As is the case with many government screw-ups, the Office of Personnel Management (OPM) hack reported last week has now been revealed to be much more worse than originally thought. Instead of four million civilian federal employees having their PII exposed, investigators now believe as many as 14 million prospective, current and former employees have been exposed. In addition to the usual PII (name, address, Social Security #, DOB, etc) the information also included background investigations which are known to include things like arrest records, financial history, medical problems, as well as information about colleagues, friends, neighbors and relatives.
What this means for you:
Given the large number of current and former government workers, it’s highly probable you or someone you know falls into the 14 million compromised in this attack. There are things you or they should be doing, not the least of which are the following:
- Set up credit monitoring for you and your family – take advantage of the free services offered, or set up something independently.
- Freeze your credit file – Krebs on Security has an excellent explanation of how to accomplish this.
- Review the Federal Trade Commission’s recommended actions.
- Watch your important online accounts like a hawk and investigate any suspicious activity immediately.
Last week, over 4 million people had their PII (Personal Identifying Information) exposed. Suggestive humor aside, this is still scandalous as this breach came by way of the Office of Personnel Management (OPM – the government’s HR department), an agency supposedly being protected under the watchful eye of the Department of Homeland Security’s (DHS) $4.5B National Cybersecurity and Protection System (NCPS), aka “Eienstein”. I’m sure that the real Einstein would be horrified to know that his good name was being sullied by a multi-billion dollar boondoggle. Adding insult to injury, the PII exposed wasn’t your “run of the mill” variety either – OPM databases housed information on security clearance investigations which also contains information on family, neighbors and close associates of any government employee who went through that process – meaning a lot more than “just” 4 million people were affected. Not quite disturbed enough yet? The OPM data infrastructure was housed in a “shared data center” which provided services to many more government agencies, all of whom could have been breached as well. US government officials have made noises that the Chinese are to blame, and of course, China called those allegations “irresponsible” and “baseless”.
What this means for you:
What this event demonstrates is that stupid amounts of money can’t buy security if you are always playing catch-up. DHS’s Einstein is only able of detecting attacks that have been seen before – it’s basically a monstrously expensive filter that looks for “signatures” that are based on – that’s right – previous attacks. Once the hack gets past the gate and they are able to “own” the system by using legitimate credentials (either stolen or created through their initial hack), the attackers can transact business through normal protocols and transactions, making detection extremely difficult. It’s the equivalent of looking for a needle on a conveyor belt full of hay – and you don’t know even know what the needle looks like, other than “not hay”. It seems that we will need a real Einstein to develop a system that can detect attacks that have never been seen before.
I can hear you say, “If the government can’t secure themselves with $4.5B, how am I supposed to do it with my modest means?” Well, if a nation-state is targeting your organization, probably no amount of money you could reasonably spend is going to protect you. Fortunately, nation-states and advanced persistent threat (APT) groups usually have bigger fish to fry. The “garden-variety” malware you and your employees will encounter can be stopped by a combination of up-to-date antimalware software, a good firewall, and training. In the case of our government, technology advances are hampered by an alphabet-soup of bureaucracy and glacial culture adoption, something attackers count on. Don’t let red tape slow down your organization on this issue – security should be at the top of your list and a budget priority, no matter your industry or size.
Despite how dependent we all have become on it, the Internet still remains a mystery to most folks. There’s a good reason for it – it is complicated and for most, it’s not their job, nor their interest, to have a comprehensive grasp of how data gets from point A to point B. But just like other things we usually take for granted – water, electricity, our cars – when it stops working, we really notice and chafe at any delays to restore normal service. In the case of a water or car problem (most of us are smart enough to not mess with electricity or natural gas!), we’ll try to roll up our sleeves, pop the hood and grab a wrench, but calling a professional is probably the safest and most effective way to get things working again. This is also the case with internet service, but believe it or not, there are some things you can do to troubleshoot and possible restore service, as long as you understand the basics of how the internet is delivered and connected to your location.
Let me break it down for you. Don’t worry, I’ll keep it simple.
First off, you have to have an Internet Service Provider (ISP). It’s important to know who this is, what your account number is, and what the Customer Support number is for that service. You should have this info printed out and easy to find, because, guess what? When the internet is down, it might be hard to look up that info.
Your ISP will deliver internet through a number of different physical types of circuits. The most common are fiber, coax (commonly known as “cable”), and twisted-pair copper. This last one can take various forms, many of which you should be familiar – T1’s, DSL and Ethernet over Copper (EoC) – are all delivered via simple copper wire. This physical circuit will be “terminated” (ie. plugged into your location) in an Minimum Point of Entry (MPOE) or a Demarcation Point (DMARC) which, depending on the type of building, can be a basement, phone closet, a box on the side of your house, or a cable drilled right through the wall into your living room. If you own the property in question, it’s important to know where your internet comes into your property.
That circuit, whatever its type, will actually plug/screw into some sort of device, most commonly referred to as a modem or a data services unit (DSU), but there are several other types and names for this piece of equipment. Essentially, they all have one function: connect the ISP to your property.
From the modem or DSU, your circuit is connected to a router. The router is where the magic happens, and is the most important device on your network, from both an internet as well as a local network perspective. Sometimes, depending on the service, the modem/DSU and router are combined into a single device. This form is often found in small offices and residential installs of coax service (from someone like Time Warner, Comcast, Spectrum, etc.), and is often just called a cable modem or simply a router.
Here’s where things get tricky: depending on your service agreement with your ISP, the router may be managed by them, or it may be your own equipment, and both situations can be found in any size business environment. It’s a safe bet that if your company is big enough to have full-time IT staff, your company probably owns and manages its own router. Either way, make sure you know who’s responsible for the router before touching it.
The internet gets conveyed to your devices through two different means: via wire (usually through an Ethernet cable) or via wi-fi. Wired ethernet is delivered via devices called switches (often incorrectly called hubs, which are no longer used), and Wi-fi through access points. In both cases, that internet is delivered to a network interface on your device, which can take the form of an ethernet jack or an antennae. To make things even more confusing, it’s very common to find routers that are also switches and access points, but which may also connect to additional switches and access points, depending on how large your local network is and how your office is designed.
Made it this far and ready to try your hand at network troubleshooting?
When troubleshooting the most basic problem of internet service, ie. it’s not working, there are a few simple questions to ask that can point you to the possible source of the problem:
- Is everyone at that location unable to access the internet? If no, it might be a problem with one of the main devices like the modem/DSU or the router. Check those devices first. If they appear to be operating normally (no flashing yellow or red lights), then call your ISP to make sure service is not down in your area or location. They may or may not instruct you to cycle power on these devices, so make sure you call from a phone that can reach where those devices are connected.
- Wi-fi service is not working properly? If your wi-fi is delivered by separate access point, cycling power may resolve this issue. In larger office environments, this may not be possible as these devices are typically mounted out of reach, and may be physically protected from tampering. In those cases, contact the responsible support person. If your router handles the wi-fi, you may need to reboot the router to restore normal service. In most cases, cycling power on these devices will not harm them nor make them lose their settings, but make sure you know who’s responsible for managing the device before rebooting it.
- Single or small-cluster of wired devices down? Look for a problem with either the ethernet cable (snugly plugged in on both ends? no exposed wires or busted tabs on the cable ends?) or a local switch. Many small offices use switches to distribute network in cubicle and multi-occupant spaces. Look for green/amber lights on both switches and network interfaces. No lights usually means the network signal isn’t getting through for some reason.
- Lastly, did you reboot the device in question? Frequently, if the problem is isolated to a single machine (computer, printer, mobile device), rebooting may solve the problem, especially if it’s wi-fi related.
Tried all of the above and still stumped? Call in a professional!
As if the mad rush to “web-ify” everything wasn’t bad enough, McAfee’s security blog now brings us a new, shining moment in Internet history: it is now possible to visit an easy-to-use website to host your own ransomware campaign for the low, low price of free. A group of cybercriminals have put together a service that will provide you with the malware that locks up your victim’s files, as well as the means to collect the ransom via bitcoin through their consolidated platform. The service even includes a dashboard that summarizes your criminal activity: number of computers infected, number of people who paid the ransom, and how much you’ve made so far. It all sounds like something the Onion.com would dream up, but sadly, it’s real. Would-be cyber-extortionists have to pay 20% of their take to the service owners, which could amount to some serious cash. Over the course of the past few years, experts estimated that tens of millions have been made on previous ransomware campaigns. Like any good money-making model, these enterprising individuals hope to amass a fortune on the backs of aspiring cybercriminals.
What this means for you:
As I’ve said in previous blogs, cybercrime is big business now. Though McAfee’s bright light of publicity may help shut down this particular iteration of mass-market ransomware services, you can bet dozens more will follow suit, if they aren’t already up, running, and better hidden. The internet has the ability to magnify anyone’s capabilities by an incredible degree, even more so when someone with savvy and no scruples turns their sights onto the vast, largely naive internet populace. The pitch for this particular service is that “anyone” can set up their own ransomware campaign, and you can bet they’ll do a booming business until the good guys shut them down. On a more reassuring note, this particular platform only provides the means to start and run a ransomware campaign. It would still be up to the would-be extortionists to actually target and distribute the malware to their victims, a task which is surprisingly hard to do in a way that won’t get you caught. However, is it so hard to imagine someone else setting up shop right next door to the ransomware folks, where, for a “small percentage of the take” they would provide those targets? Imagine if these enterprising criminals decided to form pyramid schemes on top of these “business models”. I imagine once attaining that level of vicious cannibalism, the whole thing might collapsed in on itself under the weight of sheer backstabbing and profiteering, but in the meantime, we might drown in a crushing wave of malware. Sadly, there’s no magic bullet, but there are three things you can do to better protect yourself against the coming storm: a good firewall on your perimeter, solid anti-malware on your computer, and an up-to-date offsite backup of your data. Those things plus constant vigilance (and a little paranoia!) will go a long way towards staying safer in these more dangerous times.
A little over two years ago, I wrote about a hacker who was able to demonstrate hacking and takeover of an airplane’s flight control system, and suggested that it may be awhile before someone was able to execute this same type of hack “in the wild.” Unfortunately for everyone, it’s happened sooner than we might hope: notorious hacker Chris Roberts of One World Labs has claimed that he managed to penetrate an airplane’s flight control system while it was in flight and was able to temporarily alter the plane’s trajectory by overriding controls on a wing engine, forcing the plane to fly sideways for an short period. After joking via Twitter about his hacking activities on an April flight, Roberts was detained by the FBI and his equipment seized. According to affadavits published of the FBI interviews with Roberts, it appears as if the FBI believes Roberts is in fact capable of hacking planes while in flight.
What this means for you:
I’m actually quite surprised this hasn’t happened sooner, and with much more horrifying results. On the scale of expertise on technology security, I consider myself to be only moderately well-trained and informed, but it doesn’t take a expert to comprehend why this is going to be an increasingly dangerous problem. Because all security systems are essentially designed by humans, they will inherently be flawed. Hackers count on this weakness and are able to exploit it over and over again. In the case of the above alleged hacking incidents (yes, there was more than one), Roberts exploited a hardware weakness – he was able to physically connect his equipment to the plane by cracking the inflight entertainment box under his seat – and a software weakness – he used default passwords to circumvent the security of the plane’s control systems. In both cases he would have been foiled if the people who designed and implemented the systems had taken more care in their work. According to Roberts, his actions are meant to goad the industry into taking security more seriously, and maybe now that the FBI seems be backing his claims, something might get done.
Overall, security is an uphill battle, and requires more energy, money and expertise than most companies can field at any given time. Like insurance, many folks have a hard time spending money to secure against something that might happen. In this case, like the other inevitabilities we insure against, accepting the fact that you will be hacked (even if you already have been) at some point in the near future, will help you frame your investments in security in a more realistic and practical perspective, and doing something proactive will often put you ahead of your competition. Embattled industries like airlines should definitely keep this in mind.
For those of us that spend a good part of the day stuck in SoCal traffic, Google’s self-driving car offers a tiny glimpse of future salvation. We’re a long way off from streets filled with autonomous autos, but Google’s cars have driven 1.7 million miles so far, have only been in 11 accidents, and apparently humans were at fault in all cases. This really shouldn’t come as a surprise to anyone with any measure of self-awareness and experience with today’s technology. After all, technology provides us with a means to amplify our own innate abilities and allows us to achieve objectives that might be beyond our unassisted reach. It also grants us the ability to fail faster and sometimes in a spectacular way.
What this means for you:
My newer clients are frequently surprised to hear me say, “Sometimes, less technology is better.” It sounds like a butcher preaching a vegan life-style to his customers. The main reason I say this is not because I’m a Luddite (far from it!) but that I often come across instances where someone has become temporarily blinded by what I call the “Shiny Factor” and has adopted or implemented a technology that complicates rather than simplifies their original intent.
A prime example of this are clients that purchase software or even new computers to deal with an increasing volume of email, when the simpler (but not necessarily easier) solution would be to reduce the volume of email. Purchasing expensive firewalls won’t prevent infections caused by poorly-trained employees. Faster, more powerful computers won’t fix broken process automation or buggy software, nor will a faster internet connection necessarily result in more productive workers. It’s a dangerous, slippery slope, and can become self-perpetuating spiral of expense, frustration and complexity. As the old adage goes, the cure may end up being worse than the disease.
Are we doomed? Only if we continue to ignore that technology is created to serve us, and not the other way around. Technology is not meant to replace humans, but to amplify us. It’s up to us to make sure that the good is amplified and the bad minimized wherever possible, and sometimes to solve problems or get work done the old fashioned way – with a little elbow grease, human ingenuity, and common sense.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
Over the past 2 years, I’ve seen the rate of malware attacks climbing at an accelerated rate. This is due largely in part to the evolution of malware as a lucrative crime combined with sophisticated, easy-to-use platforms that are designed for and marketed to non-technical users. Previously, successful viruses and their code were jealously guarded and the purview of an elite “cadre” of hackers who would advertise their creations as badges of honor. Now these same cadre of malware programmers are racing to bring product to a highly competitive market. Malware is a business, and business is good.
What this means for you:
It’s not just an assumption that you will be targeted by malware. It’s most likely a fact. Malware makes its handlers money by casting the widest net possible, which means everyone is a target, and the attack platform that can prey on the most victims wins. With that in mind, the safest mindset to adopt is that your technology will be or already is under attack, and you must gird yourself for the onslaught. Here are 3 ways to prepare, plus one less-obvious way that may or may not be practical for most organizations:
- Install a good firewall on your network periphery. Though most ISP-provided routers come with some basic firewall functionality, your business or organization should be protected by a professionally managed firewall that can provide what’s known variously as “Unified Threat Management” or “Gateway-based Defense”. In a nutshell, these devices sit on the entry point of your organization’s internet connection and monitor all data going in and out, scanning for malware, hacking attempts, objectionable content and spam. This is your first line of defense, and if maintained properly, can protect you from numerous threats 24/7/365.
- Use effective malware protection on your vulnerable technology. Even assuming you have some sort of protection on your network periphery, there’s still plenty of ways for malware to get inside your network, and once they are “inside the gate”, your computer or server’s only protection from a really bad day is the anti-malware you’ve installed locally. This software should have some form of active protection (always-on scanning, port blocking, etc.) and not something that has to be run in order to detect or cleanup a malware incursion. If malware isn’t detected and handled the moment it approaches your computer, it’s too late.
- Back up your data. Sad as this fact is, no anti-malware is 100% effective. Your machine will get infected and at that point, the only way you don’t lose this battle is if your data is backed up and isolated from infection. This means offsite backups, with at least 7 days of historical versions just in case the backup software unknowingly backed up infected files (which it can and will do if you don’t catch it quickly enough).
- Disconnect from the internet. If the above 3 items are beyond the reach of your organization for either budgetary or technical reasons, this rather drastic alternative is very effective. Even though it may be impractical for most companies, approaching this problem from this perspective may lead to some creative changes in operations and employee behavior. As a simple example: block access to social media sites on work computers, but provide separate, isolated wifi for mobile devices that allows them to scratch that itch on their own devices.
Image courtesy of graur razvan ionut at FreeDigitalPhotos.net
Lest you think the tech giant missed having a finger in this particular pie, Google surprised no one by debuting their own wireless carrier service earlier this week. Though the service is invite-only at the moment and only offered on Google’s own Nexus 6, they’ve negotiated a deal with both Sprint and T-Mobile to piggy back on their existing, nation-wide infrastructure to create a coverage area without having to build it. According to Google, the limited launch of this service is more of an experiment as opposed to a direct challenge of reigning champs ATT and Verizon. The major differentiator to their service? A low-cost, pay as you use it, data plan with data tethering, wi-fi calling that can also be used from other mobile devices such as tablets and laptops.
What this means for you:
Unless you have an invite in hand, you can’t jump onto the Google Wireless bandwagon yet, and if Google stays true to the “we’re just testing the waters” mantra, maybe not ever. But if Google can deliver a solid service for a fraction of the price that the big 4 carriers are charging now, it’s going to have repercussions on the entire mobile landscape. As they’ve done with Google Fiber, this particular foray into the bloody wireless markets is an exercise in forcing a change in the status quo where major carriers are squabbling over how to charge consumers more for less service. However, Google surely has an agenda that includes profit (they are publicy held), and you musn’t forget that the largest revenue stream for them is advertising and data mining. The mad scramble for dominance in the mobile data market is about as close as we’ll ever get to seeing a modern gold rush, and you can bet Google has been preparing to stake a claim since before you and I even knew there was “gold in them thar hills!”
Though it may sound enticing to some, “Mobilegeddon” is not the sudden annihilation of all mobile devices. Rather, Google is releasing a new search algorithm that will impact how mobile users find websites. For those of you who aren’t up on your search engine technology, Google uses a complex, closely-guarded formula to calculate its search result rankings for all the websites it indexes. The last major update to the algorithm, entitled “Panda“, was released in 2011, and was designed to reduce the impact of gaming search engine ranking through content manipulation, a specialty of many less-than-honest SEO companies that sprang into existence in the last decade. Panda impacted about 12% of existing websites, most of them content farms designed to leverage popular content and other nefarious SEO methods to get to the top of search results.
What this means for you:
This time around, Google is focusing on providing better results for smartphone users by favoring mobile-friendly websites over those that display poorly on small screens. If you don’t drive business through your website, this may not be a high priority for you, but it may surprise you to know that over half of all internet traffic is from mobile devices, and nearly 40% of search is done on smartphones. Having a website is essentially a must-have for any ongoing business or organization, and if your website makes a poor showing to over half of your visitors, it will have an impact on your brand. How do you know if your website is ready for Mobilegeddon? You can punch in your URL to a website developed by Google to determine whether your website is mobile-friendly. Unlike Google’s last algorithm change, this one should start impacting rankings as soon as 72 hours from launch. Lest you think you are the only one caught out in the cold with this change, there are several internationally recognized brands whose sites do not pass Google’s mobile “sniff test.” One advantage you may have over corporate behemoths: less red tape and meetings will be necessary to make the required changes to your website, also you happen to know someone who can provide strategic advice in this area as well as assist in the website redesign. Give us a call if you need to “mobilize” your website!
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
If you are one of the many folks who work for a company that doesn’t have full-time IT staff on hand to keep your technology running smoothly, you might feel like your options for troubleshooting or resolving tech problems are limited. Depending on the severity of the issue, you may be able to rectify many minor/transient issues with some simple practices that we “experts” use on a regular basis. Obviously these techniques won’t work for things like a crashed hard drive, malware infection, or security breach, but they are useful to know, and can save you time and money.
- Reboot – It may sound clichéd, but more often than not, many of my clients forget about rebooting. Even though Windows 7 and 8 are supposedly designed to work without needing frequent reboots, if your computer is acting sluggish or abnormally, try a reboot to see if the problem goes away.
- Check Task Manager – On any Windows machine, XP and up, hitting Ctrl-Alt-Del and checking out the list of running applications in Task Manager may be an eye-opener. From there, you can see your Memory and CPU usage. If a program seems to be hogging one or the other (or both), try closing that application to see if performance returns to expected levels. Recent versions of Google Chrome are notorious for being memory hogs, and will hold at least one process open for each tab you have open on your computer. If something says “Not Responding” it’s possible the app itself has crashed. “End task” on apps that are not responding may return your computer to temporary usability. Save what data you can and reboot. If CPU and/or Memory usage remains high after a reboot and closing all applications, you might have a malware infection. Skip immediately to #5 or call a professional.
- Check your network connection – so many apps rely on the internet that unpredictable things may happen if your network connection is unreliable. Check your physical Ethernet connections, Wi-fi signal strength, bandwidth speed, etc. If something is wonky with your internet, your computer may manifest that problem in unexpected ways. If bandwidth seems unusually slow and you aren’t the only one using it, someone else on the network may be hogging it up, either intentionally (Game of Thrones stream?) or unintentionally due to a malware infection.
- Reboot your router or access point – depending on who’s impacted, and whether you are feeling confident on which thing is the router, AP or switch, cycling the power on your core infrastructure may clear up a lot of strange behavior. That’s right, even your home office has a “core infrastructure”! Just make sure you warn everyone affected (officemates, employees, family, etc.) that you are taking the “reboot mantra” to the next level. Not sure which one is which? Make a call to your ISP help desk or your local, friendly technician at C2 for some guidance.
- Run a malware scan -assuming you are not a managed services client of C2 (we take care of this part for you!), fire up your anti-malware software and run a full scan. Didn’t find anything? Get a second opinion and run Malwarebytes. Want a third opinion? Try herdProtect. Not sure if you have anti-malware software installed? Might be a good time to call us for a checkup.
Many garden-variety Windows issues can usually be nipped in the bud with the above 5 practices. Practicing safe-computing will keep you out of harm’s way for everything else. As always, avoid attachments, don’t click strange links or popups and practice constant vigilance to keep your data safe!