Microsoft cracks down on tech support scams, 16 call centers raided
Read Article at Sophos

More than 100 Indian police swarmed 16 tech support scam call centers in Gurgaon and Noida last week, arresting 39 people for allegedly impersonating legitimate support reps for companies including Microsoft, Apple, Google, Dell and HP.

The day after the raids, which were carried out on Tuesday and Wednesday, Microsoft said that it has received over 7,000 victim reports from customers in more than 15 countries who’ve been ripped off by the call centers.

This is the second of two recent, big raids on Indian tech support scammers. In October, after Microsoft filed complaints about customers falling for pop-up messages that lied about their systems being infected with malware, Indian police raided 10 illegal call centers and arrested 24 alleged scammers.

In that second raid, law enforcement seized a wealth of evidence, including the call scripts, live chats, voice call recordings and customer records used to run the scams.

Read More

Plenty of news outlets have reported on the existence of a rather nasty-sounding malware – thought to originate in Russia – that may have already infected hundreds of thousands of Internet routers up and down the country. The FBI, however, may have a surprisingly easy fix for the problem: switch your router off, then turn it on again.

The official FBI public service announcement explains what this piece of malicious software is capable of. “VPNFilter is able to render small office and home office routers inoperable,” it notes, adding that “the malware can potentially also collect information passing through the router.”

It’s not easy to discover, either. Apparently, identifying and assessing the network activity of the malware in question “is complicated by its use of encryption and misattributable networks.”

Clearly, it’s a sophisticated piece of tech; the FBI attributes the malware to “foreign cyber actors” and The New York Times reports that it’s of Russian origin, with the Justice Department linking it to the Sofacy Group. Also known as Fancy Bear, this is the same Russian military intelligence agency outlet that hacked the DNC servers prior to the 2016 presidential election.

The FBI explains that “the size and scope of the infrastructure impacted by VPNFilter malware is significant. The malware targets routers produced by several manufacturers and network-attached storage devices by at least one manufacturer.”

This sounds both grim and complicated, which makes it all the more impressive that the temporary solution to the problem may be deceptively simple. “The FBI recommends any owner of small office and home office routers reboot the devices to temporarily disrupt the malware and aid the potential identification of infected devices,” it says, almost nonchalantly.

ArsTechnica reports that later “stages” of the malware, which steal data and so on, are temporarily disabled during a reboot. Upon rebooting, stage one calls out to the now-seized website for instructions, which allows the FBI to identify the infected device.

They also advise people to perhaps disable any remote management settings on their device, make sure their passwords are strong, and to activate any encryption software if available. If you can, make sure the devices are operating the most up-to-date version of the firmware.

According to the Guardian, the warning followed on from a recent court order that permitted the FBI to take control of a website, one the hackers planned to use to command the malware within the routers. Although this ability has since been disabled, the routers still remain infected if no further action has been taken on the part of the owners.

Far from just the US, by the way, infections have apparently been detected in at least 54 countries, with Ukraine thought to be the prime target for the hackers.

What is Email Phishing?

Phishing is when a third party, usually a hacker or malicious website, uses the branding of a well known company to lure a user into exposing private information.

There are two types of email phishing schemes:

• Phishing emails that come to you
• Phishing emails that come from you

Phishing emails impersonate legitimate businesses to implant malware in an attachment or download or obtain login credentials. Phishing is the primary method of obtaining user information or passwords for attacks. You need to know how to protect yourself, your employees, and your business from phishing.

Identifying Phishing Emails
Phishing groups and hackers are constantly changing their patterns to improve both their targeting and the effectiveness of their emails in order to exploit users, but there are a few characteristics in common for every phishing email.

Phishing emails impersonate a strong brand

Big brands such as Paypal, UPS, Fedex, financial institutions, credit cards, banking and insurance industries are often impersonated to trick users into thinking an email message is authentic. Always ask yourself these three questions: Do you really have an account with that company? Is this the email address i provided for that account? Have you done anything with the account lately?

“From” domain and Return Path Domain will not match

It is relatively easy to spoof a “From” address. Email Standards allow ANY 3rd party to send email messages on the internet on behalf of another domain, otherwise hosting providers like Google and Outlook.com or bulk email providers could not send email for the business or personal domains they host. If for example, you recieve a message that looks like it came from PayPal, make sure the from address ends in PAYPAL.COM. There also may be text after the .com, for instance, PayPal.com.something.somethingelse. In this instance, you have a phishing email! –

There is an (often unexpected) attachment

If you are required to download anything that you did not ask the company for, then it is probably a phishing email and will most likely contain malware or viruses. PDFs or Word DOCs can contain malware payloads. They are trying to trick you into thinking that their fake attachment is real so that they can get personal, private or financial data from you. Don’t download attachments you did not ask for.

There is a sense of urgency

These kinds of emails will usually ask you to “take action soon” or it will cost you money. This sense of urgency makes you react before you think. Take a breath before acting on any email that looks really important.

Links on the page go to a different domain

Often a phishing email will include a link to a 3rd or 4th domain or just to an IP address. The goal here is to get you to click unsuspectingly on any link so they can further the con and grab your information when you attempt to login to their fake website. Sometimes the domains even look like subdomains or related domains. Always check links before clicking on them.

It is always best practice to open a clean window and navigate to the company’s website and login to your account from there to check on the issue. for Example, if you received an urgent email from Your Bank, either open a new browser window and go directly to your bank’s website by typing in the address yourself, or give your bank a call.

Quality Varies

Some phishing emails, look good on the surface. For example, the logos look correct, the fonts and color scheme are appropriate and some of the language is even straight from legitimate emails. However, when you read deeper you can see spelling mistakes, grammatical errors or other areas where it is clear the writer was not a native English speaker.

Our Spam Filter Has You Covered

While no spam filtering solution exists that can eliminate this problem, our spam filtering has intelligent, adaptive, and learning based heuristics capabilities, allowing it to detect and block most of these emails before they ever hit your inbox. While having spam protection helps, its always up to the end users to follow these guidelines and become aware of these warning signs.

Update: AOL reporting issue has been resolved!

Update! AOL services are now working. We appreciate your patience.

— AOL Customer Support (@AOLSupportHelp) March 2, 2018

While we are not affiliated with AOL, or the outage in general, we’ll keep you posted as to when they fix the issue.

We’ve received numerous calls and emails today to our support line where customers could not reach AOL Mail. For the past several hours AOL has been down and some delivery problems have been noted. While AOL works to correct this, expect continued interruptions and timeouts.

These outages can happen time to time with free services. A hosted email solution is the most reliable way to ensure you always have access to your emails. These free accounts are not reliable, secure, spread viruses and are hacked on an almost daily basis.

Our Hosted Microsoft Exchange Emails gives you the power, flexibility & productivity you demand in business critical email system. Bulldog Tech offers affordable, convenient and secure email packages.

Looking to ditch AOL? Give us a call.

Our first robotic project – fully automated window cleaning robot!

Follow us and watch out for our other upcoming projects, such as manufacturing robots and other exciting new products.

Yes – even the big boys have problem days!

We spent all weekend helping our customers affected by the Allscripts malware attack. A limited number of Allscripts services went down Thursday after a ransomware incident, according to an emailed statement from company spokeswoman Concetta Rasiarmos.

AllScripts allows physicians to send electronic prescriptions to pharmacies. Patient data is sent to a pharmacy for order completion – by being hacked and compromised, patient data is at risk!

New variant of SamSam – a ransomware family linked to several attacks against medical providers – is behind the Allscripts outage

The EHR giant is investigating the incident to provide further details.

“We are working diligently to restore these systems, and most importantly, to ensure our clients’ data is protected,” wrote Rasiarmos. “We regret any inconvenience caused by this temporary outage.”

In a conference call for customers on Saturday, which Salted Hash listened-in on, Allscripts’ Jeremy Maxwell, director of information security, said their PRO EHR and Electronic Prescriptions for Controlled Substances (EPCS) services were the hardest hit by the ransomware attack.

Other services had availability issues as well, but those have since been restored, such as direct messaging and some CCDA functionality.

The following email was sent to Providers:

From: NYSDOH HEALTH NOTIFICATION [mailto:notify01@health.ny.gov] Sent: Friday, January 19, 2018 9:20 PM
To: Lisa Eng
Subject: Alert: For your immediate attention: AllScripts Cyber Event

Click here when you are ready to confirm receipt of the email.
If you can not click the above link use the following URL by copying into your browser.
https://apps.health.ny.gov/pub/cgi-bin/applinks/pubforms/AlertAcknowledge2?AID=9909950yag3dqb6av

Type: Alert
Description of Alert: For your immediate attention: AllScripts Cyber Event
Source Organization: NYSDOH
Authorizing Person: Sally Dreslin
Sender’s Jurisdiction: state
Document Date: 01/19/2018
Date of Alert: 01/19/2018

The Department of Health (DOH) is aware that a cyber incident regarding AllScripts has occurred. This may have an impact on the ability for hospitals, clinics, nursing homes, individual prescribers and pharmacies to transmit and receive prescription electronically. It is permissible for those impacted to use paper official prescriptions in accordance with New York State regulations. Should you have urgent questions in this regard, please contact DOH at (866) 811-7957 or off-hours at (866) 881-2809.

Recipients:
Dental Practices – Controlled Substance Prescription Data Reviewer (CSPDR)
Dental Practices – Controlled Substance Prescription Data Submitter (CSPDS)
Dental Practices – HPN Coordinator
Hospital (ext clinic) – Administrator
Hospital (ext clinic) – Director, Nursing
Hospital (ext clinic) – Emergency Response Coordinator
MDs as organizations – Controlled Substance Prescription Data Reviewer (CSPDR)
MDs as organizations – Controlled Substance Prescription Data Submitter (CSPDS)
MDs as organizations – HPN Coordinator

For questions: Please send an e-mail to debra.sottolano@health.ny.gov, as notify01 is a non-monitored mailbox.

Alert – Highest priority emergency communication; warrants immediate action or attention by the recipient.
High Advisory – High priority does not warrant immediate action but recipients should be aware.
Advisory – Provides very important information for a specific incident or situation that does not require immediate action.
Updates to Alerts and Advisories – Provides updated informa tion regarding an incident or situation; unlikely to require immediate action.
Informational Message – Provides timely information, important for review or serves as a reminder for an action that should be taken.

Click here when you are ready to confirm receipt of the email.
If you can not click the above link use the following URL by copying into your browser.
https://apps.health.ny.gov/pub/cgi-bin/applinks/pubforms/AlertAcknowledge2?AID=9909950yag3dqb6av

Don’t Fall Victim!

Vanguard’s OnGuard Remote Backup platform has helped many customers over the bast few months recover from encryption ware based attacks! We offer a trusted protection platform that’s flexible enough to meet your current and future business needs. Our LIVE support works with you to help recover your systems quickly.

We are also introducing several new OnGuard security products this year geared to protect your business.

Onguard Mail Essentials powered by GFI: Protect your business against email-borne junk, viruses, spyware, phishing and other malware threats.

Hardware Firewalls with Advanced Security Protection: We are working with our U.S.A. based developers in order to provide proactive protection of your entire network, reducing your exposure to cyber threats at a price point that will not decrease your bottom lime.

• Protection against polymorphic malware, using smart cloud based AV engine and definitions powered by Kaspersky.
• GFI Directory support for non Active Directory environments which enables far more flexibility when managing users in these environments.
• Support for Microsoft Windows Server 2016.
• Several reliability and performance improvements alongside a patch rollup of all the previous bug fixes that were released to date.
• Advanced spam-blocking technology with a spam capture rate of over 99% and close to zero false positives
• Hassle-free spam management, includes a web-based email management dashboard and reporting tool

We’re Taking The Fight To The Spammers!

A few weeks ago I explained my experiment on how I can control my spam doing nothing else but unsubscribing from emails I receive and don’t want.

Its been about 12 weeks since I began this experiment. My initial results in the first 3 weeks were amazing. I reduced my spam emails by 50%. It’s a little work to unsubscribe from some lists. If you remember, sometimes you need to unsubscribe several times, add REMOVE to your email subject, find the unsubscribe button in the email and sometimes a combination of all the above.

Now its Christmas – what better time to stop the spam emails to lists you never signed up for. and to verify our experiment. Since early October, I have intensified my unsubscribing and not allowed ANY emails I do not need to not be unsubscribed. Naturally, as I ordered items, visited web sites and performed my daily work tasks, my email will always be on another list – so i was very diligent in my immediate unsubscribing.

Results as of December 6, 2017

COMPLETE SUCCESS! – my mailbox has been reduced by 80% of junk mail. Where at nite, I would receive a few dozen emails, now I can go hours without a single unwanted email. Some experimentation with our intrusion detection software shows that attacks have been lessened, email’s with viruses loads have been reduced and our firewalls have seen a reduction in threat assessments. Therefore we can posit that the reduction in spam emails can make out network and business somewhat safer.

Therefore – unsubscribe from unwanted emails – except from us!

TLDR – Too Long, Didn’t Read

Unsubscribe from unwanted emails as you receive them – it will protect your network and decrease your incidences of viruses as well as clean you inbox!

Merry Christmas to all!

Read Article at CNBC

Hyatt Hotels said Thursday it discovered unauthorized access to payment card information at certain Hyatt-managed locations worldwide between March 18 and July 2.

Hyatt said the incident affected payment card information, such as, cardholder name, card number, expiration date and internal verification code, from cards manually entered or swiped at the front desk of certain Hyatt-managed locations.

The owner of Andaz, Park Hyatt and Grand Hyatt chain of hotels said a total of 41 properties were affected in 11 countries, with China accounting for 18 properties, the most among impacted countries.

Seven Hyatt properties were affected at U.S. locations, including three in Hawaii, three in Puerto Rico and one in Guam.

The Chicago, Illinois-based company said its cyber security team discovered signs of the unauthorized access in July and launched an internal investigation, completed on Thursday, that resolved the issue and took steps to prevent this from happening in the future.

This is not the first time Hyatt is facing data breach problem at its hotels.

In late 2015 Hyatt said its payment processing system was infected with credit-card-stealing malware, that had affected 250 hotels in about 50 countries.

Read article at MSN

SAN FRANCISCO — At the start of this decade, the Arab Spring blossomed with the help of social media. That is the sort of story the tech industry loves to tell about itself: It is bringing freedom, enlightenment and a better future for all mankind.

Mark Zuckerberg, the Facebook founder, proclaimed that this was exactly why his social network existed. In a 2012 manifesto for investors, he said Facebook was a tool to create “a more honest and transparent dialogue around government.” The result, he said, would be “better solutions to some of the biggest problems of our time.”

Now tech companies are under fire for creating problems instead of solving them. At the top of the list is Russian interference in last year’s presidential election. Social media might have originally promised liberation, but it proved an even more useful tool for stoking anger. The manipulation was so efficient and so lacking in transparency that the companies themselves barely noticed it was happening.

The election is far from the only area of concern. Tech companies have accrued a tremendous amount of power and influence. Amazon determines how people shop, Google how they acquire knowledge, Facebook how they communicate. All of them are making decisions about who gets a digital megaphone and who should be unplugged from the web.

Sign Up For the Morning Briefing Newsletter

Their amount of concentrated authority resembles the divine right of kings, and is sparking a backlash that is still gathering force.

“For 10 years, the arguments in tech were about which chief executive was more like Jesus. Which one was going to run for president. Who did the best job convincing the work force to lean in,” said Scott Galloway, a professor at New York University’s Stern School of Business. “Now sentiments are shifting. The worm has turned.”

News is dripping out of Facebook, Twitter and now Google about how their ad and publishing systems were harnessed by the Russians. On Nov. 1, the Senate Intelligence Committee will hold a hearing on the matter. It is unlikely to enhance the companies’ reputations.

Under growing pressure, the companies are mounting a public relations blitz. Sheryl Sandberg, Facebook’s chief operating officer, was in Washington this week, meeting with lawmakers and making public mea culpas about how things happened during the election “that should not have happened.” Sundar Pichai, Google’s chief executive, was in Pittsburgh on Thursday talking about the “large gaps in opportunity across the U.S.” and announcing a $1 billion grant program to promote jobs.

Underlying the meet-and-greets is the reality that the internet long ago became a business, which means the companies’ first imperative is to do right by their stockholders.

Ross Baird, president of the venture capital firm Village Capital, noted that when ProPublica tried last month to buy targeted ads for “Jew haters” on Facebook, the platform did not question whether this was a bad idea — it asked the buyers how they would like to pay.

“For all the lip service that Silicon Valley has given to changing the world, its ultimate focus has been on what it can monetize,” Mr. Baird said.

Criticism of tech is nothing new, of course. In a Newsweek jeremiad in 1995 titled “Why the Web Won’t Be Nirvana,” the astronomer Clifford Stoll pointed out that “every voice can be heard cheaply and instantly” on the Usenet bulletin boards, that era’s Twitter and Facebook.

“The result?” he wrote. “Every voice is heard. The cacophony more closely resembles citizens band radio, complete with handles, harassment and anonymous threats. When most everyone shouts, few listen.”

Such complaints, repeated at regular intervals, did not stop the tech world from seizing the moment. Millions and then billions of people flocked to its services. The chief executives were regarded as sages. Disruption was the highest good.

What is different today are the warnings from the technologists themselves. “The monetization and manipulation of information is swiftly tearing us apart,” Pierre Omidyar, the founder of eBay, wrote this week.

Justin Rosenstein, a former Facebook engineer, was portrayed in a recent Guardian story as an apostate: Noting that sometimes inventors have regrets, he said he had programmed his new phone to not let him use the social network.

Mr. Rosenstein, a co-founder of Asana, an office productivity start-up, said in an email that he had banned not just Facebook but also the Safari and Chrome browsers, Gmail and other applications.

“I realized that I spend a lot of time mindlessly interacting with my phone in ways that aren’t serving me,” he wrote. “Facebook is a very powerful tool that I continue to use every day, just with more mindfulness.”

If social media is on the defensive, Mr. Zuckerberg is particularly on the spot — a rare event in a golden career that has made him, at 33, one of the richest and most influential people on the planet.

“We have a saying: ‘Move fast and break things,’” he wrote in his 2012 manifesto. “The idea is that if you never break anything, you’re probably not moving fast enough.”

Facebook dropped that motto two years later, but critics say too much of the implicit arrogance has lingered. Mr. Galloway, whose new book, “The Four,” analyzes the power of Facebook, Amazon, Google and Apple, said the social media network was still fumbling its response.

“Zuckerberg and Facebook are violating the No. 1 rule of crisis management: Overcorrect for the problem,” he said. “Their attitude is that anything that damages their profits is impossible for them to do.”

Joel Kaplan, Facebook’s vice president of global public policy, said the network was doing its best.

“Facebook is an important part of many people’s lives,” he said. “That’s an enormous responsibility — and one that we take incredibly seriously”

Some social media entrepreneurs acknowledge that they are confronting issues they never imagined as employees of start-ups struggling to survive.

“There wasn’t time to think through the repercussions of everything we did,” Biz Stone, a Twitter co-founder, said in an interview shortly before he rejoined the service last spring.

He maintained that Twitter was getting an unfair rap: “For every bad thing, there are a thousand good things.” He acknowledged, however, that sometimes “it gets a little messy.”

Despite the swell of criticism, the vast majority of investors, consumers and regulators seem not to have changed their behavior. People still eagerly await the new iPhone. Facebook has more than two billion users. President Trump likes to criticize Amazon on Twitter, but his administration ignored pleas for a rigorous examination of Amazon’s purchase of Whole Foods.

In Europe, however, the ground is already shifting. Google’s share of the search engine market there is 92 percent, according to StatCounter. But that did not stop the European Union from fining it $2.7 billion in June for putting its own products above rivals.

A new German law that fines social networks huge sums for not taking down hate speech went into effect this month. On Tuesday, a spokesman for Prime Minister Theresa May of Britain said the government was looking “carefully at the roles, responsibility and legal status” of Google and Facebook, with an eye to regulating them as news publishers rather than platforms.

“This war, like so many wars, is going to start in Europe,” said Mr. Galloway, the New York University professor.

For some tech companies, the new power is a heavy weight. Cloudflare, which provides many sites with essential protection from hacking, made its first editorial decision in August: It lifted its protection from The Daily Stormer, basically expunging the neo-Nazi site from the visible web.

“Increasingly tech companies are going to be put into the position of making these sorts of judgments,” said Matthew Prince, Cloudflare’s chief executive.

The picture is likely to get even more complicated. Mr. Prince foresees several possible dystopian futures. One is where every search engine has a political point of view, and users gravitate toward the one they feel most comfortable with. That would further balkanize the internet.

Another possibility is the opposite extreme: Under the pressure of regulation, all hate speech — and eventually all dissent — is filtered out.

“People are realizing that technology isn’t neutral,” Mr. Prince said. “I used to travel to Europe to hear these fears. Now I just have to go to Sacramento.”

Follow David Streitfeld on Twitter @DavidStreitfeld

Read Article at MSN

The IRS said late Thursday that it has temporarily suspended the agency’s $7.1 million data security contract with Equifax (EFX) after malware found on the credit bureau’s website again called its security systems into question.

Equifax, now notorious for exposing more than half of all adult Americans to identify theft, maintained the latest security breach was not officially a hack.

An Equifax vendor was “running code that was serving malicious content” on the Equifax site, the company said in a statement. “Since we learned of the issue, the vendor’s code was removed from the webpage and we have taken the webpage offline to conduct further analysis.”

However, consumers who were using the site could easily have been tricked into downloading malware when visiting the Equifax help page, an oversight that experts said put people further at risk. The nation’s largest information technology trade group is urging the government to cancel Equifax’s now suspended contract with the IRS.

“Equifax is known publicly to have security breaches, and they are not correcting them,” said Barbara Rembiesa, president and CEO of the International Association of IT Asset Managers, which represents 50,000 IT managers in 126 countries. “Why are we spending all this money to give our data to a company that has clear problems with the technology?”

Equifax’s latest problem was discovered Wednesday by a private security consultant who realized the company’s consumer help page was serving up malware that aimed to get unsuspecting consumers to download fraudulent Adobe updates.

In September, Equifax revealed that it had exposed 143 million consumer files — containing names, addresses, Social Security numbers and even bank account information — to hackers in an unprecedented security lapse. The number of consumer potentially affect by the data breach was later raised to 145.5 million.

The company’s former CEO blamed a single careless employee for the entire snafu. But even as he was getting grilled in Congress earlier this month, the IRS was awarding the company with a no-bid contract to provide “fraud prevention and taxpayer identification services.”

“On the very day that Equifax’s former chief executive misled Congress by scapegoating a single employee for their second major data breach in four years, the IRS announced that it was awarding the company with a contract which will allow it to leak out even more personally identifiable information about taxpayers,” Rembiesa said.

“The prospect of this happening should horrify any elected official who is charged with looking out for the welfare of American consumers,” she added. “Congress needs to slam on the brakes here and kill this IRS contract.”

The tax agency stopped short of that, at least for the moment.

“Following new information available today, the IRS temporarily suspended its short-term contract with Equifax for identity proofing services,” the agency said in a statement. “During this suspension, the IRS will continue its review of Equifax systems and security.”

The agency does not believe that any data the IRS has shared with Equifax to date has been compromised, but the suspension was taken as “a precautionary step.”

In the meantime, the IRS will be unable to create new “Secure Access” accounts, which can be used to order tax court transcripts online. Although people can’t create new accounts, current Secure Access users aren’t affected by this contract change and will continue to have access to their accounts, the agency said. And these transcripts can still be ordered by mail.

Other IRS services are unaffected.

Update – Equifax Says Vendor Responsible for Malicious Content on Website

Read Article at MSN

Equifax Inc. said it was a third-party vendor that served malicious content on its website and it has taken the page offline to conduct further analysis.

“Equifax can confirm that its systems were not compromised and that the reported issue did not affect our consumer online dispute portal,” Wyatt Jefferies, a spokesman for Equifax said in an email.

The unidentified third-party vendor was responsible for collecting website performance data and had code running on Equifax’s website, Jefferies said. An independent security analyst found on Thursday that the removed page had been altered to trick visitors into installing malware, according to a report on technology news website Ars Technica.

Equifax shares had dropped as much as 3.6 percent, the most intraday since Sept. 15, after the company said its security team was investigating reports of another possible cyber attack. The company is still reeling from the massive data breach it disclosed last month that compromised the private data of more than 145 million Americans.

Richard Smith, former chairman and CEO of Equifax Inc., testifies before House Energy and Commerce hearing on “Oversight of the Equifax Data Breach: Answers for Consumers” on Capitol Hill in Washington, October 3, 2017.

• Equifax has taken one of its web pages down.
• The company recently disclosed a hack that compromised the sensitive information of 145.5 million people.

Published 36 Mins Ago Updated 29 Mins Ago | Read Article at CNBC

Equifax said on Thursday it has taken one of its customer help web pages offline as its security team looks into reports of another potential cyber breach at the credit reporting company, which recently disclosed a hack that compromised the sensitive information of 145.5 million people.

The move came after an independent security analyst on Wednesday found part of Equifax’s website was under the control of attackers trying to trick visitors into installing fraudulent Adobe Flash updates that could infect computers with malware, the technology news website Ars Technica reported.

“We are aware of the situation identified on the equifax.com website in the credit report assistance link,” Equifax spokesman Wyatt Jefferies said in an email. “Our IT and security teams are looking into this matter, and out of an abundance of caution have temporarily taken this page offline.”

The Atlanta-based company, which has faced seething criticism from consumers, regulators and lawmakers over its handling of the earlier breach, said it would provide more information as it becomes available.

Equifax disclosed on Sept. 7 that its systems had been breached between mid-May and late July. In the fallout, the company has parted ways with its chief executive, chief information officer and chief security officer.

The breach has prompted investigations by multiple federal and state agencies, including a criminal probe by the U.S. Department of Justice.

As a credit reporting agency, Equifax keeps vast amounts of consumer data for banks and other creditors to use to determine the chances of their customers’ defaulting.

Read Article at MSN

The hack into the accountancy giant Deloitte compromised a server that contained the emails of an estimated 350 clients, including four US government departments, the United Nations and some of the world’s biggest multinationals, the Guardian has been told.

Sources with knowledge of the hack say the incident was potentially more widespread than Deloitte has been prepared to acknowledge and that the company cannot be 100% sure what was taken.

Deloitte said it believed the hack had only “impacted” six clients, and that it was confident it knew where the hackers had been. It said it believed the attack on its systems, which began a year ago, was now over.

However, sources who have spoken to the Guardian, on condition of anonymity, say the company red-flagged, and has been reviewing, a cache of emails and attachments that may have been compromised from a host of other entities.

The Guardian has established that a host of clients had material that was made vulnerable by the hack, including:

• The US departments of state, energy, homeland security and defence.
• The US Postal Service.
• The National Institutes of Health.
• “Fannie Mae” and “Freddie Mac”, the housing giants that fund and guarantee mortgages in the US.

Football’s world governing body, Fifa, had emails in the server that was breached, along with four global banks, three airlines, two multinational car manufacturers, energy giants and big pharmaceutical companies.

The Guardian has been given the names of more than 30 blue-chip businesses whose data was vulnerable to attack, with sources saying the list “is far from exhaustive”.

Deloitte did not deny any of these clients had information in the system that was the target of the hack, but it said none of the companies or government departments had been “impacted”. It said “the number of email messages targeted by the attacker was a small fraction of those stored on the platform”.

This assurance has been contested by sources that spoke to the Guardian. They said Deloitte’s public position belied concern within the company about exactly what had happened and why.

The Guardian first revealed the existence of the hack on 25 September.

Since then, the Guardian has been provided with further details of the attack, which seems to have started in autumn last year at a time Deloitte was migrating and updating its email from an in-house system to Microsoft’s cloud-based Office 365 service.

The work was being undertaken at Deloitte’s Hermitage office in Nashville, Tennessee.

The hackers got into the system using an administrator’s account that, theoretically, gave them access to the entire email database, which included Deloitte’s US staff and their correspondence with clients.

Deloitte realized it had a substantial problem in spring this year, when it retained the Washington-based law firm, Hogan Lovells, on “special assignment” to review and advise about what it called “a possible cyber-security incident”.

In addition to emails, the Guardian understands the hackers had potential access to usernames, passwords, IP addresses, architectural diagrams for businesses and health information.

It is also thought that some emails had attachments with sensitive security and design details.

Deloitte has insisted its internal inquiry, code-named Windham, found that only six clients had information that had been compromised. The review had also been able to establish “precisely what information was at risk”, the company said.

However, that analysis has been contested by informed sources that have spoken to the Guardian. They say the investigation has not been able to establish definitively when the hackers got in and where they went; nor can they be completely sure that the electronic trail they left is complete.

“The hackers had free rein in the network for a long time and nobody knows the amount of the data taken,” said one source.

“A large amount of data was extracted, not the small amount reported. The hacker accessed the entire email database.”

Another source added: “There is an ongoing effort to determine the damage. There is a team looking at records that have been tagged for further analysis. It is all deeply embarrassing.”

The Guardian has been told Deloitte did not at the time have multi-factor authentication as standard on the server that was breached. A cybersecurity specialist told the Guardian this was “astonishing”.

The expert said the migration to the new email system would have “utterly complicated the kind of forensic investigation required to see what had happened”.

“A hacker has got into Deloitte’s email system and been undetected for months, and only six clients have been compromised? That does not sound right. If the hackers had been in there that long, they would have covered their tracks.”

When the Guardian put all these points to Deloitte, it declined to answer specific questions, but a spokesman said: “We dispute in the strongest terms that Deloitte is ‘downplaying’ the breach. We take any attack on our systems very seriously.

“We are confident that we know what information was targeted and what the hacker actually did. Very few clients were impacted, although we want to stress that even when one client is impacted, that is one client too many.

“We have concluded that the attacker is no longer in Deloitte’s systems and haven’t seen any signs of any subsequent activities.

“Our review determined what the hacker actually did. The attacker accessed data from an email platform. The review of that platform is complete.”

In recent months, Deloitte has introduced multi-factor authentication and encryption software to try to stop further hacks.

Dmitri Sirota, co-founder and CEO of the cyber-security firm BigID, warned that many companies had failed to use such methods because they were inconvenient and complex.

“Privileged accounts are like keys that unlock everything, from the castle to the treasury. They provide unfettered access to all systems, which is why they are so valuable.

“Organizations are monitoring databases, not the data in it. It’s hard to detect changes, prevent incidents or compare your data to notice breached information unless you have an inventory of what you have.”

Equifax’s massive cyber attack it disclosed in September compromised the sensitive personal details of nearly 700,000 consumers in the UK – Reuters

Equifax said on Tuesday that the massive cyber attack it disclosed in September compromised the sensitive personal details of nearly 700,000 consumers in the UK.

Equifax said that 15.2 million UK records dating from 2011 to 2016 were exposed in the incident, which affected 145.5 million people overall, but that 14.5 million of the exposed UK records did not contain information that put consumers at risk.

Developing Story

Now known as Oath, AOL says it will shut down its instant messenger service on Dec. 15 after 20 years.

by Roger Cheng October 6, 2017 7:42 AM PDT | Read Article at CNET

Farewell, AIM.

AOL Instant Messenger, a popular form of communication in the early days of the internet, goes dark on Dec. 15, AOL, now a unit of Verizon’s Oath, said on Friday.

AIM was once one of the dominant instant-messaging platforms on the internet, helped by the massive number of dialup subscribers using AOL internet service. After launching in 1997, it enjoyed its peak in the late ’90s and early 2000s.

But newer services offered by Google and others displaced AIM, and it lost most of its relevancy when users increasingly turned to their smartphones, which brought the rise of WhatsApp, Line, Facebook Messenger and a myriad of other services.

Oath, which also now controls Yahoo, another star of the era when consumers were discovering the internet, said that it’s shutting AIM down to focus on new products and that there would be no replacement for AIM.

The aim.com e-mail domain will still work, Oath said.

Read Article at CNBC

• Yahoo said every single account was affected by a data breach in 2013; originally, the company said 1 billion out of 3 billion accounts were affected.
• Yahoo is now part of a Verizon subsidiary named Oath.
• Yahoo and Oath disclosed the new information on Tuesday evening.

Todd Haselton | @robotodd | CNBC

Published 17 Hours Ago Updated 2 Hours Ago

Yahoo on Tuesday said that every single Yahoo account was affected by a data breach that took place in 2013.

In 2016, Yahoo disclosed that more than one billion of about three billion accounts had likely been affected by the hack. In its disclosure Tuesday, the company said all accounts were likely victimized.

Yahoo included the finding in a recent update to its Account Security Update page, saying that it found out about the wider breach through new intelligence obtained during the company’s integration into Verizon Communications. Outside forensic experts assisted in the discovery, the company said.

“It is important to note that, in connection with Yahoo’s December 2016 announcement of the August 2013 theft, Yahoo took action to protect all accounts. The company required all users who had not changed their passwords since the time of the theft to do so. Yahoo also invalidated unencrypted security questions and answers so they cannot be used to access an account,” Yahoo said Tuesday.

Yahoo said it will begin alerting accounts that weren’t previously notified of the attack.

In 2013, a breach allowed attackers to steal email addresses, passwords, birth dates, telephone numbers and more. The new investigation indicated that stolen information didn’t include passwords in clear text, payment card data or information about bank accounts.

Verizon finished its acquisition of Yahoo in June and is folding it, with AOL, under a new subsidiary named Oath.

Don’t Fall Victim!

Vanguard’s OnGuard Remote Backup platform has helped many customers over the bast few months recover from encryption ware based attacks! We offer a trusted protection platform that’s flexible enough to meet your current and future business needs. Our LIVE support works with you to help recover your systems quickly.

We are also introducing several new OnGuard security products this year geared to protect your business.

Onguard Mail Essentials powered by GFI: Protect your business against email-borne junk, viruses, spyware, phishing and other malware threats.

Hardware Firewalls with Advanced Security Protection: We are working with our U.S.A. based developers in order to provide proactive protection of your entire network, reducing your exposure to cyber threats at a price point that will not decrease your bottom lime.

We also offer managed Antivirus as well as advanced Network Monitoring. We monitor numerous parameters of your systems including disk space, backup status, operating system updates, errors. This proactive approach allows us to proactively maintain your systems for optimal performance and minimal downtime.

[button url=”http://vanguardsys.com/contact-us” text=”Contact Us Today!”]

The U.S. government on Wednesday plans to ban the use of a Russian brand of security software by federal agencies amid concerns the company has ties to state-sponsored cyberespionage activities, according to U.S. officials.

Subscribe to the Post Most newsletter: Today’s most popular stories on The Washington Post

Acting Homeland Security Secretary Elaine Duke will order that Kaspersky Lab software be barred from federal government networks while giving agencies a timeline to get rid of it, according to several officials familiar with the plan who were not authorized to speak publicly about it. Duke ordered the scrub on the grounds that the company has connections to the Russian government and its software poses a security risk.

The directive comes months after the federal General Services Administration, the agency in charge of government purchasing, removed Kaspersky from its list of approved vendors. In doing so, GSA suggested a vulnerability exists in Kaspersky that could give the Kremlin backdoor access to the systems the company protects.

In a statement to The Washington Post on Wednesday, the company said: “Kaspersky Lab doesn’t have inappropriate ties with any government, which is why no credible evidence has been presented publicly by anyone or any organization to back up the false allegations made against the company. The only conclusion seems to be that Kaspersky Lab, a private company, is caught in the middle of a geopolitical fight, and it’s being treated unfairly even though the company has never helped, nor will help, any government in the world with its cyberespionage or offensive cyber efforts.

“Kaspersky Lab has always acknowledged that it provides appropriate products and services to governments around the world to protect those organizations from cyberthreats, but it does not have unethical ties or affiliations with any government, including Russia,” the firm said.

The directive comes in the wake of an unprecedented Russian operation to interfere in the U.S. presidential election that saw Russian spy services hack into the Democratic National Committee and the networks of other political organizations and release damaging information.

At least a half-dozen federal agencies run Kaspersky on their networks, the U.S. officials said, although there may be other networks where an agency’s chief information security officer — the official ultimately responsible for systems security — might not be aware it is being used.

The U.S. intelligence community has long assessed that Kaspersky has ties to the Russian government, according to officials, who spoke on condition of anonymity to discuss internal deliberations. Its founder, Eugene Kaspersky, graduated from a KGB-supported cryptography school and had worked in Russian military intelligence.

In recent months concern has mounted inside the government about the potential for Kaspersky software to be used to gather information for the Russian secret services, officials said.

Richard Ledgett, former National Security Agency Deputy Director, hailed the move. Speaking on the sidelines of the Billington cybersecurity summit in Washington Wednesday, he noted that by Kaspersky, like other Russian companies, is “bound to comply with the directive of Russian state security services, by law, to share with them information from their servers.”

Concerns about Kaspersky software had been brewing for years, according to one former official who told The Post that some congressional staffers were warned by federal law enforcement officials as early as November 2015 not to meet with employees from Kaspersky over concerns of electronic surveillance.

When GSA announced its July decision, it underscored its mission was to “ensure the integrity and security of U.S. government systems and networks” and that Kaspersky was delisted “after review and careful consideration.” The action removed the company from the list of products approved for purchase on federal systems and at discounted prices for state governments.

The directive will also put pressure on state and local governments that use Kaspersky’s products. Many had been left to speculate about the risks of sticking with the company or abandoning taxpayer-funded contracts, sometimes at great cost. In July, The Post found several state or local agencies that used Kaspersky’s antivirus or security software had purchased or supported the software within the last two years.

Tired of spam email? Try this simple technique to reduce your spam.

My INBOX receives over 400 emails a day. Many of these emails are from websites I have either ordered something from,  downloaded something or are just junk mail. The number of emails almost doubles during the weekend and at nite. Now, its not difficult to DELETE these unwanted emails. But it does take some time to do so and I sometimes delete by mistake a good email that I need (Murphy’s law at work!). To be honest I actually find something interesting in those “junk” emails every now and than.

The technique:

About 3 weeks ago, I decided to try an experiment to reduce the spam emails I receive and save me some valuable time. What I came up with is so simple that I was skeptical if it would actually work. What did I do? I scrolled down on every “spam” email and hit the UNSUBSCRIBE button.

How to UnSubscribe:

Not every email has an “unsubscribe” and those are truly spam and need to be deleted. What i found over the last 3 week was interesting. First, not every web site handles the unsubscribe the same way. Most bring you to a web site where you have to OPT OUT of the list you are subscribed. These require you to be careful and read the screen and make sure you select UNSUBSCRIBE ME FROM ALL and not just the boxes with a check in it. Experimenting, I began first de-selecting all boxes and unsubscribing THAN reloading the page (clicking on the link again from the email) and hitting UNSUBSCRIBE FROM ALL – basically doing it twice. After 3 weeks, the double method seemed to work best in removing you from the list. Other sites have you type in your email (yes I thought this is how they confirm you are real, but this was an experiment remember) and again hit unsubscribe. Still other’s required you to CHECK OFF not UNCHECK the lists you no longer want. The best ones send you to a web page that states “you are unsubscribed”.

Finding the Un-subscribe button:

No one wants you off their list as you are a potential customer. So they don’t make it easy. The BETTER more reputable sites have a clear button to click. The less reputable sites don’t have a button but text you read and click. This text does not always show a link with your mouse so you have to click around – sneaky. This text may state “to remove yourself…”, “if you no longer wish to..” or my favorite “you requested these emails if you no longer want them” yes that’s right nothing else after that – even sneakier.

Finally some emails require you to reply with UNSUBSCRIBE in the email – again experimenting, i put unsubscribe in the subject and the body. What i found was that doing both, placing the unsubscribe in the subject and body of the email works best.

What happened after 3 weeks of doing this?

You may think this was a lengthy process and too time consuming – but fear not! It takes less than 8 seconds per email – yes I timed it! So for 3 weeks I diligently removed myself from every email I did not want.

First, some sites state you will be removed in 10 days (sears, homedepot etc..) and some said it will take a few days to process your request –  so be patient hence why I gave this 3 weeks. Some emails continued to come in despite my efforts to unsubscribe. I followed my process may times on each email. Interestingly, some continued to send emails but WITHOUT the UNSUNSCRIBE button – even sneakier – bastards! So i began making the unsubscribe links my favorites and continued to remove myself from the emails. Others immediately send me 2-3 emails right after unsubscribing without the button – like parting shots in a war. But I remained vigilant and continued to remove myself from the lists.

The results were quite astonishing

3 weeks later, my inbox receives less than 200 emails  a day with most if not all being good emails – a 70% reduction! Now at nite, I find myself looking at my phone only to find NO emails for me to delete! Saturday what was over 200 spam emails is now less than 20.

so this process works, costs nothing but some time and has greatly reduced junk mail. As a side benefit, since a lot of junk mail has been eliminated, the incidences of viruses also has gone down.

So if you want less spam and some virus protection, follow these steps – it worked for me!

Anthony Pennacchio
President

Why do you call your internet provider before Vanguard?

If your internet is “down” or problematic – our productivity suffers, we lose business and employees sit around “waiting” – in effect we lose money when our internet is down not to mention the frustration we have when trying to have it repaired.

Over the years, Vanguard has been working with internet providers (cable/Spectrum, Verizon etc..) and our customers to keep their internet operational. Over the years, we have found that these internet providers love to “pass the buck” when they service your internet.  Vanguard receives many calls a day when these providers magically appear at your office and state “your network is bad” or “call your IT people” and they leave with you having no or limited internet. Upon calling Vanguard, we find almost 100% of the time that the providers tech person did not set up your system properly.

Now you have the background for this newsletter.

Our clients call us for many reasons (all true):

• “My cell phone won’t dial”
• “My Amazon order was declined”
• “facebook is slow”
• My favorite:  “your man just left and now our microwave does not work”

YET – if you have internet problems, we find that most JUST call their provider, allow them to CHANGE their network and leave without you being operational.

This week alone (yes its just Wednesday!), we have had 3 calls from customers stating our internet provider was here and says its you and we have no internet. Only for us to find that the tech took the router away with them (yes this happened), they did not bridge the modem, or they simply did not plug in the new router to your network.

Things you should know about your internet service and how its setup:

• Always call Vanguard First if you have or think you have an internet problem: Always call Vanguard First, if you have or think you have an internet problem: Always call Vanguard First if you have or think you have an internet problem – Did I say call Vanguard First?
• 
• The hookup. Your internet is attached as follows if you use Vanguard services: Cable/Verizon Modem – cat5 cable to your router (Linksys/Cisco, Apple or Sonicwall), cat5 cable to your switch. This is the most common hookup, very few have something different and if you do, the ROUTER is removed from the equation.
• If internet trouble – FIRST – unplug and re-plug your internet modem- wait 2 minutes, THAN unplug & re-plug your router – wait 2 minutes – reboot your computers
• FOR CABLE ONLY – your cable modem cannot be replaced without configuration – if you have it replaced make sure you call Vanguard to verify if the modem is BRIDGED.
  Bridging puts the modem in PASS THROUGH mode and allows your router to handle all IP’s and security – if your modem is NOT set for bridge mode and its required for your network – no PC will get on line. The technician can set the bridge mode in less than 5 minutes – always verify with us and do not allow them to leave unless you are 100% working
• FOR VERIZON ONLY – Same as Cable
• FOR VERIZON FIOS ONLY – these modems cannot be set to bridge mode and may need PORTS opened – please call Vanguard.
• Do NOT allow your provider to be ALONE when working on your equipment –  make sure you watch them and verify they leave all your equipment and do not change cables.
• BEFORE you have your provider work on your equipment – LABEL all your cables and write down where they are plugged into – and VERIFY they are replaced in same ports – this will eliminate miss-wiring
• Do NOT EVER allow your internet provider to change settings on your computer and router
• Most importantly, when you do call Vanguard, please make sure the provider is STILL on site and you advise us exactly why you called them and what they have done so far – we do not read minds or have psychic powers. We find all to often that we are not told the what, whens or why’s causing you longer down time and longer more expensive service calls.

Our business depends on the internet – by working together with Vanguard and keeping us in the loop, we can all make sure we stay profitable!

Raise your sales!

Anthony Pennacchio
The Vanguard Staff!

PROTECT YOUR BUSINESS FROM RANSOMEWARE – Some Facts and best practices!

The news broke on Friday of a massive ransomware attack on the UK NHS and the attack has now impacted up to 200,000 organizations in 150 countries. As such, we have received many emails and phone calls asking if “we are protected” and “what can we do to prevent an attack” since the news broke. Well, the reality is that you CANT prevent the attack from TRYING to occur and if you are unlucky enough to be attacked and compromised, there is not much you can do to recover your data UNLESS you have good backups.

Let me explain this in simpler terms: MOST security measures are reactive – not proactive. Think of getting a flu shot – this prevents KNOWN diseases from attacking you (in most people) it does not mean you will never get sick or that a new strain will infect you. Its an ounce of prevention but no guarantee. The attack vector USUALLY is an email you open or a web site you visit. Just reading the email can instantly infect your systems. The attack is invasive and will search out your servers and other systems thereby locking ALL you data – hence why we DO NOT recommend locally connected hard drives for backup – we have seen too many times after we remove the infection the systems be re-infected by these devices.

Now back to your protections, most of us will not spend the money to change our routers and firewalls to “better” units. Think right now would you:

A. Spend $1500 for a new router that will not prevent an attack but provide better protection? If you say YES than i will make sure you have piece of mind – I have them in stock now and have installed them in a few customers already.

B. Will you spend $50 more month for for a “better” antivirus” that’s managed  and provides additional protections?

I strongly suggest you think about these 2 options if you business data is critical.

Steps you can take to mitigate ransom where attacks:

1. DO NOT USE AOL, Yahoo, Gmail or any other free mail service – We cannot stress this enough – those services are hacked regularly and are not secured. They are not business services – Call us and we can switch you over to our secured Microsoft Exchange Emails
2. Do not allow employees to read their personal emails using the above services on your business systems
3. DELETE ANY email you are not sure of
4. Delete Any Email you are not sure of
5. Did I mention to delete ANY email you are not sure of?
6. NEVER open attachments from emails you are unsure of – DELETE Immediately
7. Avoid social media on work computers
8. Remove all external backup drives from systems
9. Remove all weather software and any other non-business software from user stations
10. MAKE SURE YOU HAVE VANGUARDS REMOTE BACKUP SERVICES – We have saved many businesses from total disaster with our service – it may take 2 days to retrieve all your data – BUT you HAVE all your data!
11. Update your firewall/Routers – remove all cisco/linksys routers/firewalls and allow Vanguard to install more secure systems
12. Change to our managed antivirus
13. Migrate all your emails to our secure Microsoft Email servers

In effect this comes down to training and enforcement of specific policies for you and your employees.

Nothing is 100%, no one is immune – but by judiciously applying resources in upgrades and training, you can harden your systems and continue doing business!

I have included an attachment for my Ransomware hostage rescue manual – give it a quick read.

Contact us anytime to discuss and we can provide you with suggestions to securing your business.

Users of Windows need to be notified ASAP of a new ransomware strain and take immediate measures to patch.

Specifically, on May 12, 2017 a new strain of the Ransom.CryptXXX (WannaCry) strain of ransomware began spreading widely impacting a large number of organizations, particularly in Europe.

Wcry is demanding a ransom of $300 to $600 in Bitcoin to be paid by May 15, or, in the event that deadline is missed, a higher fee by May 19. The messages left on the screen say files will remain encrypted. It’s not yet clear if there are flaws in the encryption scheme that might allow the victims to restore the files without paying the ransom.

If you have yet to install the Microsoft fix—MS17-010— you should do so immediately. You should also be extremely suspicious of all e-mails you receive, particularly those that ask the recipient to open attached documents or click on Web links.

If you have seen nonstandard activity and believe your customers’ information may have been exposed, please contact support.