREE Network Security Assessment!

Check out our “Email Red Flags”  for what to watch for in suspicious emails. 

Ask us about our “Core Security Solutions” package!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:

Your Stolen iPhone Has Been Found

 

The enormous sales of Apple products, also mean that they are a huge target for theft.

Between 3 and 4 million smartphones are stolen every year.  

If you’re like most people your phone tends to be a little bit of everything:  a photo album, a diary, wallet, gaming machine, bank account, and more.  Most people have their entire work and private lives on these devices which can cost up to a thousand bucks.  The cost of losing your phone just starts with the cost of replacement…just take a moment to think about all the personal and financial information your phone contains.  Losing it can feel like a disaster.

CyberCriminals count on this panic, and use it for their gain.  They count on the person wanting to avoid the personal and financial loss, in order to use social engineering against them.  

In this new iPhone scam, people are victimized twice:

1. Your iPhone gets stolen.
2. You go online, and turn on the ‘Find My iPhone’ Activation Lock.
3. Shortly afterwards, you receive an email that your iPhone has been found, but you need to go to this website (they provide a link) and verify your Apple ID.  
4. You click on the link provided, and enter into your Apple ID credentials.

The link that was provided, was to a fake Apple iCloud site.  When you entered your information, you gave all the information that the CyberCriminals needed to now own your account and unlock the phone.  The CyberCriminals are now free to sell the phone.

There is nothing else for you to do, other than to go to Apple (go to the Apple site, or type in the address into the address bar manually – Not the one provided in the email).  Change your password, and set up a 2-factor verification for your account.

Your iPhone (or iPad) is gone forever.

 

How CyberCriminals Do This:

Since the release of iOS7, Apple has made it entirely possible for CyberCriminals to reset and reformat your iDevice without your iCloud Username and Password.  They simply send an iMessage to the email address that it said it had been locked by, as the default iOS settings mean you can send & receive iMessages to email addresses with an Apple ID.

It’s important to note that iCloud does not provide an IP address or any other details which will help you actually identify your thief.  It basically shows you a map of the general vicinity of the location of the stolen item (could be 1-3 city blocks), and that’s all.  

What to do if Your iPhone (or iPad) is Stolen:

1. Do Not respond to, or click on links, from an address you do not recognize claiming your phone was found.  
2. Do not click on any links, or open any attachments provided.  Do not call any phone numbers that the message may give you.  
3. Do not log into any site that you get within an message like this, and do not provide your username and password, or any other credentials.
4. DO follow the procedures you were given by your phone manufacturer.  If you do not know the procedure, go directly to the manufacturer website to find out.
5. For Apple go to:  https://support.apple.com/en-ca/HT204315
6. Deactivate the phone with your wireless provider to prevent the theif from running up a lot of charges on your bill.  Some providers will deactivate your device on their network, which prevents a thief from just resetting the device and slapping in a new SIM card.  Note:  Once you deactivate service, you won’t be able to communicate with your iPhone via ‘Find My iPhone’.  
7. Start taking steps to prevent the criminals from accessing your personal information.  Visit the website for every app and service on your phone, and see if they have the option to logout other devices, revoke tokens, or de-register mobile devices.  This will prevent the thief from simply firing up an app or website and using your saved login info.
8. File a police report.  It’s unlikely that the police will act upon the theft, but it is important to document the theft, especially if the device turns up later.  Be sure to include a unique identifyer for your device (phone number or serial number).
9. Change any passwords for email, Facebook, etc.  
10. Inform your family, friends, coworkers, and all contacts in your address book.  It’s possible that the thief may try to impersonate you through social media or via SMS on a different phone. By letting them know, you can prevent them from being victimized as well by a phone/email scam.

Not sure if your company is safe?  Ask us for a FREE Network Security Assessment!

Check out our “Email Red Flags”  for what to watch for in suspicious emails. 

Ask us about our “Core Security Solutions” package!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks