KRACK (Key Reinstallation Attacks) was discovered by Mathy Vanhoef, of imec-DistriNet, KU Leuven, by accident whilst he was working on an unrelated security paper. Further investigation revealed that the attack works by exploiting a 4-way handshake of the WPA2 protocol which lets new devices that have a pre-shared password, join the network.

Once an attacker establishes a man-in-the-middle position between the client and the access point, they can then “selectively manipulate the timing and transmission of messages in the WPA2 Four-way, Group Key, Fast Basic Service Set (BSS) Transition, PeerKey, Tunneled Direct-Link Setup (TDLS) PeerKey (TPK), or Wireless Network Management (WNM) Sleep Mode handshakes, resulting in out-of-sequence reception or retransmission of messages.”

In easier to understand terms, the victim is tricked into reinstalling a key that is already in use and the attacker does this by manipulating the handshake and then replaying it. 
After getting inside your network, the attacker can then listen in on all of your network traffic and although the attacker does need to be within physical proximity to the device or wi-fi network, public wi-fi hotspots are everywhere with many people using them in their day-to-day travels, so there is still some cause for alarm.

Because the vulnerabilities are in the Wi-Fi standard itself and not the actual device, if your WPA2 is set up correctly it is still affected.

Any device that uses wi-fi is at risk, so taking stock of all of your wi-fi connected ‘things’ is a good idea. Vendors of IoT devices don’t often release updates or security patches, so these are the devices you need to be particularly wary of on your network.
Changing passwords will not make the device secure, so it is up to these vendors to provide patches for their devices and up to you to make sure that patch is applied as soon as it is available.

It is also being advised that use of a secure VPN whilst browsing the internet to encrypt all of your traffic is a good idea. Visiting HTTPS only websites may also be safer as (at this stage) this traffic can’t be decrypted using this attack.

At this stage, it is unknown as to whether attackers have been/are currently exploiting this in the wild, but as with every proof-of-concept that gets released, there is a risk of would-be attackers taking it upon themselves to test and utilise this exploit.

What you need to do

Update/patch the firmware for your router/modem and access points as soon as a patch is available. 
Make sure updates/patches are also applied to any of your IoT devices (Home assistants, amplifiers, sound bars, stereo equipment, kettles, aircon, etc) as well as tablets and phones. 
Update/patch any devices with wi-fi capabilities: printers, faxes, switches, computers, particularly laptops – make sure the firmware has been updated as well as your operating system.

A list of currently known vendors who have products affected by this vulnerability, can be found here.
If your vendor hasn’t released an update for your device as yet, continue to check for it or visit the vendors website for more information.

Patches that have been released by vendors thus far:

• Apple: iOS, macOS, watchOS and tvOS patches are currently in beta stage and are to be released via software updates over the coming weeks
• Arch Linux: Patches for WPA Supplicant and Hostapad are available
• Aruba: Patches are available for ArubaOS, Aruba Instant, Clarity Engine and others
• Cisco: Many of the Cisco devices are affected but at this stage only some patches are available, pending further investigation
• DD-WRT: Flashrouter patch available
• Debian/Ubuntu (Linux)
• Espressif Systems: Patches have been released for ESP-IF and ESP8266 versions
• Fedora
• Fortinet: Firmware updates are expected
• Google: Any affected devices will be patched over the coming weeks
• HostAP: Several patches are available
• Intel: Updated wi-fi drivers and patches for chipsets that are affected have been listed
• LineageOS
• Linux: Patch is available (OpenBSD was previously fixed in July)
• Microsoft: Security update was released via automatic updates on October 10, 2017
• Microchip Technology
• MikroTik
• Netgear: WAC120, WAC505/WAC510, WAC720/730, WN604, WNAP210v2, WNAP320, WNDAP350, WNDAP620, WNDAP660, WND930
• OpenBSD
• Ubiqiuti
• Ubuntu
• WatchGuard

In the IT industry, we hear some interesting (and more often than not, entirely untrue misconceptions) from our customers, and like many others have done before us, we thought it might be fun to visit some of these myths and explain the untruths behind them (in no particular order):

Users then act as both “seeds” and “leechers” – seeds send pieces of the file out and leechers take those pieces. This enables a fast and continuous/uninterrupted download of data.

A BitTorrent client is needed to assemble those pieces back together, and this client searches for and monitors each piece and determines what it has and what it needs to complete a file, but the BitTorrent client doesn’t actually hold any data itself. The BitTorrent protocol is also used by software companies to distribute patches and data for games, as it is faster and reduces server loads while increasing availability.

The use of the BitTorrent protocol is only illegal when it’s used to download copyright infringing work such as movies, TV shows and music as well as any other digital work protected by the copyright infringement act.

2. Data is less secure in the Cloud

This is another common misconception, probably brought about due to numerous data breaches that have been publicised over the last few years. Any data that can be accessed from outside of a business or a cloud environment has the same chances of being hacked, if the opportunity to do so exists.

The truth is that on-premise data is more at risk of theft and corruption than data in the cloud. In an on-premise environment, data is exposed to real people, every day. Being located on-site means that a lack of physical security (locked, secure communications rooms as well as secure site entrances) can allow anyone direct access to your data; disgruntled employees, employes without restricted data access as well as on-site service providers.

Research has shown that more on-premise user data has suffered from data security incidents than cloud data service providers. Cloud data is harder to gain access to, and cloud service providers must adhere to strict data security standards and therefore tend to provide a far more secure environment in order to maintain their reputation, especially if their core business is selling cloud hosting services.

This doesn’t make a cloud environment bullet-proof but it does significantly reduce the risk that on-premise data faces.

Incognito is handy if you share a computer or device with another person. You can do your gift shopping in secret and it’s also effective and safer to use for any bank transactions or conversations that you don’t want to leave traces of on your PC.

So can you actually make your browsing private? You can take measures to make it more private, but there is no true 100% privacy option available. A VPN can be used to mask your IP address and your physical location and TOR, an open source browser, works like VPN does but as a browser.

4. Antivirus will protect me from…

Everything? No, not even close. Most antivirus software will protect you from viruses, trojans, worms and some malware, but they are only as good as their last update.

In a perfect world, an antivirus solution would protect from every one of these threats but because new variants are released every single day, it takes time for an AV provider to update their engines and provide protection from newly developed threats.

Often it’s necessary to use both an antivirus as well as an anti-malware software, and if you want to get as close as possible to being safe from ‘everything’, a firewall should be considered first and foremost in your line of defense.

Lastly, nothing can protect you from yourself or other local users because unfortunately, humans are the greatest risk element of all.

5. USB connected devices should be dismounted before removing them

This one is interesting because there are two sides to this myth: those who say you should dismount them first and those who swear that it doesn’t matter.

In a Windows OS environment, the write cache feature is disabled for drives that the OS believes are removable. There is an option to turn this on or off, found under Device Manager > Disk Drives > Drive Name > Properties > Policies. Turning this off enables write caching but you have to then always use the ‘Safely Remove Hardware’ notification icon in order to disconnect the device safely. 
Having write caching on provides better performance of the device.

6. WWW is the same thing as the Internet

Many people believe that the Internet and the World Wide Web is the same thing, and they could be forgiven for it because we use the term ‘Internet’ as a generalisation for just about everything ‘online’.

The World Wide Web (www) is how we access information over the internet. It uses the HTTP protocol to transmit data and web services that use HTTP to allow apps to communicate, use the World Wide Web to share information. Browsers are used to access websites which are web pages linked to each other by hyperlinks (http:// or https://).

The Internet is essentially a great big network of networks or rather, a network infrastructure. It globally connects millions of devices together to form a network where any internet device can communicate with another internet connected device. Information data is transferred across the internet by various traffic protocols such as SMTP (email), FTP (file transfer protocol) and IM (instant messaging).

8. Macs don’t get viruses

This one is a favourite and it’s a great talking point for both Mac enthusiasts and Windows users alike.

The reason for this misconception is that for many years it has been far more profitable for attackers to target Windows devices because there are more of them. This means that the likelihood of a successful malware or viral campaign is far greater and an attacker will reap more of the reward (money) that they are after. 
Macs have always been vulnerable to malwares and viruses, but because viruses designed for Windows can’t be deployed on Macs, attackers choose to take the easy route and target the larger group of users.

Now that Mac users are on the rise, we are seeing more Mac targeted malware and viruses released into the wild.

9. Hacking is illegal

Seems legitimate, and for the most part hacking into a private computer system or systems is illegal. However there are plenty of people making a living hacking ethically and by ethical hacking, we mean “white hat” hackers whose job it is to seek out the bugs and vulnerabilities that allow “black hat” hackers to do their thing.

10. My PC is slow, it must have a virus

This seems like a reasonable assessment but you’re probably wrong. If you’ve done the scans without getting a result and are still convinced you have a virus, taking a look at your PC’s overall health is a good idea.

PCs get slower simply because we use them. Everything you do, both locally on your machine and online, is cached somewhere in your PCs memory. Combine this with all of the programs you have installed, big or small, your browser extensions (which you really do not need especially if it’s one of those free ones that came bundled with something else) and plugins and the fact that your PC just might not have enough memory (RAM) to cope with the 1001 tasks you’ve asked it perform all at the same time, no wonder your PC is slow!

Hard drive failure can also cause a drop in speed, because they have moving parts they are built to eventually fail. Not having enough space on your drive will also slow things down. Having too many tabs open in your browser can also hog memory and any programs running in the background (like virus scans) may be contributing to your PC’s lack of speed.

Sometimes all that’s needed is a restart – this is where the old ‘Have you tried turning it off and on again?’ comes from because doing this flushes out the system and starts everything up fresh.

There are many more IT myths out there so remember to check out the facts before believing anything is true.

Hackers (or bad actors) can and will use all sorts of means to gain access to a device or a network; adware, malware, RATs (remote access trojans), that random usb drive you found (on the ground outside the office maybe), but a good hacker also knows how to use low-tech methods for hacking and these start with simple physical access rather than remote.

Best of breed hackers know how to pick locks. If they can unlock the right door, they can get to your data in person. 
They know how to fit in. That guy behind you in the suit with the serious face chatting steadily away on his phone obviously needs to be here, so you hold the door open for him after you’ve swiped your access card. 
The person who strolls in with a computer tucked under his arm says he’s the IT Guy so you nod and say sure, go right ahead.

When was the last time you asked someone for their ID? And when was the last time you were asked for yours?

Reading a report last night, on inc.com, I was reminded of how stupidly simple it is for an unauthorised person to gain access to a building, even a secure one. 

In the report, David Kennedy (founder of TrustedSec” and former cyber intelligence analyst), explained at Inc.’s Iconic Conference, how he helps other companies find their security weaknesses.

He starts with the physical security and will literally try to break in and steal something. Alternatively, using a “piggybacking” method, he said he is quite often successful at following an employee through a security door and if that doesn’t work, he resorts to “MacGyver-style hacks”; blowing smoke or spitting whiskey through door cracks in order to trigger the motion sensors. 
He went on to explain that once access is gained, getting what he wants is as easy as telling an employee that he’s part of the IT department and needs to update their computer. As Kennedy said, “When hackers break into one individual, it’s the downfall of an entire company.”

When I read this, I’m not ashamed to admit that I was thrilled in a way and I think it’s because the simplicity of it is so beautiful. 
We are all so busy making sure we don’t open those email attachments or trying to make our passwords as hard as possible, that we’ve overlooked the basics of keeping a business secure. Locked doors only work when employees are educated on how to use them correctly.

In passing, I mentioned the topic of this blog post with a fellow employee and was startled to learn that he sees this kind of thing at customer sites all the time.
As recently as this week, my colleague was at a site where a new employee was manning a reception desk at a locked entry door. Although this person had never met my colleague, they buzzed him in without a second thought and didn’t ask any questions as he strolled past and made his way deeper into the building.

He also recalled another time when he showed up at a new customer site, having not met anyone there face to face before. He informed the staff member that he was the computer guy (as most of us computer people casually do) and without being asked for any form of identification or questioned any further, was shown directly to the comms room.

This seemingly inconsequential kind of negligence highlights just how bloody easy it is for someone to not only gain physical access, but gain access to the heart of your business where your crucial data lives without using a computer.
“When a hacker gets past one employee, the hacker spreads to the entire network.” Kennedy said. “People are the No. 1 target when it comes to how hackers get access to offices and computer systems.”

So whilst you are busy ensuring that your firewalls are impenetrable, your devices are armed with AV or anti-malware software and that your employees have been educated in art of not clicking, you need to make sure that your building is secure and remains that way. 
If someone outside of your organisation claims to be there for a service or a meeting and they are not familiar (and maybe even if they are), the question of identification should be raised. It takes two seconds to ask and could save thousands, if not millions of dollars in damage because once that damage is done, it’s too late.

Site security should be considered a core part of any employee induction, no matter who the employee (or the business) is. Combined with essential computer security basics, an employee can be a valuable part of your line of defence instead of your weakest link.

Ignorance will not prevent you from the theft of assets or business data and it certainly won’t save your job.

This ransomware targets computers running on unpatched or unsupported versions of Windows. Once a PC is infected, it then scans for all other vulnerable computers on the same network. In March of this year, Microsoft applied patches to its currently supported operating systems but due to the cessation of support for older operating systems such as Windows XP, many machines were left wide open to this exploit. Whilst ransomware is nothing new, this particular variant is outstanding due to the incredible speed that it spreads as well as the high profile targets it’s aimed at. It uses strong RSA-2048 encryption which makes it next to impossible to decrypt.

At the time of writing this, reports of over 250,000 computers across 150 countries have been affected. The victims have been hospitals, telecommunications, courier services as well as many others. 
In Australia, only a few instances have been reported however it’s still early and now that Monday is upon us, we are certain there will be a great deal more. 
The question has been raised as to why so many computers have fallen victim to this attack but the answer is simple: many organisations as well as users have not caught up with security updates and security practices. A great many number of PC’s in business environments as well as homes are not only still running an unsupported Microsoft operating system, (namely, Windows XP) but are not ensuring that Windows Updates are being applied.

We know that thanks to the quick thinking of a MalwareTech researcher, this current wave of attacks by WannaCry were thwarted by the registering of a website domain (hidden in the malware) which brought the spread of the ransomware on a system to a halt. Registration of this website created a ‘sinkhole’ which redirected traffic from the infected computers to a self-controlled system. That said, the threat is far from over. WannaCry, as with other ransomware and malware, was spread in the usual ways long before this and will continue to do so in the future.

Now that the bad actors are aware of the flaw you can guarantee that they will be re-writing, re-working and re-deploying this ransomware as soon as possible. 
This means it’s time to suit up and protect your assets.

What You Need To Do

If you aren’t already and still haven’t done so, make sure your PC’s are up-to-date. Don’t assume that they are or that you in particular are safe because believe it or not, ransomware does not discriminate.

If you are running Windows 10, you are generally safe as the particular vulnerability that WannaCry targets exists only in older version of Windows.
For users running Windows Vista, Windows 7 or Windows 8.1, if your PC has been regularly updated it will have already installed the update that contained the patch, back in March. Businesses running Windows Server 2008, 2008 R2, 2012, 2012 R2 or 2016 will have also received the patch.
If you aren’t sure or you know that your system is behind, you should update immediately. The patch that applies directly to this vulnerability is MS17-010. Patches can be found at the bottom of the Customer Guidance for WannaCrypt Attacks post by Microsoft.

Educate your employees and yourself in the best practices for computer security. Knowing what not to click or open should form the basis of any staff training where the use of a computer is involved in a day-to-day job.

Is Up-To-Date Patching Enough?

Patching only provides a ‘patch’ over the ‘hole’ in the code of the operating system. WannaCry, as with any ransomware on the market, can still target you via a link or a download in an email or in a drive-by website visit. 
You should never rely on patches wholly and solely to provide security. At the very least, your PC should have a good, reputable antivirus program installed and where possible, a secondary malware detection program such as MalwareBytes. 
Businesses should have a secure, multi-function threat management firewall appliance, of course our firewall of choice and the only one we recommend to our customers, is a WatchGuard device.

Businesses often feel that the cost involved with both security, computer and/or operating system upgrades is either too much or an unnecessary trend however this is simply not the case. If your business relies on computers to operate, it is imperative that they are secure, current and efficient.

Backing up your data regularly is an essential step for both business and home. If ransomware does get through your defences, the threat will be nothing more than an inconvenience because you will still have your data. When backing up data, ensure that once your backup is complete, your drive is removed.
An automated, secure off-site backup can take the hassle out of needing to switch drives daily and as an addition to on-site backup, provides a dual safety net for your data.

Finally, if you or your business are still running computers on Windows XP, there has never been a better reason to upgrade.

For help, support or guidance on any of the above, don’t hesitate to contact us.

In January 2016, SplashData published their annual top 25 most commonly used passwords based on a list of millions of stolen passwords that have been made public over the previous twelve months:

1. 123456
2. password
3. 12345678
4. qwerty
5. 12345
6. 123456789
7. football
8. 1234
9. 1234567
10. baseball
11. welcome
12. 1234567890
13. abc123
14. 111111
15. 1qaz2wsx
16. dragon
17. master
18. monkey
19. letmein
20. login
21. princess
22. qwertyuiop
23. solo
24. passw0rd
25. starwars

The amusement one might feel whilst reading this list may also be accompanied by a profound feeling of disbelief. When did we get so stupid? If your password or a variation of it is on this list, give yourself an uppercut. Then go and change it.

What should your password be?

Anything that is too painful to read let alone remember is your best bet. I know, it seems difficult but it’s the most secure type of password you could have. If it’s hard for you to remember, it will be just as hard for someone else to hack.

• We recommend using no less than a 15 character password using a mixture of numbers, lowercase and uppercase letters as well as punctuation symbols.
• Use a different password for each account that you have. Because passwords are almost always linked to an email address, it’s highly likely that you’ve used it and the same password elsewhere. In the event of a data breach or an email hack, you may inadvertently give a hacker access to all of your online accounts.

I asked a co-worker (with a particularly rain-man-like brain) what his answer would be if he were asked this question. He suggested that every website/account should/could be associated with a memory; a song title, a line from a song or a book, poem or movie, or a particular item – something that could trigger a password memory. Unfortunately, instead of making me feel like I could regain some control over my own passwords and then impart that knowledge confidently to others, it left me standing there with a painfully confused expression on my face that resembled something like a smacked bum crossed with a toothache.

The fact is, my boss co-worker makes a good point – passwords don’t have to be a word. They could be a phrase, a line or a song title and of course the more obscure to everyone else, the better. It could be an abbreviated version of these using a mixture of numbers, letters and symbols. 
User names can also follow the same guidelines – you don’t have to provide your real name. It’s also a good idea to blatantly lie when it comes to filling out those password security questions. Anyone who knows you well enough probably has all the information they need to take you down, should they be so inclined. In saying that, as was demonstrated very clearly in a recent episode of Mr. Robot, gathering this kind of information about someone from something as simple as a Facebook account is way too easy to do and can be done by anyone (is your Facebook account set to private and if so, are all those friends actually trustworthy friends?).

So how are we supposed to remember the 3,487 passwords we need?

If associating smells, colours and sounds doesn’t work for you, not all hope is lost.

Repetition

Repetitive anything will always ingrain something into your mind. Try it, you may be pleasantly surprised at what you can remember. 
Using the suggestions above, you could even develop your own personal format as to the way you create passwords which will then make it easier to remember.

Write them down

Woah, Nelly. 
No, don’t write them down unless you live in a deep cavern on the side of a very tall, hard to climb mountain, in a very remote part of the world where your nearest (and only) neighbour is an antelope you call Fred. 
Writing down a password one time only and then destroying that piece of paper can be an effective way to remember something but if you do this please make sure it’s destroyed. If someone breaks into your office/home and is looking for access to accounts, you’ve made it way too easy. 
I would never advise this regardless of the reason but please, whatever you do, do not write it on a post-it note and stick it to your monitor.

Locked Documents

An alternative to a password manager. 
Making the master password complex is the key to securing this document and it will then serve the same purpose as a password manager, although you will have to manually enter in your password into the website account you wish to log into. For an extra two minutes of your time, it’s not a big deal. These documents are encrypted so that in the event of a hack into your machine or network your data is safe. Make sure this document is backed up externally or remotely because if you lose your data, your drive, or some other disaster should render your machine unusable, you may lose this file forever. 
If you choose this option, I would recommend using an Excel file and ensuring that it is from version 2013 onward as Microsoft have very thoughtfully increased the hash value and added an additional layer of protection the form of a Salt Value. Bravo, Microsoft.

Password Managers

Are great if they aren’t logged in 24/7. 
There’s not much point in having a third party application manage your passwords for you if it is always open/unlocked. You might as well use the built in password manager on Chrome or IE/Edge which is always ready to fill out your details for you. If you remember to log out of your Google account and don’t have that password saved, it’s an option. Logged in permanently makes it no different to having book sitting on open on your desk with all of your passwords written down (or an unsecured document on your desktop titled ‘Passwords’) or as previously mentioned the one we see most often – the post-it note stuck to the monitor on the desk. 
If you do choose to use a password manager, do some research. Free isn’t always the best option but be sure to investigate and be comfortable with the one you choose to use. Make sure that it is not logged in 24/7 and that you have to enter your master password before it fills in your login details to the website you want to login to. Make your master password complex and memorize it – if it’s the only password you have to remember, then remembering it shouldn’t be too hard.

So. Have you been hacked?

If you think any of your accounts may have been hacked, there are ways to check. A tried and true favourite is haveibeenpwned.com where you simply enter in the email address (or two or three) that you most commonly use to sign up to sites with. It will go off and check them against a list of known hacks and data breaches and then inform you whether your information has been stolen and which of your details have been compromised.

Before you do that though, you may just want to go and change those passwords.

Why Phish?

Because phishing works well by tempting users with offers, freebies and giveaways, which are tried and true methods of success. Humans by default are curious and even in 2016 when we are more aware than ever of the need to exercise caution, we still get lured in by these baits.
Phishing is extremely profitable and takes very little effort from the cyber criminal. Even if only 1% of those targeted by phishing fall into the trap, that cyber criminal will still net themselves a nice payday.

A global study by the Anti-Phishing Work Group (APWG) in May 2016, revealed that:

• The Retail/Service sector remained the most- targeted industry sector during the first quarter of 2016, with 42.71% of attacks
• The number of brands targeted by phishers in the first quarter remained constant – ranging from 406 to 431 brands each month.

This means targeted brands such as PayPal, Apple, Facebook, (and in Australia) the ATO, AGL, Australia Post etc. are used most often in phishing attempts. Fake websites are hard to distinguish from the real thing and are now being seen to use HTTPS connections and certificates in a further attempt to mislead the user. People generally trust many of these brand and because of that, they are the perfect cloak for cyber criminals and bring in a greater catch.

How Can I Tell If I Am Being Phished?

Phishing emails almost always contain the following:

• Typos and grammatical errors
  For some reason, cyber criminals aren’t very literate and are known for their poor grammar and bad spelling.
• Web Links or Attachments
  This is the number one bait tactic that almost always works. Clicking on these links results in a redirection to a website that will install some form of malware onto your PC. If no link is present, usually there will be an attachment and once you open and execute the file, the virus/malware happily installs itself and then goes about its business.
• Threats
  Often these emails are threatening in nature, warning of an account closure, a fine or trying to convince you that your security is at risk. No better way to get you to react hastily than by threatening you.
• Spoofing
  Spoofing involves using popular website or company names and addresses in order to appear legitimate. When you click on a spoofed link, you end up somewhere similar to where you may think you were going or somewhere else entirely. Spoofing often occurs within a network, sending emails that appear to be from within your network (your boss, the receptionist, the person at the desk next to you or even yourself), particularly from a scanner or fax.
• Phone Calls
  These start out pleasant enough with the caller informing you that they are phoning from the ‘Windows Department’ or from ‘Telecom’, perhaps even from a legitimate business within your country (in Australia, Telstra is often used in these calls). They may convince you to give your user name or password for a particular site or have you give them your credit card or banking information in order to make a payment for something. They may also instruct you to visit a website and download or install software that will let them access your PC.

How To Avoid Being Phished

There are some really easy ways to avoid phishing and most of them just require a few seconds inspection before you react:

• Is the email from someone you know or someone you are expecting to hear from?
  If not, chances are it is spam or very likely a phishing attempt. Just because it claims to be ‘Your Monthly Electricity Usage’ doesn’t mean that it is.
• Are the links in the email real?
  A simple way to check is by hovering your mouse (do not click, just hover) over the link – this will reveal the true destination of the link.
• What is in the attachment?
  Attachments in phishing emails will more than likely be zip or macro files. The attachments are usually obscurely named and will often contain your own name or a default ‘scan’ or ‘attachment’ which is a pretty good indication that it is not what it’s claiming to be.
• Assess the threat
  An email from an electricity company telling you that your account is being suspended unless you click this link or open the attachment can easily be checked by calling your electricity supplier first. Don’t assume that because they’ve appeared to have sent you an email advising of this suspension, that it is for real. The same goes for any company that you may do business with. Make a phone call, speak with your account representative, ask a real person.
• Is it a Spoof Email?
  To identify spoofing, simply take a minute to look and think – does that scanner or fax machine in the email address exist on your network? Is it normal for your CEO to be emailing you a file of that nature or asking for your user name or password? Would your boss actually want to start you on one of the most amazing pesos making journeys you’ll ever take?
• Personal use of work email addresses
  Don’t use your business email account for personal use. By this I mean that you shouldn’t be signing up to websites for personal reasons using your work email address. Doing this greatly reduces the chances of falling for a phishing scam. The damage that can be done by unleashing ransomware or malware into your work network because you believed an email to be from a place that you have personal business dealings with, is just not worth the cost to your business. Whilst we are all only human, reducing the chances of being a victim is of great benefit to your organisation.
• Phone calls can be returned
   Businesses such as Microsoft, Paypal or Telstra will never contact you via phone to ask for personal details. If you are unsure as to whether a call is legitimate or not, insist that the caller provide you with identifying information of their own such as an employee ID number or ask that they give you their number so that you can call them back later. The best way to deal with these calls is to simply hang up and then phone back the actual business if you believe you do need to speak with them further.
• Just take a few moments to check. Those few moments could save you a whole load of hassle, not to mention money.

An example of a phishing email:

Question: is that the email address of my bank, let alone my bank manager? Is that her name?
Question: a message in the form of a zip? Why would it be called scan? Why would my bank manager not just type the message in the email and save herself the hassle?
Unusual: it doesn’t read with the usual professional edge that my bank manager would use. There is no signature, nothing to confirm that it is what it claims to be.

Below is another example of a phishing email currently doing the rounds and catching many Australians out by claiming to be from AGL:

We have seen many people fooled by this very email over the past few weeks. 
When I received this email, right away I knew it was spam based on a few things. Firstly, we don’t get our electricity bill via email. Second, this email is missing the AGL company logo. Third, (if I was still unsure) before even clicking on any buttons, I hovered my mouse over the links as you can see in the second image. The link is not going to AGL in fact it looks like it’s going to take me to a coach development website.
This email actually contains a link to ransomware and once clicked, sends a message back to base which then deploys the ransomware into your system. Similar to this email are the ones claiming to be from Australia Post and/or the ATO. Combined, these phishing/malware emails have claimed thousands of victims and counting.

Don’t Become Complacent.

Just because the general rules of poor spelling, bad grammar and cloaked links usually apply, doesn’t mean that they are hard and fast. Sophisticated phishers can and will use professional marketing techniques in order to get you to click. They may include logos and other legitimate information taken directly from a company website, newsletter or email. Remember that no organisation would urgently request you to send your credit card details via email. If in doubt, pick up the phone. Make a call. Manually type in the email address of the website if you need to go there.
It is far better to delete an email and have it resent or to hangup on a suspicious caller than it is to be phished and hacked or robbed.

Keep your anti-virus up to date. Keep your firewalls updated and secure and above all, don’t rush. 
Read what is before you and take a breath before clicking a link or opening an attachment.

Ransomware isn’t only deployed via email, according to FBI Cyber Division Assistant Director James Trainor, “These criminals have evolved over time and now bypass the need for an individual to click on a link. They do this by seeding legitimate websites with malicious code, taking advantage of unpatched software on end-user computers.”

How do you prevent your business from becoming a victim of ransomware?
There are a number of ways you can do this. These are some of the key elements that together, can provide a strong and long lasting wall of defence for your organisation (all of these steps can also be applied to the home user).

Backup your data

Backing up your data on a daily basis will reduce your vulnerability to ransomware attacks. If your data gets locked/encrypted, you won’t have to pay that ransom to see it again. You may lose a day’s work (this may mean re-keying some data) but in comparison to losing everything, it’s a small loss.

Backing up onsite, however, does still come with a risk – ransomware is clever enough to seek out and destroy backup data. In fact, the ransomware attacks we have come across in the past week have actively sought out this data first. The creators behind this malware know that backups will save their victim. On-site backups are often done to external drives, connected to servers/machines via USB, and plugged in 24/7. If the backup drive is connected at the same time that the ransomware is deployed, that data can and will also be compromised.

An off-site/cloud backup is ideal and can be used in conjunction with an on-site solution if preferred but because the off-site backup only ever creates a connection when the backup runs, if a user comes in the following morning and accidentally deploys ransomware throughout your organisation, your off-site backed up data will be safe and ready for restoration. Machines/hardware may still be damaged by ransomware, but your business can be back up and running if a copy of your data is intact.

Educate your staff

If an employee uses a computer that is connected to the internet/receives email, ensure that they have the knowledge they need to be aware.

Users should not login to any site that doesn’t show https:// because that site is not secure. Take another look at that email address – is it actually the right web address or is it misspelled? Many of these websites appear to be legit but contain typos. A site, such as a banking site, should display a https:// but the link displays http://. The domain .whatever may not be your banks regular domain. Because we humans tend to skim read it is easy to be tricked into thinking that you are heading somewhere legitimate.

Users should be taught about the importance of not opening emails, clicking on links or opening attachments within emails, from people they do not know or do not normally receive mail from. These can also appear in web chat and users should be aware that these tactics are the same ones used in phishing emails.
Phishing emails from known organisations may appear to be legit, but if you hover your mouse over a link within these emails you may find that the link that appears is going to take you somewhere else entirely.

Users should be aware that any banking or government organisation (among many others) will never ask for your user name, password or any other personally defining information in an email. They will generally never send a zip file or word document to you. In the instance that they do, it will be locked and a separate email will be sent with the password to open the file. A phone call will often initiate this kind of contact either from yourself or the institution.

Malware, both online and the kind that pops up in an email, is almost always easy to detect – they are full of grammatical and spelling errors and tend to read awkwardly. 
It is better to delete a legitimate email from a legitimate source than it is to open something that you aren’t sure about. Emails can be re-sent. If an email does appear to be from someone you know, but not an attachment that you were expecting or would normally receive from them, pick up the phone. Ask the question. They themselves may have been compromised but taking that second step by asking is far better than putting your business at risk.

Firewalls

Firewalls are a necessary and extremely effective defence tool for any business, big or small. A good firewall will offer at least a 3-layer protection, a web blocker service which prevents ransomware (and other forms of virus/malware) from making its call back to ‘home’ and a deep inspection feature of all traffic and websites. This feature runs security scans even on encrypted web traffic. Of course these all need to be configured correctly but when they are, they are an ultimate tool of defence. (At F5 Solutions, we highly recommend, use and deploy WatchGuard Firewalls)

Antivirus

Antivirus programs should never be your first or only line of defence. Most AV’s will prevent most viruses and malware from infiltrating your systems but not all are created equally. An AV program is only as effective as its last update. Many AV’s cannot detect or prevent ransomware from being deployed and if they do detect it, the damage may have already been done.

Patching

Ensuring that patches are updated and applied to all machines and servers within your organisation. Keeping machines updated won’t necessarily stop them from being attacked or the attacks from taking hold, but it is an important step that shouldn’t be overlooked. Patches are released regularly to address security as well as critical operating issues present on a machine.

No security solution is 100% foolproof and multiple steps will always need to be taken in order to protect your business. These elements of prevention are not ‘set and forget’ and will require ongoing updating, monitoring and changes as malicious software becomes smarter.

If your business has any form of data, then you have something worth stealing or holding to ransom.
Don’t forget; it’s not a matter of if, but when. Educate your staff, build your defence and stay vigilant.

Welcome to the F5 Solutions Blog.

F5 Solutions has been providing IT solutions for many businesses in the Sydney region since 2011. Our team consists of highly skilled, creative, honest and caring IT professionals who strive for excellence within their fields. As a business, our core focus is on tailoring IT solutions to suit individual businesses, rather than just supplying a blanket fix. This means that we have no interest in selling you a service that you don’t need and because of this, our solutions are refreshingly simple and effective.

The purpose of this blog is to inform not only our clients but the general public about various aspects of IT within businesses. We will be sharing our thoughts as well as experiences from a solution point-of-view as well as any discoveries we may make along the way. From information regarding viruses and malware to informative articles about new technologies and IT capabilities, we hope to share a wide variety of information that may be useful and taken into consideration when making decisions about your business IT solutions.

We welcome your feedback and your comments and encourage any questions that you may have regarding our blog content or general questions about our business, so don’t be afraid to ask. We hope that you find the information here helpful and we thank you for taking the time to poke around.

F5 Solutions Pty. Limited
info@f5solutions.com.au