What’s New
- Internet Explorer is the new Java? According to the news, Internet Explorer seems to have dethroned Adobe and even Java as the most popular way the bad guys use to gain access to your computer. According to the article, the number of vulnerabilities in Internet Explorer have increased more than 100% over 2013 levels. What does this mean to you? Don’t use Internet Explorer. Use Google Chrome, Mozilla Firefox or even Apple Safari but avoid Internet Explorer.
- Encryption is the wave of the future. The Internet first ‘met’ Cryptolocker in September of 2013 and, since then, it’s made a pretty significant splash and there have been a number of similar viruses (think Synolocker) that have started claiming their share of victims. Basically, you get a virus (through an infected email, because you were using Internet Explorer on an infected website, etc.) and, in the background, Cryptolocker would go through your computer encrypting all of your files. When it finished, it popped up a screen telling you what it had done and informing you that, unless you pay a ransom, all of your data was gone. Unfortunately, for most folks, they were right. The data was encrypted with strong encryption and, without the key (which you had to pay for), there was no way to get it back without a backup. This is proven to be a HUGE cash cow for the bad guys and, I suspect, we will continue to see this type of attack grow and evolve in months and years to come. I’m thinking of Cryptolocker as the Storm worm of the ransomware era.
- Are you backing up? Fresh off of the topic of Cryptolocker, now is a good time to talk about backups. If you’re backing up regularly and well, you really don’t have as much to worry about because, once you’ve cleared the virus, you can simply restore the files. If you don’t have a good backup, you can pay the ransom (and hope that the servers your keys were on haven’t already been taken down and that you can get the key back) or lose the data. We recommend (and use) CrashPlan Pro for our backups. It’s easy to use, they offer a 30 day free trial, they have an app for your smartphone (Did my backup run? Let me check, yup, there’s that file that I created earlier today) and they support roll-your-own encryption so you’ve got less to worry about regarding privacy. All of that plus their tech support rocks. Simple. Cheap. Easy. Done.
Updates
Microsoft – According to the Advanced Notification of August 2014, there are a total of 9 bulletins with 2 listed as critical and the remaining 7 listed as important. Both of the critical bulletins address vulnerabilities that can allow remote code execution (someone can install software onto your computer without your permission or knowledge). The important bulletins range from remote code execution to privilege escalation (allowing a user or process / program to run with administrative privileges without the administrative password) and security feature bypass (bypassing specific security features). Most of the updates require a reboot and, at least with the critical vulnerabilities, should be installed as soon as testing permits. The updates address issues in Windows, Windows Server, SQL Server, Internet Explorer, Office and the .NET Framework.
Microsoft releases regular updates the second Tuesday of each month, often referred to as ‘Patch Tuesday’. These updates are catagorized as Low, Moderate, Important or Critical. Details on the categories are available here. The updates can include any supported Microsoft product from Windows to Office to Internet Explorer and server products like Exchange and SQL Server. If you have one or more of these products installed, especially if the update is listed as Important or Critial, it’s important that the updates are installed.
Additional details are available Microsoft Here.
Adobe – Adobe released a cross platform (e.g., Windows, Mac, Linux, etc.) update to Adobe Flash Player back on 8 July that was pretty significant but, since then, it’s been uncharactaristically quiet. All MyIT clients already have these updates installed.
Like Microsoft, Adobe now releases updates to their products on the second Tuesday of each month. Adobe will also release ‘out of band’ updates if necessary to address critical vulnerabilities in their products. Adobe products include Adobe Reader (for viewing PDF files), Adobe Flash Player (often used to watch videos, for interactive content like games, etc.), Adobe Shockwave and the Adobe Creative Suite (Photoshop, Illustrator, Acrobat, Lightroom, etc.).
Additional details are available from Adobe Here.
Java – The latest ‘mainstream’ version of Java is Java 7 update 67. I’m going to just ignore the whole Java 8 thing at this point. If you *need* to know about Java 8, chances are, you already know about it :).
Java is a tool that’s widely used by banks, online service providers and even security companies for SSL VPN connections. Java’s ‘official’ release cycle is approximately quarterly but Java updates have been ‘fast and furious’ in recent months. It’s worth noting again that, if you don’t absolutely need Java on your computer, it’s not a bad idea to remove it altogether.