Recent News – Page 25

Windows 10 Gets New Set Of Recommended Security Standards

November 23, 2017 by Joseph Martin

Microsoft has introduced a new set of standards designed to make computers running Windows 10 more secure.

Obviously, these standards are not industry requirements, and most of the off-the-shelf PCs you can buy will struggle to meet all of these requirements. In time, of course, that could change, but as things stand now if you’re interested in making your computer as safe and secure as it possibly can be, this is a road you’ll have to go down on your own and make the necessary mods and additions to your existing equipment. Here’s the summary, in a nutshell:

• 7th generation AMD or Intel Processors, because these contain MBEC (Mode-Based Execution Control)

• 64-bit processor architecture to take advantage of VBS (Virtualization-Based Security)

• Support for AMD-Vi, Intel VT-d, or ARM64SMMUs (this, to take advantage of Input-Output Memory Management Unit device virtualization)

• Purchase a Trusted Platform Module, if one is not already built into your existing chipset

• Make use of Platform Boot Verification to prevent the loading of firmware that was not designed by the manufacturer of your system

• A minimum of 8GB of RAM

• Use a system that implements UEFI (Unified Extensible Firmware Interface) 2.4 or above

• Systems should also support the Windows UEFI Firmware Capsule Update specification

• All drivers used should be Hypervisor-based Code Integrity compliant

At first blush, this list seems a bit daunting, but the cost requirements to better secure the Windows 10 PCs on your network are really not as bad as they first appear. In fact, it is possible to find a few off-the-shelf PCs that meet the newly published security standards, so if you’re ready to replace some of your network equipment, you do have at least a few options that don’t require you to custom build.

In any case, although it’s true that the new standards aren’t a magic bullet, they will certainly go a long way toward making your network as a whole more secure, making them a welcome addition indeed.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

New iPhone X May Be Susceptible To Burn-In

November 22, 2017 by Joseph Martin

Apple’s new iPhone X is a technological marvel that boasts the best display in the industry today, featuring Super Retina OLED display technology and offering a mind-boggling 1,000,000 to 1 contrast ratio.

Unfortunately, there’s a problem, as revealed by a new support document the company released on the iPhone X. In it, Apples states that users may experience shifts in hue and color, and burn-in with the new display, especially if they maximize the phone’s brightness and keep the same image displayed for long periods of time.

According to the support document itself:

“If you look at an OLED display off-angle, you might notice slight shifts in color and hue. This is a characteristic of OLED and is normal behavior. With extended long-term use, OLED displays can also show slight visual changes. This is also expected behavior and can include ‘image persistence’ or ‘burn-in,’ where the display shows a faint remnant of an image even after a new image appears on the screen. This can occur in more extreme cases such as when the same high contrast image is continuously displayed for prolonged periods of time. We’ve engineered the Super Retina display to be the best in the industry in reducing the effects of OLED ‘burn-in.'”

The company also recommends a simple workaround users can employ to minimize the chances of this occurring. If it’s something you’re concerned about, simply adjust your phone’s brightness as follows:

• Go to Settings, and then into General

• From General, tap Accessibility, and then Display Accommodations

• Adjust to taste from there

Another simple thing you can do would be to set your phone to auto-lock after a shorter period of time. To make changes to that feature:

• Go to Settings

• From there, select Display & Brightness

• Then, go to Auto Lock and set whatever time period you deem appropriate

While neither of these is perfect solutions, they will certainly get the job done for the overwhelming majority of users.

Joseph Martin

Many Businesses Found To Be Running Old Microsoft Office Versions

November 21, 2017 by Joseph Martin

When an operating system reaches the end of its supported life, such as Windows XP, NT and Vista have, it’s big news. It makes headlines. When other forms of software reach the end of the line, there’s just not as much fanfare. It’s not that it’s not important; it’s just not something people think or care very much about.

They probably should, at least according to a recently released survey by Spiceworks, which revealed statistics that were both shocking and dismaying. Here are a few of the highlights:

• Fully 68 percent of businesses surveyed are still running instances of Office 2007, in spite of the fact that the software stopped receiving security updates in October

• Nearly 50 percent (46 percent to be exact) are still running Office 2003

• 21 percent are still running Office 2000

• 15 percent are running Office XP

• And three percent are amazingly still running some instances of Office 97

Of particular interest was the fact that most of the firms running outdated software are mid-sized companies employing between 100 and 1000 people. Large companies have the resources to keep their software up to date and smaller firms, recognizing their lack of resources, have readily moved to embrace Office 365, which is always up to date, and thus, saves them money and headaches.

Those firms stuck in the middle, though, and possibly your own company, find themselves in a tricky position. They’ve invested heavily in productivity tools, they found themselves in the unenviable position of not having the resources to keep them fully updated, and of course, are reluctant to lose their investment by switching to Office 365.

It’s undeniably a balancing act, but the reality is that if your company is using outdated productivity tools, your risks of a breach are higher than they should be. It’s something that’s too important to gloss over or delay. If you’re using an outdated version of Office or other productivity tools, find a way out of that box as soon as is feasible. Your data security staff will thank you for it, and it’ll give you peace of mind.

Joseph Martin

Latest iOS Version May Have Bug That Changes Your Letters

November 20, 2017 by Joseph Martin

If you’re using an Apple device running iOS 11.0.3 or 11.1, you may have noticed some oddities when sending text messages. For reasons that aren’t quite clear, the letter “I” is being replaced by the characters “A[?].” It’s not a game-breaking bug, but it is annoying, and if you’re not paying attention, it can make for some rather mystifying text messages.

Fortunately, Apple is on the case, and the company has announced that they’ll have a fix for the issue in their next release. If you’d rather not wait, there are several things you can do in the meantime to work around the issue. In no particular order, these are:

• Simply disable Apple’s predictive text auto-correct feature. If you rely on it frequently, this may slow you down some, but is probably the most straightforward approach to take at the moment.

• Install a third-party keyboard app because these use their own predictive text features.

• Or, take Apple’s recommendation and set up a text replacement rule (essentially replacing “I” with “I”).

If you opt for this last approach, you’ll want to go into your phone’s settings, look under the general tab, then keyboard, and choose “Text Replacement.”

Tap the plus sign (+), then, for “phrase,” type in an upper case “I”. For a shortcut, type a lower-case “I.”

Save that change, and you should be all set.

To reiterate, this isn’t a huge deal, and it’s hard to see how this could cause anything but a bit of annoyance and perhaps a few scattered miscommunications. Even so, if you send more than a handful of text messages during the course of a typical business day, it’s probably worth spending a few minutes implementing one of these simple workarounds until Apple can ride to the rescue with a permanent fix.

Joseph Martin

Android Gets Fix For KRACK WiFi Vulnerability

November 19, 2017 by Joseph Martin

Last month, a new WiFi security vulnerability known as “Krack” was discovered by a security researcher named Mathy Vanhoef. It was about as serious as a security flaw could be, enabling hackers to clone a router and funnel traffic through it, either monitoring all the activity on the network or, if they wanted to be more destructive, conducting all manner of “man in the middle” attacks against anyone on the network.

The major tech companies were all given advance notice of Vanhoef’s research, and as such, not long after it was published, many responded almost immediately with patches. Apple, for example, released a Krack patch at the end of October.

Microsoft was even quicker to respond, releasing a patch to the problem quietly before Vanhoef’s research was even published.

In that regard, Google has been a bit behind the curve, but as of the release of this month’s Android Security Bulletin, the company has at last provided a fix for the issue.

This month’s update is spread over the following three updates:

• 2017-11-01

• 2017-11-05

• And 2017-11-06

The fix for the Krack issue is contained in this last one.

If your Android device is set to automatically receive security updates, then there’s nothing for you to do. The patch has already been installed on your phone.

If you tend to take a skeptical view of automatic updates, then at the very least, be sure to grab 2017-11-06. If you don’t, you’re probably putting your organization at unnecessary risk. If you want to check to see if you’re vulnerable before applying the update, you can do that, too. Vanhoef released his proof-of-concept code and detection tools on his GitHub account, and since releasing the data, an interested third-party has developed a tool aptly named “Krack Detector” you can use to see if you need the fix.

Either way, it’s worth looking into, and something your team should make a priority.

Joseph Martin

Facebook Has A Major Problem With Fake Accounts

November 18, 2017 by Joseph Martin

Facebook has been in hot water with evidence mounting that hordes of fake accounts were used to spread misinformation about the recent presidential election.

In addition to sparking congressional hearings, it also prompted Facebook and the other major social media companies to do a deep dive into their own active accounts and get a better sense of just how large and pervasive the problem was.

According to Facebook’s most recent quarterly earnings report, the problem turned out to be a fair bit larger than was first imagined. The company changed their methodology for tracking and identifying fake accounts, which has led to the grim discovery that some 13 percent of the company’s accounts are duplicates, a figure that doesn’t take into account the more than 60 million outright bogus accounts.

According to Facebook’s founder and CEO, Mark Zuckerberg, from in the earnings report: “We’re serious about preventing abuse on our platforms. We’re investing so much in security that it will impact our profitability. Protecting our community is more important than maximizing our profits.”

The problem is going to wind up costing Facebook in a number of ways. First and most obvious, of course, is the unwanted attention caused by the congressional hearings themselves, and the loss of trust it creates on the platform.

More immediately, there’s also the factor addressed directly by Zuckerberg in his statement. The company is spending a ton of money on improving security and rooting out and shutting down duplicate and fake accounts. As he indicated, it’s having an impact on their profitability.

It’s also impacting the company’s ability to generate ad revenue, which, of course, is based on the number of actual users the company can claim are viewing ads. With more than a quarter of a billion duplicate and fake accounts in the system, the network is simply less attractive to advertisers.

There are no simple solutions here, but kudos to Facebook for making significant investments to rein the problem in.

Joseph Martin

Touch And Vibration May Be The Fingerprints Of The Future

November 17, 2017 by Joseph Martin

Researchers at Rutgers University have hit upon a novel idea that could be a game-changer in terms of biometric identification. The team published a paper entitled “VibWrite: Towards Finger-input Authentication on Ubiquitous Surfaces via Physical Vibration,” and demonstrated a prototype of the device at the Association for Computing Machinery (ACM) conference in Dallas, Texas.

The new technology is a lesson in simplicity, consisting of a simple vibration motor and a receiver on almost any solid surface (wood, metal, plastic, glass etc.). The motor sends vibrations to the receiver, and when the user touches the surface, the vibration waves are modified, creating a unique signature.

By itself, this isn’t terribly remarkable or exciting, because a single finger touching the surface in question doesn’t create a signature that’s unique enough for individual identification. On the other hand, combining that basic idea with the act of drawing a pattern or entering a PIN on a vibrating surface would create patterns of sufficient complexity to identify individual users, and that’s where the real magic is.

It should be noted that at this point, the technology isn’t ready for mass production, and the research team estimates that it’ll probably be another two years until it is. Among other things the group still needs to improve are:

• Accuracy – There’s not much more to be done on this front. The current model is 97 percent accurate, producing only three percent false positives. However, that last three percent is crucial.

• Sensitivity – At present, the most persistent complaint associated with using the new technology is that users often have to re-enter the PIN, or retrace the pattern multiple times before they can pass the device’s authentication checks.

• Weather – Ideally, these devices could be placed everywhere, but in order for that to become a reality, they’ll need to be tested in a wide range of temperatures and humidity levels, which hasn’t been done yet.

All in all, it’s an exciting new technology with tremendous possibilities. It’ll be interesting to see how well it is accepted by the market.

Joseph Martin

New Ransomware “BadRabbit” Starting To See Infections In The US

November 15, 2017 by Joseph Martin

You may not have heard of the new strain of ransomware known as BadRabbit. If you haven’t, it’s because the overwhelming percentage of BadRabbit attacks have been occurring in Russia, which accounts for 71 percent of all known infections at present. Unfortunately, there have been a few infections reported in the United States, which may be a harbinger of things to come.

The new threat is functionally similar to NotPetya, which not only encrypts the files on a target system but also then encrypts the file system, which gives the victim a lovely ransom lock screen before the OS can even boot up.

Fortunately, there are simple things you can do to help protect yourself from this latest threat.

Event Log Monitoring

Windows Defender is capable of recognizing the threat, provided you’re using detections update 1.255.29.0 or higher. If you haven’t updated to this version, do so immediately.

Once that is done, be aware that BadRabbit will schedule tasks using the names “Viserion,” “Rhaegal” and “Drogon.” If you see any of these, it’s a clear sign of an infection in process on your network. Administrators can attach scheduled tasks to events bearing these names, running specified commands should one of these be detected. For example: initiating a “shutdown -a” command.

Obviously, this stuff can be quite complicated. We would highly recommend you reach out to us to not only scan your network but to also evaluate your entire network for potential threats or vulnerabilities. Ransomware is a real threat that is literally shutting down businesses, and this is on a global scale. If you aren’t being proactive against hackers, you can easily find yourself locked out of your own network.

BadRabbit is just the latest in hackers’ arsenal of ransomware and threats on your network. If you are as concerned as we are, give us a quick call.

Joseph Martin

Granting Photo Access In iPhone Might Allow Unauthorized Photographing

November 14, 2017 by Joseph Martin

An Austrian software engineer named Felix Krause has made a disturbing discovery about iPhones using iOS11. Once an app has been given permission to access the device’s camera, it can take pictures and videos without alerting the user and upload them to the internet in real time.

Unfortunately, there are a lot of apps that users grant camera permissions to. Basically, any time you upload an avatar or post a picture with an app, you’ve got to give it camera permissions to do that.

Krause documented his findings in a short video presentation. As long as an app with camera permissions was in the foreground, it could snap photos literally every second, all without the user being alerted to what was going on.

Krause was quick to point out that he wasn’t naming names, and so far, at least, there are no known instances of malicious apps abusing this flaw, nor are any legitimate apps misusing it to anyone’s knowledge. The simple fact that it is possible, though, opens the door to a whole host of malicious apps that could, and that’s disturbing.

For the moment, there are really only two ways to address the issue: either go in and modify all your apps’ permissions so that they no longer have camera access, or use lens covers to make it so that your front and back cameras can’t record anything unless you specifically want them to.

Longer term, there are a number of things Apple could do to address the issue. The two simplest fixes would be introducing expiring permissions for apps to allow for more precise user controls, or introducing LED lights that would activate any time the camera was in use, thus giving the user a clear visual marker.

In any case, for the moment, it’s important to know that your phone may be watching and/or recording you.

Joseph Martin

Watch Out For New Facebook “Trusted Friend” Scam

November 9, 2017 by Joseph Martin

If you can’t trust your friends, who can you trust?

No one, apparently.

There’s a new scam on Facebook that’s making waves, and it’s one you should be mindful of. You may get an “urgent message” from someone you know, asking for your help in recovering their Facebook account.

This is a tried and true phishing scam, relying on some basic psychology. After all, if you get an earnest sounding message from someone you know explaining that you’re listed as one of their “Trusted Friends” and as such, uniquely positioned to help verify their identity so they can get access to their account back, who wouldn’t instinctively respond? This is exactly what the scammers are hoping for.

The message goes on to explain that they’re sending an unlock code to your email address, and they just want you to reset the password for them.

Unfortunately, the unlock code is nothing of the sort. Instead, it triggers a password reset for your own account. If you click the link and “reset your friend’s password,” then reply back, helpfully telling him or her what the new password is, you’ve inadvertently given your own login information to the hackers. From there, the sky’s the limit.

What makes this latest scam particularly problematic is that so many other web properties allow you to use your Facebook login details to access them, which is a roundabout way of saying that you’re using the same login credentials across multiple websites – one of the most basic and pervasive problems of user security in existence.

There’s no real defense for this other than vigilance, and if you see a message like this, simply ignore it. If your “trusted friend” genuinely needs help regaining control of their account, Facebook has resources to assist.

Joseph Martin

Windows 10 Gets New Set Of Recommended Security Standards

New iPhone X May Be Susceptible To Burn-In

Many Businesses Found To Be Running Old Microsoft Office Versions

Latest iOS Version May Have Bug That Changes Your Letters

Android Gets Fix For KRACK WiFi Vulnerability

Touch And Vibration May Be The Fingerprints Of The Future

New Ransomware “BadRabbit” Starting To See Infections In The US

Granting Photo Access In iPhone Might Allow Unauthorized Photographing

Contact Info

Navigation