Blue Solutions

Over the last week we have seen an increase in the amount of companies receiving emails containing Zepto Ransomware, a file encrypting virus based on the infamous Locky cryptoware.
Most of the emails have been carefully crafted to ensnare the victims using social engineering techniques, typically greeting the recipient by first name and asking them to open an attachment which they had requested.
zepto image
The attachment will typically be either a .zip extension or .docm extension and once opened will run a malicious JavaScript which then encrypts all files on the users machine with the .zepto extension

To try and combat the infection, we offer the following advice
1. To protect against JavaScript attachments, tell Explorer to open .JS files with Notepad.
2. To protect against VBA malware, tell Office not to allow macros in documents from the internet.
3. Ensure your AntiMalware program is upto date
4. Ensure your users are careful with email attachments and only open the ones they are sure they have requested
5. If possible set email filtering to quarantine all .zip and .docm files

Brian-A-Jackson1

On a weekly basis there are now articles regarding a big brand company which has been hacked, these usually relate to what data has been lost, how they are notifying those affected and what they are going to be doing to prevent this from happening again.

So how do you prevent it from happening in the first place?

From experience I can see that if a hacker wants to get details from somewhere they will take the easiest target, the ‘Low Hanging Fruit’ as they say, in ensuring your company has some basic security principles in place can help mitigate this.

So how do you ensure you are not the ‘Low Hanging Fruit’

Simple measures can be taken within your environment to help secure it. As a basic level you should be meeting the following guide - CyberEssentials Requirements

This sets out some advice regarding Firewalls, User access control, Passwords, Malware protection and Patch management.

Once you have met the standards given within this document you should be looking to increase the security standards within your organisation. The most effective we have found is the use of education, once educated your staff will be able to react to the threats quicker and reduce the risks to your company.

security-banner

Our top security updates in the news and on the web this week

1. CryptoWall 4.0 A Stealthier, More Sweet-Talking Ransomware

When the malware makes its move, the new CryptoWall not only encrypts files, as it always has done, it also encrypts filenames. Heimdal Security states this new technique increases victims’ confusion, and thereby increases the likelihood that they’ll pay the ransom, and quickly. First posted on Dark Reading.

For the original post and further information click here

2. TalkTalk – The case for a Chief Security Officer

While the importance of the Chief Information Security Officer has been in constant growth over the past few years, organisations that employ a CISO/CSO are still far too few. First posted on Trend Micro.

For the original post and further information click here

3. Linux Ransomware Debut Fails on Predictable Encryption Key

No need to crack RSA when you can guess the key. File encrypting ransomware Trojans are almost ubiquitous on Windows, and it was only a matter of time. First Posted on Bitdefender Labs.

For the original post and further information click here

Brian-A-Jackson1

 

4. Adobe Flash Update Includes Patches for 17 Vulnerabilities

In what’s becoming a monthly ritual, Adobe today pushed out an updated version of its Flash Player that includes patches for critical vulnerabilities. First posted on Threatpost.

For the original post and further information click here

5. How Scammers Are Trying To Use Your Computer To Steal Your Cash

Cyber criminals want to hijack your computer for financial gain. But how does the scam work and how can you stop them? First posted on TechWeek Europe.

For the original post and further information click here

6. Top ranking Instagram client removed from iTunes and Google Play after user data theft discovery

A software developer has discovered that a leading free app on iTunes and Google Play has been sending people’s usernames and passwords to an unknown website. The malicious app is called InstaAgent, and is touted as an Instagram client. It is also reportedly the most downloaded free app in the UK and Canada. First posted on TechWeek Europe.

For the original post and further information click here

If you have any security news that you would like to see on our blog please send it to us at bluesolutions, please include the link from the original article in the email.

blue and comptia bannerAre you attending CompTIA EMEA Member and Partner Conference 20th October 2015?

If you haven't yet registered to the Comptia event at 155 Bishopsgate London please go to  https://www.comptia.org/emea/home it would be great to see you there.

Blue Solutions was founded in 2000 with a clear mission: to enable IT channel partners to sell managed services software that would boost recurring revenues, strengthen margins, and clearly differentiate their offerings in a crowded market. As key vendor partners like AppRiver, Bitdefender, Censornet, DataFortress, Malwarebytes, Microsoft, Phish5, Redstor, Symantec, TrendMicro, and many others will testify, we’ve been succeeding at it ever since.

The bottom line of it is we enable our partners to build profitable, regular revenues, by delivering what their competitors can’t – compelling, diverse, scalable managed services, at low cost, that delight their end-users. So if you’re serious about growing your business, don’t miss this opportunity to expand your knowledge and to hear from our vendor and industry experts please feel free to book a time with Barry Atkinson, Emma Wale, Lee Walker or Israel Azumara to discuss Blue Solutions our vendors in more detail.

If you have queries please call 0118 9898 222 and request to speak to any of the names above regarding the event.

microsoft

Originally posted by Mary Jo Foley for All About Microsoft on ZDNet

Microsoft is kicking off the rollout of Office 2016 for Windows on September 22, and is adding a new branch updating scheme, similar to the one available for Windows 10.

It's not a big surprise given recent leaks, but Microsoft officials are confirming that the Office 2016 for Windows rollout will begin on September 22.

September 22 is the date when the next version of Office for Windows desktops will be generally available. Office 365 Personal and Home users will be able to start manually installing Office 2016 apps for Windows on September 22 from Office.com. Microsoft will begin pushing out the new Office 2016 apps via automatic updates in October 2015. Those with volume-licensing contracts will be able to download Office 2016 starting October 1 from the Volume Licensing Centre.

Office 2016 for Windows desktops is the full-featured set of Office apps and the successor to Office 2013. Microsoft released an IT/pro preview of Office 2016 for Windows in March and a public preview in May 2015. The new Office suite runs on Windows 7, 8 and 10 PCs, laptops and tablets.

As part of the rollout, Microsoft is making some changes to the Office update model.

newoffice2016branches.jpg

Those with Office 365 ProPlus subscriptions will be able to continue getting monthly feature and security updates. Taking a page from the Windows 10 playbook, Microsoft is calling this monthly updated release the "Current Branch." The next Current Branch release will be September 22 and will include all the new Office 2016 app updates, according to a September 10 blog post explaining Microsoft's rollout plans.

There also will be a new Office 365 Pro Plus Current Branch for Business updating option. This is for business customers and IT pros who may prefer to wait a few months before rolling out new versions or updates to Office for testing purposes.

Similar to Microsoft's new Current Branch for Business updating path for Windows, the Office Current Branch for Business will provide users with "three cumulative feature updates per year," plus monthly security updates, officials said. That means the next Current Branch for Business build of Office 2016 -- which will include the same feature set as the September 22 release, plus four additional months of security updates -- will be out in February 2016, according to today's blog post.

There are relatively few new features in Office 2016 for Windows. Data loss prevention comes to the Office apps with this release. There also are additional document co-authoring capabilities, new "Tell Me" navigation support, integration with Power BI, and more lockdown/rights management capabilities in the new version of Office for Windows.

Microsoft made the Mac version of Office 2016 available to Office 365 subscribers in July. Later this month, Microsoft plans to offer Office 2016 for Mac available to those who prefer to buy a single copy outright.

Microsoft delivers first public preview of Office 2016 for Mac

Microsoft delivers first public preview of Office 2016 for MacMicrosoft has released the first public preview of Office 2016 for Mac, its updated Office suite for Mac OS 10.10 users, which is due out this summer.

Read More

 

 

Update: A few more reader questions and answers about Office 2016 for Windows' coming rollout (delivered via a Microsoft spokesperson):

Q: Will Office 365 Business Premium -- and not just Office 365 users with ProPlus -- automatically get these updates and be serviced via branches?

A: Yes, Business customers will also receive the 2016 apps and will default to the Current Branch. Business Premium customers can choose to move to the Current Branch for Business if they choose to at any time, once available.

Q: Is there going to be an equivalent to Windows 10's Long Term Servicing branch for O365 users who don't ever want to see new features between Office releases?

A: We recommend using the Office 2016 Volume Licensing (MSI) version for customers who want to have Office installed on specialty systems that do not require feature update but can continue to get security update and bug fixes.

Q: If you are an O365 Pro Plus subscriber right now, are you already getting three buckets of updates to the Office apps annually?

A: Current Office 365 ProPlus customers are on the Current Branch today. We will, however, move all ProPlus customers to the thrice-yearly update schedule by moving them to the Current Branch for Business. Customers can choose to remain on the current branch. All updates are delivered via the Office CDN or deployed via the organization's administrator (not Windows Update).

Q: If you are on Current Branch Office 365, are the thrice-yearly updates forced/mandatory -- the way Current Branch updates are on Windows 10?

A: Current Branch can contain feature, security and non-security fixes on a monthly basis. Customers have a choice to stay on a build as long as they choose to but we recommend they update to the latest version in order to take advantage of any new feature and security fixes.

Q: Can those running Office 2016 for Windows preview upgrade directly to RTM version?

A: It depends on how a customer has accessed the Office 2016 Preview.

Commercial Office 365 customers who have accessed the Office 2016 Preview through the First Release program will continue to get the latest updates across their Office 365 workloads, including Office client. If they would like to revert to the production release of Office 2016 when it becomes available, they can uninstall the Office 2016 Preview from programs and features and download the production version of Office 2016 from their My Software page.

Office 2016 Preview for IT Pros and Developers will continue to get the latest updates across their Office 365 workloads, including Office client. If they would like to revert to the production release of Office 2016 when it becomes available, they can uninstall the Office 2016 Preview from programs and features and download the production version of Office 2016 from their My Software page.

Office 365 Consumer Subscribers: If a customer joined the Office 2016 Preview through their Office 365 My Accounts page, they can simply uninstall the Office 2016 Preview from Windows Programs and Features and install the production release of Office 2016 from their My Accounts page. Office 2016 Preview (no Office 365 subscription):

The Office 2016 Preview will expire at Fall 2015 and will enter a reduced functionality mode. Customers will have the option to convert to a paid Office 365 subscription or they may choose uninstall the Office 2016 Preview from Windows and re-install any licensed version of Office that they have.

 

Blue Solutions GoTo logo

 

We are pleased to announce that we’ve expanded our team and have recently welcomed the following people to Blue Solutions:

  • Lee Walker has joined us as our LabTech Software Specialist. He is responsible for recruiting new LabTech Channel partners and managing the existing partners using the Remote Monitoring and Management solution.
  • Danni Sparkes has joined our team as a new Internal Sales Co-ordinator.  Her role will involve producing quotes for customers and responding to sales queries in a timely and effective manner.
  • Michael Smith and Zoe Hepper have both joined us as Business Development Executives, supporting new business revenue growth by recruiting new channel partners.

A big welcome to our new team members.

LabTech logo

 

Originally published on the LabTech Blog - Author Josh Preston

As an MSP, you have two choices. You can be your own boss, be passionate about the work you do and work hard for your success. Sound good? Option two is even better. With the right preparation and foundation, you can have a business that runs so smoothly and effortlessly that you can finally take a real vacation.

Running your business with an eye on growth means changing your mindset and your business focus. Continuous growth is the goal, since it means expanding profits and staying a step (or several) ahead of your competitors. The market changes fast, but the more proactive you can be, the more you’ll be able to offer your clients. The more they depend on your services, the faster you’ll see growth in your company and your bottom line.

Here are a few big game changers to help you jump start your business growth:

1. Stay Safe
Security continues to top the list of your clients’ biggest concerns, so find a strong security platform that keeps them protected without risk. Find the perfect balance between mitigating risk and hindering productivity.

2. User First
How many devices do you have? Chances are you’ve got more than one, and so does every end user you support. Enter the shift to by user management instead of by device. Make sure you’re staying ahead of the game by supporting multiple devices.

3. Connect Everything
Data, devices and people are quickly intertwining, giving MSPs the chance to offer a number of ‘smart’ devices and opportunities. The market opportunity for the Internet of Things (IoT) is huge, so watch this one grow in the next few years and see how you can get on the bandwagon.

4. One-Stop Access
In a nutshell, virtualization allows multiple operating systems to run on one physical piece of hardware. This cost-saving trend will easily catch clients’ attention, so be sure to stay informed of what it offers.

5. Keep Compliant
Regulation and compliance requirements are an important and challenging task for many organizations. Wrap your head around the details for a few relevant verticals, and start reaching out to offer this vital service to new and current compliance-reliant clients.

Keep a close eye on these trends as they come to life, and be ready to answer any questions your clients might have about them. The more you know, the faster you establish your place as a trusted advisor—and the more your clients will thank you.

Windows10

Article originally published on the Malwarebytes website

It’s that time again, a new operating system emerges from the Microsoft incubator! While many of you might not get to experience Windows 10 just yet or even in the foreseeable future, we want you to know that when you decide to use it, Malwarebytes has got your back.

The latest versions of our Malwarebytes products supports Windows 10! And that includes:

  • Malwarebytes Anti-Malware Free
  • Malwarebytes Anti-Malware Premium
  • Malwarebytes Anti-Exploit Free
  • Malwarebytes Anti-Exploit Premium
  • Malwarebytes Anti-Malware for Business
  • Malwarebytes Anti-Exploit for Business
  • Malwarebytes Anti-Malware Remediation Tool

So one of the first things you should do after setting up your new operating system is to download Malwarebytes Anti-Malware. Trust me, the cyber criminals won’t wait until everyone is comfortable with Windows 10 to start targeting folks using it.

To download the latest Malwarebytes Anti-Malware on your new Win 10 system, click here.

Find out more about Malwarebytes at www.bluesolutions.co.uk/malwarebytes/. Call our sales team today on 0118 9898 222 for a free trial or demo.

Malwarebytes Image

Originally published on the Malwarebytes Security Blog

May 6 marked the 15 year anniversary of the infamous ILOVEYOU (Love Letter) email virus. The virus is regarded as the first major virus spread by email.

ILOVEYOU reportedly infected tens of millions of computers worldwide, and cost billions of dollars in damage.

Once a machine was infected with ILOVEYOU, the virus scanned the Windows Address Book and subsequently sent copies of itself to every contact within the list. Using the public’s lack of email security to its advantage, the virus was able to masquerade as a legitimate attachment sent by a known acquaintance.

This simple social engineering tactic allowed the virus to propagate world-wide quickly and efficiently.

In the years since ILOVEYOU, we’ve all learned lots regarding email security and ‘best practices’ to use when downloading attachments. There have been numerous articles, write-ups, warnings, and suggestions advising users to be wary when opening attachments that come via email – even when from a trusted source.

Despite more than a decade and a half of these warnings, email is still a primary vector for the installation of malicious software.

The M3AAWG Email Metrics Report, released Q2 of 2014, indicates that over a three-month tracking period, a whopping 987 billion “abusive” emails were identified as being successfully delivered.

While this pales in comparison to the other 9+ trillion emails blocked by the mail providers, this number demonstrates just how successful  a vector email is for malicious actors to use to compromise their victims.

While the M3AAWG report doesn’t distinguish between emails with malicious attachments and other types of abusive emails such as phishing emails, it’s reasonable to assume that at least a significant percentage of the abusive emails did indeed contain a malicious attachment.

As indicated by the report, the vast majority of these messages are blocked by large email providers such as Microsoft and Google, but despite the best efforts of these companies, many messages still find their way through the filters.  Here is an example of a malicious email I received to my personal email account just the other day.

MalSpam1

The success of these malware campaigns relies in numbers. With an estimated 205 billion emails sent each day, it seems to be a herculean, if not almost impossible task to prevent each and every malicious email from being delivered.

We would all be quite peeved if that important document from our boss wasn’t delivered to our email box, or if that emergency change in insurance wasn’t received from HR.

The big email providers know this, so they are forced to tread lightly when determining if an attachment is malicious or not. The problem is malicious actors know this too.  So for them, it’s just a numbers game.

If one address gets blocked, use another. If one message is blocked, send one more – better yet, send a million more. And there in-lies the issue that we in the security field face when it comes to preventing you from seeing (and in the case of malware – blocking) this sort of garbage all together.

A small portion of over-all attempted deliveries and an even smaller percentage of successful installs is all that’s needed to claim success.

Malware authors utilise a dizzying array of tools, services, and botnets to facilitate delivery of malicious email. Email addresses are spoofed. The subject and body can be dynamically generated using unique information to help provide a sense of legitimacy to the email. Most attachments are randomized both in name and MD5’s to thwart detection.

Geo-location is used to send emails to users of a particular region, city, or post code. And the subject matter of emails constantly changes to play into the fears, desires, and dreams of every potential person.

MalSpam2

Attachments are not limited to .zips either. Attachments have been seen to arrive in .exe format (although rare with large email providers), .scr, .pdf, .com, .js, or a variety of others. Here we can see how some attachments attempt to appear legitimate.  Take notice of the large spaces between filenames and the .exe extension on a few of the attachments.

MalSpam3

Remember, it only takes a small portion of sent emails, and an even smaller percentage of those to be clicked, in order for a malware author to claim a particular spam-run successful.

The reality is, these people wouldn’t use email as an attack vector if it didn’t work – but it does.

The only reason it does is because a small percentage of us still click such attachments thinking there may be some legitimacy to the content.

Despite 15 years of warnings, billions of dollars in damages, and countless attacks attributed to email, we have yet to learn the dangers of downloading unsolicited attachments.

So for the sake of humanity (a bit dire, I know) please quit clicking attachments from people you don’t know, or from contacts where the content appears suspicious.

If there is a question if the email is legitimate, contact the sender and inquire.

If you didn’t order anything online, don’t click the Word document advising you of your recent purchase.

If you haven’t done so already, configure Windows to always show file extensions. That way, if you do download and extract a malicious attachment, you can hopefully see if any trickery is being played with spaces between the visible filename and the extension.

And most importantly, educate someone you know who would never read this (or any) security blog as to hopefully help them from succumbing to the ever-changing tactics of malware spam.

Blue Solutions is now a distributor for Malwarebytes- read the press release here. Call our team on 0118 9898 222 and they'll help with any questions or arrange a free trial.

censornet logo

Originally published by CensorNet

The poor old IT department, if there were ever an Olympic sport where you could count the moments between suggesting that technology could change the world and then having it bite you on the backside by an unruly mob, well, they’d be gold medallists.

Naturally, an IT team is predisposed to focus on the challenges and risks that a BYOD culture can bring, which is not a bad thing.  In the IT world, BYOD makes the world a more complex place rather than a simpler one. A fixed desktop located on an internal network is always going to be simpler to deploy, easier to manage, easier to secure and much easier to monitor. The risks can be easily identified and mitigated.

The problem with Browsers

With a few exceptions, the main browsers tend to be Chrome, Internet Explorer, Firefox & Safari. The problem arises when every user’s personal device needs its browser software up to date. Take your fixed, standardised, controlled infrastructure away and it’s not quite as easy. Some applications will simply not work on older browser versions or even with specific browsers. The quality of user experience may be compromised if the right browser is not selected. It can be a fickle, inconsistent way of working.

More importantly, not keeping a browser up to date may expose security flaws that place the device and its content at risk. Many have learned that particular lesson the hard way.

Our old nemesis ‘Malware and spyware infection’

The natural by-product of an increasing tech savvy world is that the bad guys are getting smarter and the users are more ‘click-happy’, particularly on mobile devices.

Users are seldom intentionally malicious, although clearly it happens. However it is often more a case of due diligence when time is a constraint. Not all will adopt sensible security protocols to ensure they are free of Trojans and other malicious autobots that might be hiding within what, at the time, looked like a cool free widget or an article containing a part of Kim Kardashian that broke the internet.

In 2013, a study by Alcatel-lucent in 2013 estimated that 11.6 million devices were infected; a number that is simply likely to grow. The fastest growing infection rates was on Android with Windows and Android being the primary operating systems likely to be targeted.

In Wi-Fi we (Don’t) trust

All mobile devices will invariably hop on and off Wi-Fi with reasonable regularity. The bandwidth and access point will play a role in mitigating the risk of contamination. Using unsecured hotspots increases the risk, not only to the user but potentially the corporate network. The bad guys are smart and unsecure access channels are a happy hunting ground. An experiment by Jonny Milliken, Valerio Selis and Professor Alan Marshall proved that an airborne virus could be transmitted via WiFi from router to router and hence from one device to another. The attempts to access precious data are unrelenting on the increase.

Even on-premise WiFi can be problematic. The strength of any WiFi and available bandwidth may well dictate how usable a commercial application is on any given mobile device. It should be remembered that not all devices have the same capabilities when it comes to transmission and reception.

Authentication

The mechanism of accessing corporate applications, network and resources requires a method of authenticating that the user is who they say they are. Inadequate mechanisms open the door to abuse.

Legal constraints

It may not immediately spring to mind, but a business cannot control the peccadillos of its employees. A personal laptop that has been used for social activities that cross legal boundaries is one that can compromise the integrity of the business and all that could entail. Reputation is as much a protected treasure as any other business asset, as is consumer confidence in who they are buying from.

Data loss

The most precious asset of any organisation is data. Sales prospects, agreements, policies, goals, strategies, Financial Information, Shareholder reports, whatever information an organisation has must be kept secure. The ramifications of data loss can be severe. A user’s device can compromise data in a variety of ways and not just from pernicious access. How much and where on a device is corporate data going to reside? What degree of sensitive data can be trusted to be on a specific users’ device? What about access codes? Is a user storing key account details in plain text somewhere? What happens if a device is lost or stolen, can data leakage truly be prevented?

Device control

If the device belongs to a user, do they have complete administration rights over their device? The owner tends to know how to use their device and how to change configurations. One potentially  damaging scenario is if a user decides to jailbreak their own device so they can access areas that companies like Apple would rather they did not. Android also has its challenges, although not exactly open source, it naturally lends itself to modification and user changes, given its Linux roots. There is an ever-growing community that seeks to either legitimately change code or simply break it because it can be broken and compromised.

Application conflict

What a user downloads onto their own device is by and large a matter for them. Some applications however, particularly apps for smartphones and tablets, can interfere with commercial applications. There is no way that an IT department can track and recommend, from the hundreds of thousands of apps available, which ones are suitable or which could cause cross-application contamination i.e. result in sub-optimal performance or use.

Human error

No matter what technology is used, there is no way of avoiding simple stupidity or oversight by human beings. A human interface is a flawed one simply because we make mistakes and because the users own their devices; mistakes will inevitably happen. Human error will always be the one true constant why there is no such state as 100% secure.

From an IT standpoint, BYOD presents a raft of obstacles. They are challenges that can be met but the solutions are not fool proof and an element of risk will always remain.