Blog – Page 7

If You Use Photoshop, Update Immediately

August 28, 2018 by Joseph Martin

Do you use Photoshop? Does anyone who works for you use it? If so, you’ll want to apply the latest security patch immediately.

Two new vulnerabilities were discovered after the release of Adobe’s regularly scheduled August 2018 security patch update. This prompted the company to take the unusual step of releasing an emergency, out-of-band update to correct the issue.

These two newly discovered vulnerabilities (tracked as CVE-2018-12810 and CVE-2018-12811) impact Adobe photoshop CC2017, v18.1.5 and earlier 18.x versions, and Adobe Photoshop CC 2018, v19.1.5 and earlier 19.x versions.

It was discovered and initially reported by Kushal Arvind Shah, a security researcher with FortiGuard Labs. The vulnerabilities allow hackers to exploit a pair of critical memory corruption flaws, which allows a them to remotely execute malicious code on the target user’s machine.

Again, it must be stressed that neither of these issues were addressed by the company’s regularly scheduled patch update released earlier this month. Although if you haven’t yet applied that patch, you should. It addresses a total of eleven different security flaws spread across a number of the company’s products including: Flash Player, Acrobat, Reader, Experience Manager and Creative Cloud.

To get the fix for the Photoshop vulnerabilities, you’ll need to go to the company’s website and download the out of band patch designed specifically to address this issue.

It should be noted that both issues, while having been assigned a severity rating of “Critical,” have only been given a priority rating of three. This suggests that these flaws have not been exploited in the wild. That, however, is simply a matter of time. If members of your creative team employ Photoshop to generate graphics for your business, applying the latest patch should be a top priority. To do anything less is to invite an attack against your business.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

New Intel Vulnerability Named Foreshadow Found

August 27, 2018 by Joseph Martin

Intel has had a tough time of things so far this year. The most recent trouble stems from yet another newly discovered security flaw in the company’s processors, bearing the inelegant name of “L1 Terminal Fault,” or “Foreshadow” by those who have discovered it.

The attack can take one of three different shapes (so far), and ultimately allows a hacker to access sensitive data stored in the computer’s memory or on third-party cloud-based storage services. This sensitive data includes passwords, pictures, other sorts of data files, and encryption keys.

The three variants of the attack have been grouped into two distinct categories, known as Foreshadow and Foreshadow NG (Next Gen).

The standard Foreshadow variant (Reference CVE-2018-3615) targets Intel’s Software Guard Extensions (SGX), which is new technology designed by intel to help keep user data from falling into the wrong hands, even if the whole system comes under attack.

As the researchers who discovered it describe it:

“Foreshadow enables an attacker to extract SGX sealing keys, previously sealed data can be modified and re-sealed. With the extracted sealing key, an attacker can trivially calculate a valid Message Authentication Code (MAC), thus depriving the data owner from the ability to detect the modification.”

The Foreshadow: Next Generation attack (reference CVE-2018-3620 and CVE-2018-3646) targets virtualization environments like those used by large cloud-based service providers like Microsoft and Amazon.

From the researchers again:

“Using Foreshadow-NG, a malicious program running on the computer might be able to read some parts of the kernel’s data. As the kernel has access to data stored by other programs, a malicious program might be able to exploit Foreshadow-NG to access data belonging to other programs.

Foreshadow is different from Meltdown as it targets virtual machines and SGX, in addition to data stored in the operating system’s kernel (which was targeted by Meltdown).”

According to Intel, none of these attacks have been seen in the wild, but of course, that’s just a matter of time now. No word from Intel yet on a time frame to address these issues, but stay tuned.

Joseph Martin

Macs Can Be Hacked With Synthetic Dismissal On Warning Boxes

August 25, 2018 by Joseph Martin

Depending on the lens you view him through, Patrick Wardle (former hacker for the NSA and macOS security expert) is either your best friend or your worst nightmare.

Most people (whether fans of Apple or not) will readily concede that the company works hard to make their products as secure as possible. Unfortunately, at this year’s Def Con hacker convention in Las Vegas, Wardle made a presentation that is currently sending shockwaves through the Apple user community. He exposed a major security flaw in the company’s products that impacts many of their secondary defensive measures.

Normally, when an Apple device detects an action that is potentially malicious, Apple’s OS will block it, then display an alert box to let the user know.

Unfortunately, as Wardle demonstrated, it is a trivial task for a hacker to generate a “synthetic click” to dismiss the warning box. This could be done in the blink of an eye, or with only slightly more effort, and be made utterly invisible to the end-user.

As Wardle puts it, “The ability to synthetically interact with a myriad of security prompts allows you to perform a lot of malicious actions. Many of Apple’s privacy and security-in-depth protections can be trivially bypassed.”

This is hardly a new trick. Over the years, several malware strains have used synthetic clicks to dismiss warning boxes, so Apple is certainly no stranger to the strategy. In response, they have given their OS some ability to detect and ignore synthetic clicks, but as Wardle demonstrated, it’s far from perfect and even a fully updated High Sierra system was not completely protected.

Wardle concluded his presentation with the following: “I wasn’t trying to find a bypass, but I uncovered a way to fully break a foundational security mechanism. If a security mechanism falls over so easily, did they not test this? I’m almost embarrassed to talk about it.”

Apple has not yet responded to Wardle’s presentation.

Used with permission from Article Aggregator

Joseph Martin

Fax Machines Might Be Gateway To Next Hacker Attack

August 24, 2018 by Joseph Martin

Nothing bad could possibly happen to your company’s network if the only piece of information the hackers have is your fax number, right?

Unfortunately not, according to recent research by employees at Check Point.

They recently revealed details about not one, but two different REC’s (Remote Code Execution) techniques that exploit flaws in the communications protocols of tens of millions of fax machines spread all over the globe.

If you think the Fax machine has largely gone the way of the dinosaur, think again. Many printers sport “all in one” functionality, which includes both scan and fax functionality, and therein lies the problem. Since these printers are invariably attached to your network, your fax number is a good a way in, since most people don’t even think about it.

Called the “Faxploit,” the new attack type involves a pair of known buffer overflow vulnerabilities, CVE-2018-5925 and CVE-2018-5924, which allows anyone who takes advantage of them to have the ability to execute code remotely.

The researchers who discovered the issue created a proof of concept video demonstrating the attack in action. In their demo, they made use of an HP Officejet Pro 6830 and an OfficeJet Pro 8720, sending an image file with a malicious payload through the phone line. The moment the fax machine receives it, the image is decoded and uploaded into the fax/printer’s memory.

From there, the sky is the limit. Having gained a foothold on the network, what happens next is entirely dependent on the nature of the payload delivered. One thing you can be sure of, however, is that none of the outcomes you can expect will be good.

The researchers point out that there’s nothing special about the two all in one printers they selected, and the vulnerability will work on just about any make or model. Something new to be worried about.

Joseph Martin

Android Still Tracking Users With Location History Turned Off

August 22, 2018 by Joseph Martin

According to Google’s support page on the matter, disabling your phone’s “Location History” in your phone’s privacy settings will prevent Google from tracking every move you make.

The support page reads as follows:

“You can turn off Location History at any time. With Location History off, the places you go are no longer stored.”

That doesn’t leave much in the way of wiggle room. A pity it’s not even close to being true.

A new investigation conducted by the Associated Press reveals that even with your Location History turned off, some Google Apps are designed so that they automatically store time-stamped location data on users, without asking their permission.

The AP report on the matter explains in further detail:

“…for example, Google stores a snapshot of where you are when you merely open its Maps app. Automatic daily weather updates on Android phones pinpoint roughly where you are, and some searchers that have nothing to do with location, like “chocolate chip cookies,” or “kids science kits,” pinpoint your precise latitude and longitude – accurate to the square foot – and save it to your Google account.”

To demonstrate their claim, the AP created a map of the movements of Gunes Acar, who carried his Android phone with “Location History” switched off in a bid to prevent his location data from being collected.

Despite taking this step, the AP researchers were able to produce a map of his train commute on a pair of trips to New York and visits to the High Line park, Chelsea Market, Hell’s Kitchen, Central Park, and Harlem. The team also discovered his home address in this manner, but in a bid to protect the professor’s privacy, they did not publish that information on the map tracing the routes mentioned above.

At this point, Google has not responded to the AP’s research.

Joseph Martin

Social Media App Filters Could Alter Beauty Perception

August 21, 2018 by Joseph Martin

File this one away under “unintended consequences.” There’s a newly emerging trend in the medical community called “Snapchat Dysmorphia” that’s leaving plastic surgeons around the country to sound the alarm, and in some cases, scratch their heads in disbelief.

Recent research conducted at Boston University has discovered that the digital filters featured prominently in social media services like Snapchat are influencing how Millennials think about beauty. It’s causing significant numbers of them to investigate the possibility of getting plastic surgery in order to look more like the filtered pictures of themselves.

The newly minted term, ‘Snapchat Dysmorphia’ is a variant of body dysmorphia, which is a mental health condition that causes people to be stressed and obsessed with the way they look. Previously, one of the leading causes of body dysmorphia has been the unrealistic standards of beauty portrayed in magazines and on televisions. These media portrayals include supermodels with perfect bodies setting a standard of perfection that few can ever hope to achieve.

The more recent trend, however, is an increasing percentage of young people wishing to look more like their filtered-image selves, with, as the report highlights, “fuller lips, bigger eyes, or a thinner nose.”

The researchers went onto say, “This is an alarming trend because those filtered selfies often present an unattainable look and are blurring the line of reality and fantasy for these patients…overall, social media apps, such as Snapchat and Facetune, are providing a new reality of beauty for today’s society. These apps allow one to alter his or her appearance in an instant and conform to an unrealistic and often unattainable standard of beauty.”

If you have a child who spends a significant amount of time on social media, then it’s something to keep a close eye on. Based on the data, this trend is only going to get stronger over time.

Joseph Martin

Survey Shows People Are Most Concerned About Data Theft

August 21, 2018 by Joseph Martin

How seriously does the average consumer take data theft? It’s an interesting (and fair) question, and one that Radware recently attempted to answer when the company sent out surveys. They contacted more than three thousand people to conduct its recent survey titled “Consumer Sentiments: Cybersecurity, Personal Data and the Impact on Customer Loyalty.”

As it turns out, today’s consumers take the matter even more seriously than many other types of crimes.

Here are some of the highlights from the recent report:

A full 55 percent of those surveyed said that data theft was their top concern

The theft of a personal wallet ranked a distant, with just 23 percent of respondents placing it as their top concern

10 percent of respondents listed auto theft as their primary concern

Just 6 percent listed the theft of their cell phone and house keys as their #1 concern

Anna Convery-Pelletier, Radware’s Chief Marketing Officer, had this to say about the report:

“It’s no surprise that data theft ranks so high in the minds of Americans as a major risk. It’s easy to buy a new car or a new cell phone, but having private data exposed can have permanent consequences for both the consumer and the brand where the breach occurred. When an organization does not properly secure its network, it is putting its brand reputation in jeopardy and risking its customer base.”

While that’s true, some of the results are curious. After all, the theft of a cell phone ranks quite low in terms of top concerns, but cellphones contain a treasure trove of personal data, which points to an odd disconnect in the survey results.

Additionally, while 54 percent of survey respondents said that having their social security number stolen was a major concern, only 18 percent said they were worried about having their banking information stolen, and only 9 percent listed the theft of healthcare information as a big issue.

In the end then, the survey raises at least as many questions as it answers, but it does shine a much needed light on a fascinating topic. Clearly, more study and education is needed.

Joseph Martin

PGA Golf Organization Gets Hit By Ransomware

August 20, 2018 by Joseph Martin

These days, we expect giant corporations, government agencies and medical facilities to be the targets of hackers. However, golf is something new.

According to a recent report from GolfWeek, the PGA’s offices have been hacked and infected with what appears to be the “BitPaymer” ransomware. That’s the same strain that recently hit the town of Matanuska-Susitna, in Alaska, forcing city officials to resort to the use of typewriters for a week until they got their system back.

The interesting thing about this is the fact that BitPaymer isn’t a new ransomware strain. It’s actually been in the wild for quite some time. Until very recently, it’s kept a low profile and hasn’t been widely used.

That appears to be changing. While the recent spike in BitPaymer infections can’t be called a serious trend on the web as a whole, it is true that the ransomware is suddenly getting a surge of attention from hackers.

One of its hallmarks is the fact that the people using it tend to demand much higher ransom amounts than average to decrypt files locked by the malicious software. Unfortunately for those affected by it, BitPaymer is quite secure, so victims have no choice but to pay up or restore their files from their most recent backup.

This represents a disturbing event on two fronts. First, it seems that no target is safe from hacking, not even something as innocuous as golf. Second, if the current trend continues, (and there’s no reason to think that it won’t), we’re going to be hearing more about BitPaymer attacks in the weeks and months ahead.

As ever, vigilance is the best defense. Make sure your IT staff is aware of this latest threat to system security. It may be time for another round of email education for all employees, to stress the importance of not opening messages from unknown parties and being wary of downloading files or clicking links unless the sender’s identity can be confirmed.

Joseph Martin

Android Gets New OS Update Named Android Pie

August 17, 2018 by Joseph Martin

Android 9 is finally here, at least for some users. As of today, if you have any of the following phones, you can get the latest update:

The Google Pixel

The Pixel XL

The Pixel 2

The Pixel 2 XL

The Essential Phone

The company is currently working with other vendors to make the new update available. So if you’ve got an Android device other than those listed above, you should have access to the new version later this fall.

As to features, there’s a lot to like. Google borrowed from Apple’s playbook in at least one way by changing its navigation. It replaced its three-button navigation bar with a new gesture-based system that allows you to switch from one app to another by using natural gestures, which is a nice addition.

Additionally, the new OS makes excellent and much heavier use of machine learning and AI than any of its predecessors. Among other things, these changes subtly impact your phone’s brightness and battery power prioritization, which extends the time between recharges.

The phone learns how you use it and adapts accordingly. It also adapts to environmental conditions, adjusting display brightness as those conditions change.

Another new feature called ‘Slices’ brings relevant segments of certain apps forward, as needed. For example, if you’re searching for a ride, your phone will bring real-time pricing and driver ETAs from services like Lyft and Uber to the foreground.

There’s also a new suite of features under the general heading of “Digital Wellbeing,” which includes a “Do Not Disturb” mode that blocks notifications and sounds, and also grays out the screen to help eliminate unwanted intrusions.

The Digital Wellbeing dashboard also tracks and displays how much time you’re spending on each of the apps on your phone and allows you to set App Timers which will help you better manage the time you’re spending.

On balance, we love the robust new feature set, and we think you will too! If you have one of the devices mentioned above, you can download the update now by going to “Settings – System – System Update”, and then tapping “download and install.”

Joseph Martin

Microsoft Is Keeping Classic Skype, For Now

August 16, 2018 by Joseph Martin

Microsoft recently found itself on the receiving end of more than a little user rage when they made significant changes to Skype, with the release of version 8. The company’s original plan was to model Skype 8 after several different social media services, but the users found the new interface to be both annoying and frustrating.

On the face of it, Skype 8 boasts a number of impressive enhancements, enabling users to screenshare inside calls, connecting with up to 24 users simultaneously and sharing up to 300MB of files via the Skype application itself. Plus, it offers free HD video.

Unfortunately, users weren’t pleased with the fact that the redesign relied on a single window. This makes it impossible to multitask with separate conversations occurring in different windows. Some of the new features lacked professional polish (like emoji’s and @mentions). These features would be fine for a consumer grade app, but the desktop version of Skype is something that businesses rely on heavily, and those features are of little value there.

It caused such an uproar in the Skype user community that the company abandoned their plans to end support for Skype 7 on September first, and re-branded it as “Skype Classic,” leaving it in place for the time being. Ultimately, the feeling is that “Skype Classic” will be killed off at some point, but for now, Microsoft has chosen to listen to their user base and continue offering support for it.

The future, however, is uncertain. While the temporary stay is useful, it is not yet known how long that will hold. The company might intend to go back to the drawing board where Skype 8 is concerned and re-think some of their design decisions to make the new version more palatable to Enterprise users. Time will tell.

Joseph Martin

« Previous Page
1
…
5
6
7
8
9
…
31
Next Page »

If You Use Photoshop, Update Immediately

New Intel Vulnerability Named Foreshadow Found

Macs Can Be Hacked With Synthetic Dismissal On Warning Boxes

Fax Machines Might Be Gateway To Next Hacker Attack

Android Still Tracking Users With Location History Turned Off

Survey Shows People Are Most Concerned About Data Theft

PGA Golf Organization Gets Hit By Ransomware

Android Gets New OS Update Named Android Pie

Contact Info

Navigation