Windows 10 update kills Adobe Flash

We have issued an article related to Flash RIP back in May 2020

Microsoft has rolled out an optional update for Windows 10 that permanently removes Adobe Flash from the operating system and prevents it from being re-installed.

Ahead of the long-awaited end-of-life date for Adobe Flash, which will fall on 31 December 2020, Microsoft has released a tool for Windows 10 and Window Server that strips out all elements of the software.

The company has released the removal tool in advance of this cut-off point to help customers test and validate their environments for any impact that might occur by the removal of Adobe Flash Player.

Adobe decided in 2017 to retire its Flash Player due to the diminished usage of the technology, and the availability of better and more secure options including HTML5, WebAssembly and WebGL.

Flash Player updates and patches will continue to be rolled out between now and the end of 2020, although will cease once 31 December is reached. Disruption shouldn’t be too severe, however, given just 5% of websites were still using the environment as of 2018. 

source: ITPro

Ransomware Attacks are not problem for us

 

If there is one characteristic that defines cybercrime today, it is the capacity to evolve and adapt to new environments and the ability to find ways of evading the cybersecurity measures taken by victims. 

Ransomware is no exception. One of the main features of ransomware as a threat, in addition to kidnapping data, is that it is constantly reinventing itself to persist over time and ineffectiveness.

This type of malicious software has evolved greatly since it began, and today there is a wide variety of families in existence, giving rise to new, more sophisticated strains.

Did you know that?

• 65% of ransomware infections are delivered via phishing 
• A ransomware attack will take place every 11 seconds by 2021 
• 85% of ransomware attacks target Windows systems. 
• The average cost of a ransomware attack in 2019 was $133,000 
• 50% of IT professionals don’t believe that their organization is ready to defend against a ransomware attack.  
• Hackers attack  every 39 seconds or an average of 2,244 times a day 
• Between January 1st and June 30th, 2020, ID Ransomware received 100,001 submissions relating to attacks that targeted companies and public sector organizations. 
• 90 % of IT pros had clients that suffered ransomware attacks in the past year 
• Ransomware costs will reach $20 billion by 2021 
• 51% of businesses have been impacted by ransomware in the last year
• 0 affected Scicane customers

Don't be a victim - Contact us for further information @ info@scicane.com (no obligation)

Zoom: It appears to have more problems than it solves

Zoom admits meetings don't use end-to-end encryption

Video conferencing app Zoom does not use end-to-end encryption, according to reports, despite specifically stating that it does on its website.

Though Zoom offers users the option to “enable an end-to-end (E2E) encrypted meeting,” and provides a green padlock that claims “Zoom is using an end to end encrypted connection,” the company this week admitted that offers no such thing.

A spokesperson for the company told The Intercept that, despite its claims, it was "currently not possible" to enable end-to-end encryption for its video meetings.

Instead, the spokesperson revealed, the service uses Transport Layer Security (TLS) which encrypts data between user's meetings and Zoom's servers. End-to-end refers to data encrypted between calls, blocking out third parties - which includes the service provider. As a result, the company can see and use the data for things like targeted ads. 

"When we use the phrase ‘End to End’ in our other literature, it is in reference to the connection being encrypted from Zoom end point to Zoom end point,” the spokesperson added.

Part of Zoom's appeal to organisations is its simplicity and the fact it can be used for free, albeit without any premium features, which lets businesses try it out before forking out any money. "Video conferencing is a fantastic necessity in times like these but it is vitally important to understand the security and privacy concerns that go in parallel with this increasingly popular form of communication," said Jake Moore, a cyber security specialist for ESET. "For social and light business meetings they are fine as long as users realise what data is being shared by Zoom to third parties. I certainly wouldn't recommend using free software for sensitive or private meetings."

Unpatched Zoom App Bug Lets Hackers Steal Your Windows Password

According to the latest finding by cybersecurity expert @_g0dmode, which was also confirmed by researcher Matthew Hickey and Mohamed A. Baset, the Zoom client for Windows is vulnerable to the 'UNC path injection' vulnerability that could let remote attackers steal login credentials for victims' Windows systems.


The attack involves the SMBRelay technique wherein Windows automatically exposes a user's login username and NTLM password hashes to a remote SMB server when attempting to connect and download a file hosted on it.

The attack is possible only because Zoom for Windows supports remote UNC paths, which converts such potentially insecure URLs into hyperlinks for recipients in a personal or group chat.


To steal the login credential of user running zoom for Windows, all an attacker needs to do is sent a crafted URL (i.e. \\x.x.x.x\abc_file) to the victim over its chat interface, as shown, and wait for the victim to click it once.

To be noted, the captured passwords are not plaintext, but a weak one can easily be cracked in seconds using password cracking tools like HashCat or John the Ripper.

In a shared environment, like office space, stolen login details can be reused immediately to compromise other users or IT resources and launch further attacks.

Besides stealing Windows credentials, the flaw can also be exploited to launch any program already present on a targeted computer or downloaded as part of the attacker's social engineering campaign.


Zoom has already been notified of this bug, but since the flaw has not yet been patched, users are advised to either use an alternative video conferencing software or Zoom in your web browser instead of the dedicated client app.

Source(s) & more info: Hacker News, ITPro

Microsoft Teams

Microsoft Teams Commercial Cloud Trial offer

The Microsoft Teams Commercial Cloud Trial is replaced by Microsoft Teams Exploratory beginning in January 2020. To learn about this new offer, read Manage Teams Exploratory license.

The Microsoft Teams Exploratory experience lets users in your organization who have Azure Active Directory (AAD) and are not licensed for Teams initiate an exploratory experience of Teams. Admins can switch this feature on or off for users in their organization. The earlier Microsoft Commercial Cloud Trial is now replaced by The Teams Exploratory experience.

Who's eligible?

As long as the user has a managed AAD domain email address and currently does not have/haven't been assigned a Teams license, they are eligible for this experience. For example, if a user has Office 365 Business (which doesn't include Teams), they're eligible for the Teams Exploratory experience.

How users sign up for the Teams Exploratory experience

Eligible users can sign up for the Teams Exploratory experience by signing in to Teams (teams.microsoft.com). They will be assigned this license automatically and the tenant admin will receive an email notification the first time someone in your org starts the Teams Exploratory experience.

Differences between Microsoft Teams and Microsoft Teams free

	Microsoft Teams free	Microsoft Teams
Features
Maximum members	500,000 per org	Potentially  unlimited  with an  enterprise  license
File storage	2 GB/user and 10 GB  of shared storage	1 TB/user
Guest access
1:1 and group online  audio and video calls
Channel meetings
Screen sharing
Scheduled meetings
Meeting recording		Available with  MS Stream
Phone calls and audio  conferencing
Administration
Admin tools for managing  users and apps
Usage reporting for  Office 365 Services
99.9% financially-backed  SLA uptime
Configurable user  settings and policies

More info and sources: Microsoft Support website, Microsoft Docs

Snatch Ransomware Reboots Windows in Safe Mode to Bypass Antivirus

Cybersecurity researchers have spotted a new variant of the Snatch ransomware that first reboots infected Windows computers into Safe Mode and only then encrypts victims' files to avoid antivirus detection.

Unlike traditional malware, the new Snatch ransomware chooses to run in Safe Mode because in the diagnostic mode Windows operating system starts with a minimal set of drivers and services without loading most of the third-party startup programs, including antivirus software.

Snatch has been active since at least the summer of 2018, but SophosLabs researchers spotted the Safe Mode enhancement to this ransomware strain only in recent cyber attacks against various entities they investigated.

"The ransomware, which calls itself Snatch, sets itself up as a service [called SuperBackupMan with the help of Windows registry] that will run during a Safe Mode boot."

"When the computer comes back up after the reboot, this time in Safe Mode, the malware uses the Windows component net.exe to halt the SuperBackupMan service, and then uses the Windows component vssadmin.exe to delete all the Volume Shadow Copies on the system, which prevents forensic recovery of the files encrypted by the ransomware."

What makes Snatch different and dangerous from others is that in addition to ransomware, it's also a data stealer. Snatch includes a sophisticated data-stealing module, allowing attackers to steal vast amounts of information from the target organizations.

Source and more info: Hacker News

What is RAID?

What are the differences between the different RAID levels? Should you use Software RAID or Hardware RAID?

Don’t worry, we’ll keep it simple.

Whether or not you’re looking to set up your own server, optimize the performance of your data storage solution, or just make sure you’re protected as best you can be against data loss, a RAID solution is going to come in handy – and setting one up the right way is essential.

In this quick guide we’re going to cut down on as much of the geek speak as possible, really working to simplify everything you need to know about the different RAID levels, different ways to set up a smart RAID solution, and how to make sure you’re getting the most out of this incredible tool.

What Is RAID, Anyway?

Before we get right into the actual nuts and bolts of finding or setting up a RAID solution, it’s critical that we break down exactly what RAID technology is to begin with.

RAID is a term that stands for Redundant Array of Inexpensive (or Independent) Disks. While that sounds like a pretty geeky acronym for an even geekier system name, the actual technical aspect of a RAID setup is pretty simple and straightforward.

We’re talking about a solution that uses at least two different hard drives, working in concert, to improve the performance and/or the reliability of the system they have been installed into.

The overwhelming majority of RAID setups – especially on the commercial side of things – are going to be for those that want to protect their data and system uptime. With the right RAID solution in place, you could have an entire hard drive fall apart, break down, and stop working completely – and you’d never have to worry about comprising the safety or usefulness of the data on your RAID disk. Furthermore, your dedicated server will remain up and running even when the hard drive fails.

Yes, you’re reading that right. When you have two or more disks set up in a RAID (excluding RAID 0), one of them can fail totally and you’ll still be able to keep chugging along as though nothing happened.

At the same time, different RAID levels and setups are going to influence how, when, and what your hard disks do when there is a failure. You have to be sure you always choose the right RAID setup to maximize the protection and performance boosts you’ll get out of this technology.

Should I Get RAID? Do I Need It?

Hard drives fail. That’s a fact of life and it’s only a matter of time until the hard drives your dedicated server has will fail.

When hard drives fail on a JBOD (“Just a Bunch Of Disks” or NO-RAID) system, the system will experience downtime and data loss. If your business wants to prevent that downtime and data loss, RAID is for you.

Furthermore, if you need better I/O performance, RAID solutions can improve write and read speeds significantly.

At the end of the day, it all comes down to finding the right RAID type for your needs.

Finding The Right RAID Solution For Your Needs

The only way you’ll be able to make the most of this technology is if you find the right RAID solution for you, and you have plenty of options to pick and choose from.

Let’s breakdown the most common – and often leveraged – types below.

RAID 0 (Striping)

RAID 0 is used specifically for those that want to improve the performance of their server solutions but do not care about consequences of losing one of the disks in the array.
This RAID level uses data striping. What this means is that each piece of data is split into segments and these segments are spread across the different disks in the RAID 0 system. With RAID 0, writing and reading happens simultaneously from all the drives in the array so the I/O performance improvement can be very significant.

Because this is such a performance focused solution and not a reliability solution you won’t find any data protection with RAID 0. If a disk in the RAID 0 system fails – the system fails, and all data spread across the disks will be gone.

RAID 1 (Mirroring)

This type of RAID array is commonly referred to as a “disk mirroring” solution. RAID 1 will be implemented with at least two disks (and always with an even number of disks).

With RAID 1 the same data is written on all disks. With RAID 1 you constantly have at least two copies (depending on how many disks you have) of all of your data so should something happen to one of your disks, you’ll have a complete and functional drive to work off of, all thanks to the RAID 1 system.

RAID 1 can also provide I/O performance improvement for read operations. Having the data in two copies means being able to read it simultaneously so the read I/O speed can be up to twice as fast.

RAID 5 (Parity)

RAID 5 is set up on at least three disks that have all of the data saved stripped across them, this gives you “hot swap protection” should a disk go down.

This RAID type uses parity calculation to achieve striping of the data and the ability to recover from a single failed drive.

Think of it this way: If you have a RAID 5 setup in place, one of your hard drives can fall apart at the seams without any issues. You’ll be able to swap the damaged disk out and replace with a brand new one, with the RAID 5 system mirroring your data and rebuilding the system on the fly as necessary.

It’s like a self-healing piece of technology!

RAID 5 also provides up to two times performance improvement for read operations thanks to the striping.

RAID 10 (Mirroring + Striping)

Certainly the most common type of RAID you’ll find in a commercial setting (and a favorite for those running dedicated server systems for clients), RAID 10 balances performance AND data security.

This RAID level essentially combines the features of RAID 1 and RAID 0, making sure data is mirrored and therefore safe (mirroring) while also making sure that the I/O performance of a system is improved thanks to the data being spread across multiple drives and disks (striping).

RAID For SSD Caching

Another option that not all providers can offer you (but we can because we’re absolutely awesome) is to use RAID to create a system which automatically caches your most used data in SSD and saves the less often used in SATA. This caching mechanism constantly proves itself and brings exceptional performance boosts to those who need a lot of storage, with high performance but without the price tag of many high-capacity SSD drives.

Hardware RAID vs Software RAID

A hardware RAID controller costs money but has no overhead on the server. A software RAID is free but does carry some overhead on the server and may be less reliable under certain circumstances.

You see? We told you we’ll keep it simple.

Choosing A RAID Solution For Your Needs

At the end of the day, you need to make sure that you’re getting the most out of a dedicated server – but you also need to make sure that your data is backed up and protected at the same time.

RAID array solutions (like the ones highlighted above) are going to fit the bill perfectly, but only you will know which makes the most sense for you.

Windows 10 users forced into adopting the latest OS Update

Machines using build 1803 will be upgraded to avoid risk when it reaches end-of-service in November

Small businesses and home users with Windows 10 installations older than a year will be automatically upgraded to the May 2019 Update to avoid systems falling out of support in November.

Despite widespread concerns over the way Microsoft implements its biannual operating system (OS) upgrades, Home and Pro users will be automatically kicked into using version Windows 10 1903, issued just a couple of months ago.

Source & more info: ITPro

Schizophrenic robot

Researchers at the University of Texas at Austin and Yale University used a neural network called DISCERN to teach the system certain stories. To simulate an excess of dopamine and a process called hyperlearning, they told the system to not forget as many details. The results were that the system displayed schizophrenic-like symptoms and began inserting itself into the stories. It even claimed responsibility for a terrorist bombing in one of the stories.

Computer networks that can't forget fast enough can show symptoms of a kind of virtual schizophrenia, giving researchers further clues to the inner workings of schizophrenic brains, researchers at The University of Texas at Austin and Yale University have found.

The researchers used a virtual computer model, or "neural network," to simulate the excessive release of dopamine in the brain. They found that the network recalled memories in a distinctly schizophrenic-like fashion.

After being re-trained with the elevated learning rate, DISCERN began putting itself at the center of fantastical, delusional stories that incorporated elements from other stories it had been told to recall. In one answer, for instance, DISCERN claimed responsibility for a terrorist bombing.

Source & more info: The University of Texas

Enable "God Mode" in Windows 10

Enable 'God Mode'

Are you a power user who wants access to your PC's nitty gritty? "God mode" is for you. Right-click on the desktop > New > Folder. Re-name the new folder with this bit of code:

GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

To enter the "God Mode" window, double-click the folder and go nuts.

Malware vs Viruses: What’s the Difference?

Understanding the difference between malware and viruses is very important. A virus is just one type of malware, but the term is more widely used by the public. The term malware refers to any malicious software, including a computer virus. For example, between 2000 and 2005, spyware and adware emerged as types of malware that protection systems had to deal with.

Malware is infecting computers and mobile devices at an increasingly greater pace.

What is a Malware?

Malware is software written specifically to harm and infect the host system. Malware includes viruses along with other types of software such as trojan horses, worms, spyware, and adware. Advanced malware such as ransomware are used to commit financial fraud and extort money from computer users.

Common types of malware:

    Virus: As discussed, Virus is a specific type of malware by itself. It is a contagious piece of code that infects the other software on the host system and spreads itself once it is run. It is mostly known to spread when software is shared between computers. This acts more like a parasite.

    Adware: Adware is also known as advertising-supported software. It is software which renders advertisements for the purpose of generating revenue for its author. The advertisements are published on the screen presented to the user at the time of installation. Adware is programmed to examine which Internet sites, the user visits frequently and to present and feature related advertisements. Not all adware has malicious intent, but it becomes a problem anyway because it harms computer performance and can be annoying.

    Spyware: This type of malicious software, spies on you, tracks your internet activities. It helps the hacker in gathering information about the victim’s system, without the consent of the victim. This spyware’s presence is typically hidden from the host and it is very difficult to detect. Some spyware like keyloggers may be installed intentionally in a organization to monitor activities of employees.

    Worms: This type of malware will replicate itself  and destroys information and files saved on the host PC. It works to eat up all the system operating files and data files on a drive.

    Trojan:  Trojans are a type of virus that are designed to make a user think they are a safe program and run them. They may be  programmed to steal personal and  financial information, and later take over the resources of the host computer’s system files.  In large systems it may attempt to make a host system or network resource unavailable to those attempting to reach it. Example: you business network becoming unavailable.

    Ransomware: Ransomware is an advanced type of malware that restricts access to the computer system until the user pays a fee.  Your screen might show a pop up warning that your have been locked out of your computer and  that you can access only after paying the cyber criminal. The cyber criminal demands a ransom to be paid in order for the restriction to be removed. The infamous Cryptolocker is one type of ransomware.

It is very difficult to live without computers or mobile devices and we have come to depend on them for many activities – communication, online purchases and payments, etc.., In order to protect our devices and data against the different types of malware mentioned above, an effective anti-malware solution is required.

Azure Sphere OS: built with Linux kernel

Microsoft realized that Linux was better suited than Windows for IoT devices. Azure Sphere OS is built with a custom Linux kernel and security monitor for "defense in-depth" with multiple layers of security, according to Smith. The company had previously announced SQL Server support for Linux, but a non-Windows OS is a first.

Read more at  PCMag 

HP Notebook Computer and Mobile Workstation voluntary Battery Safety Recall and Replacement Program

In January 2018, in cooperation with various government regulatory agencies, HP announced a worldwide voluntary safety recall and replacement program for certain notebook computer and mobile workstation batteries. These batteries have the potential to overheat, posing a fire and burn hazard to customers. For this reason, it is extremely important to check whether your battery is affected.

Batteries affected by this program were shipped with specific HP Probook 64x (G2 and G3), HP ProBook 65x (G2 and G3), HP x360 310 G2, HP ENVY m6, HP Pavilion x360, HP 11 notebook computers and HP ZBook (17 G3, 17 G4, and Studio G3) mobile workstations sold worldwide from December 2015 through December 2017. They were also sold as accessories or provided as replacements through HP or an authorized HP Service Provider.

Many of these batteries are internal to the system, which means they are not customer replaceable. HP is providing battery replacement services by an authorized technician at no cost. HP is also providing a BIOS update that places the battery in "Battery Safety Mode" so that the notebook or workstation can be safely used without the battery by connecting to an HP power adaptor. Batteries affected by this recall should immediately be put into "Battery Safety Mode".

Battery Safety Mode is only applicable to HP products affected by this recall. If the validation process identifies a battery as being eligible for replacement, the BIOS update should be applied and the system should be rebooted. During the reboot process, an option will be presented to enable Battery Safety Mode. Accepting Battery Safety Mode causes the battery to discharge and to cease future charging until Battery Safety Mode is disabled. HP strongly recommends accepting Battery Safety Mode so that the notebook or mobile workstation can be safely used by connecting to an HP power adaptor. For more information please refer to the FAQs tab on this website.

HP's primary concern is for the safety of our customers. HP is proactively notifying customers, and will provide replacement battery services for each verified, eligible battery, at no cost. For customers with 5 or more potentially affected batteries, HP has put in place a process to assist with validation and ordering . For details please refer to the FAQs tab on this website.

Note: Not all batteries in all HP ProBook 64x and 65x, HP x360 310 G2, HP ENVY, HP Pavilion x360, HP 11 notebooks and HP Zbook mobile workstations are affected by this recall.

 

For more information please refer to the Frequently asked questions at this website https://batteryprogram687.ext.hp.com

Πως να προστατευτείτε από απάτες "ψαρέματος" (phishing) με απλές μεθόδους

Είναι πλέον δύσκολο να μην αντιλαμβανόμαστε την αυξανόμενη συχνότητα των επιθέσεων phishing μέσω ηλεκτρονικών μηνυμάτων. Μέσα σ' αυτή τη χρονιά, οι συχνότερες επιθέσεις έγιναν σε χρήστες Google Cloud Docs. Τα λογισμικά καταπολέμησης κακόβουλων επιθέσεων γίνονται ολοένα και πιο 'εξυπνα' ή καλύτερα πιο αποτελεσματικά έτσι οι προσπάθειες καταδολίευσης και απάτης επικεντρώνονται πλέον από τους hackers στην 'ολίσθηση' στο λάθος των χρηστών.

Ακόμη και να νομίζετε ότι δεν σας αφορά αυτό το άρθρο, αξίζει να το διαβάσετε. Μπορεί να μη πληρώνετε μέσω διαδικτύου, μπορεί να 'νομίζετε' ότι δεν έχετε ευαίσθητες πληροφορίες στην 'διαδικτυακή σας παρουσία'. Όμως ΕΧΕΤΕ. Από τη στιγμή που χρησιμοποιείτε το διαδίκτυο ΕΙΣΤΕ ΕΥΑΛΩΤΟΙ!

Τι είναι το phishing;

Οι επιθέσεις phishing όπως αντιλαμβάνεται κανείς, είναι προσεγγίσεις που μοιάζουν νάναι νόμιμες και λογικές, προερχόμενες από ηλεκτρονικά μηνύματα ή/και (σε συνδυασμό) με ιστοσελίδες με πρωταρχικό στόχο την ανάκτηση πρόσβασης στο ηλεκτρονικό ταχυδρομείο του χρήστη ή έμμεσα/αμεσα στους τραπεζιτικούς λογαριασμούς του. Είναι με πανουργία και αποτελεσματικότητα προετοιμασμένες επειδή φαίνεται να προέρχονται από οργανισμούς ή εταιρείες με τις οποίες συνεργάζεστε. Σας οδηγούν σε σελίδες πανομοιότυπες με αυτές που έχετε εμπιστευτικά δεδομένα. Πέφτει στην παγίδα ο χρήστης και βάζει τους κωδικούς του νομιζόμενος ότι εισέρχεται είτε στην ασφαλή πύλη του ηλεκτρονικού ταχυδρομείου του ή στη σελίδα της τράπεζας του που του ζητά να επαναβεβαιώσει τους κωδικούς του. Ο σκοπός του ψαρέματος είναι πάντα ο ίδιος, να αποκτήσει πρόσβαση σε ευαίσθητες περιοχές του χρήστη. Οι hackers τότε αντιγράφουν τον τρόπο γραφής του χρήστη, τιμολόγια που συνήθως πληρώνει και κλέβει την (ηλεκτρονική) ταυτότητα του.

Απλοί τρόποι να μην είστε το επόμενο θύμα phishing

Πάντα να σκέφτεστε διπλά πριν κάνετε κλικ σε σύνδεσμο (link) που σας δίνεται είτε μέσω ηλεκτρονικού ταχυδρομείου (email), SMS, messenger κλπ. Αναρωτηθείτε αν ο αποστολέας θα σας έστελνε μήνυμα τέτοιου περιεχομένου. Θα σας ζητούσε κάτι τέτοιο; Για παράδειγμα οι τράπεζες συνεχώς σας θυμίζουν ότι δεν σας ζητούν τους κωδικούς σας είτε από ηλεκτρ. μήνυμα ή άλλη ιστοσελίδα. Αποφεύγετε επίσης να κάνετε κλικ σε συνδέσμους τύπου shortURLs (π.χ https://goo.gl/Z6gYE5, http://alturl.com/i3tew αυτά είναι ασφαλή), δεν ξέρετε που σας οδηγούν. Με τον ίδιο τρόπο να αποφεύγετε να στέλνετε μηνύματα με τέτοιους συνδέσμους. Δεν είναι παράνομο ή κακό αλλά όταν οι παραλήπτες σας γνωρίζουν ότι δεν χρησιμοποιείτε τέτοιους συνδέσμους, ΔΕΝ θα ανοίξουν ένα τέτοιο σύνδεσμο αν φανεί ότι αποστέλνεται απο σας.

Συνδέσμοι, URLs, Domains

Επίσης οι σύνδεσμοι δεν σημαίνει ότι σας οδηγούν σ' αυτό που φαίνεται στο κείμενο. Π.χ www.bankofcyprus.com ενώ νομίζετε ότι σας οδηγεί στην Τράπεζα Κύπρου, σας παίρνει στην Google! Κοιτάζετε το σύνδεσμο που γράφει στην κάτω μεριά του προγράμματος email που χρησιμοποιείτε (status bar). Εκεί φαίνεται πραγματικά η ιστοσελίδα που θα ανοίξετε. Οι hackers φυσικά δεν θα σας στείλουν σε 'αθώες' σελίδες όπως η Google Search Engine.
Κοιτάζετε πάντα στο address bar του browser σας και βεβαιώνετε ότι είστε στη σελίδα που θέλετε να είστε. Απομνημονεύετε τους σημαντικούς διαδικτυακούς χώρους ενθυμούμενοι το domain τους. Για παράδειγμα, η www.hellenic-bank.com ΔΕΝ ΕΙΝΑΙ η Ελληνική τράπεζα (Κύπρου) της οποίας η σελίδα φυσικά είναι www.hellenicbank.com (χωρίς την '-').
Προσοχή στην λεπτομέρεια!
 Οι phishers είναι έξυπνοι, ρισκάρουν, είναι θρασείς. Βελτιώνουν τις τεχνικές τους και σκαρφίζονται καινούργιες μεθόδους προσέγγισης του θύματος. Παίζουν ιδιαίτερα με αναγραμματισμούς των ονομάτων. Οι ιστοσελίδες http://helenicbank.com/ ή  http://hellenikbank.com/ φυσικά ΔΕΝ σας οδηγούν στην Ελληνική τράπεζα. Ο ένας συνδεσμος είναι με ένα 'l' αντί με δύο ενώ ο άλλος είναι γραμμένος με 'k' αντί με 'c'.

Ηλεκτρονικά μηνύματα, Emails

Προσέχετε τα ηλεκτρονικά μηνύματα από που προέρχονται. ΜΗΝ βλεπετε ΜΟΝΟ το όνομα. Για παράδειγμα ένα μήνυμα από τον "Christos Andreades <234ss44ff gmail.com="">" είναι προφανές ότι δεν είναι από τον Χρίστο τον οποίο ίσως ξέρετε!
Με τον ίδιο τρόπο μπορεί να γνωρίζετε κάποιο Χρίστο με email christos@mydomain.com αλλά λαμβάνετε μήνυμα από το email christos@my-domain.com. Υπάρχουν πολλαπλά τέτοια κρούσματα.

Πολλοί χρήστες του διαδικτύου χρησιμοποιούν δωρεάν υπηρεσίες email όπως της Google (gmail), Microsoft (outlook.com, hotmail.com), Yahoo (yahoo.com) κλπ. Πολλοί επίσης τα χρησιμοποιούν και για επαγγελματική χρήση (κακώς!)
Εδώ οι hackers πάλι αναγραμματίζουν το username. Γνωρίζετε πχ κάποιον με email nikoshalikakakis@gmail.com. Σας στέλνουν email με αποστολέα nikoshallikakakis@gmail.com. Ένα 'l' περισσότερο! όμως ΔΕΝ είναι από τον γνωστό/συνεργάτη/πελάτη σας!

Ένα τελευταίο στα email που πρέπει να προσέχετε είναι ποιος είναι ο αποστολέας και ποιο email είναι δηλωμένο για 'reply to'. Είναι μια από τις ιδιότητες των email. Μπορώ για παράδειγμα να στέλνω email με το όνομα μου και το email μου αλλά θέλω οι απαντήσεις (replies) να πηγαίνουν στο 'κεντρικό' email της εταιρείας μου:
Christos Doe
reply to: MyCompany
Αυτή την ιδιότητα κάνουν πολλοί hackers χρήση γιατί υπάρχει (εύκολα) η δυνατότητα να στείλουν email κάνοντας χρήση ένα πραγματικό email που γνωρίζετε αλλά για σκοπούς επικοινωνίας μαζί του και όχι με τον γνωστό σας, βάζουν στο reply to το email του hacker!

Εταιρειες με καλή δομή στις email πλατφορμες τους κάνουν χρήση του λεγόμενου SPF Record το οποίο μπορεί να απαγορεύει στους διάφορους mailservers να αποδέχονται email των εταιρειών αυτών αν δεν προέρχονται από τους δικούς τους mailservers.

Λογισμικά προστασίας

Η χρήση λογισμικών προστασίας (antivirus, antimalware, firewalls κλπ) ΔΕΝ ΕΙΝΑΙ παντα αρκετή! Πρέπει να προσέχετε διπλά, σαν να μην έχετε προστασία! Οι επιθέσεις απάτης μπορούν να έρθουν είτε από email, instant messaging (messenger, whatsup etc) ακόμη και από SMS! Σκεφτείτε διπλά πριν δώσετε ευαίσθητα στοιχεία σας μέσω κάποιου μέσου που αναφέρουμε ποιο πάνω.

Τιμολόγια, πληρωμές

Ελέγχετε όταν κάνετε πληρωμές τιμολογίων. Τα τιμολόγια πολλές φορές αναγράφουν αριθμούς λογαριασμών τραπεζών που πρέπει να γίνει η πληρωμή. Συγκρίνετε τους αριθμούς αυτούς με τους αριθμούς που έχετε κάνει χρήση σε προηγούμενη πληρωμή. Αν ακόμη συναλλάσεστε συχνά με αυτή την εταιρεία και κάνετε πληρωμές μέσω online banking, φυλάξετε τις εταιρείες αυτές στους beneficiaries που σας δίνει δυνατότητα (συνήθως) η τράπεζα σας να φυλάξετε.
Αν παίρνετε εντολές πελατών σας για πληρωμές, επιβεβαιώνετε μαζί τους με δεύτερο τρόπο (πχ SMS verification) ότι σας έστειλε να κάνετε αυτή την πληρωμή.

Επιπλέον προστασία

Τέλως ακόμη μια καλή μέθοδος προστασίας είναι και το multi-factor ή two-step authentication. Πολλοί από σας που κάνετε διαδικτυακές πληρωμές, ήδη το χρησιμοποιήτε με το λεγόμενο 'dongle' που σας υποχρεώνει η τράπεζα να έχετε για τις πληρωμές σας. Πολλές υπηρεσίες Cloud όπως η Google, Microsoft κλπ το παρέχουν και το συστήνουν.

Τελειώνοντας...

Προσέχετε στο διαδίκτυο, έχει καταντήσει να είναι πιο επικίνδυνο από το να περπατάς στο δρόμο....

Μπορείτε να επικοινωνήσετε μαζί μας για περισσότερες πληροφορίες και συμβουλές στο email μας, info(at)scicane.com

Το παρόν άρθρο όπως και τα υπόλοιπα στην ιστοσελίδα αυτή αποτελούν πνευματική ιδιοκτησία της SCICANE LTD και απαγορεύεται η χρήση/αντιγραφή/επαναδημοσίευση μέρους ή όλου του άρθρου χωρίς την έγγραφή αποδοχή της εταιρείας

Περισσότερες πληροφορίες για μας στο About Us

Millions of recent laptops will stop receiving new features and aniversary update

Laptops running on Intel Atom 'Clover Trail' chipsets will not receive any Windows 10's feature updates post the Anniversary Update, issued in summer last year.

Microsoft has confirmed that millions of recent laptops will no longer receive updates to add new features to Windows 10.
Laptops running on Intel Atom 'Clover Trail' chipsets will not receive any Windows 10's feature updates post the Anniversary Update, issued in summer last year.
Despite most of these machines only being three or four years old, Microsoft says it is unable to push these updates to 'Clover Trail' laptops, due to Intel ceasing support for the chipset.
Machines that will no longer receive these updates include those running on Intel Atom Z2760, Z2580, Z2560 and Z2520 processors, such as the HP Envy X2 laptop. Reports say that at least 10 million of these devices were sold in 2013 and 2014, according to analyst estimates.

Ahead of the launch of Windows 10, Microsoft's executive VP of the Windows and Devices Group Terry Myerson said: "Once a Windows device is upgraded to Windows 10, we will continue to keep it current for the supported lifetime of the device - at no cost. With Windows 10, the experience will evolve and get even better over time."

"If a hardware partner stops supporting a given device or one of its key components and stops providing driver updates, firmware updates, or fixes, it may mean that device will not be able to properly run a future Windows 10 feature update," says a Microsoft spokesman.

While feature updates will not be forthcoming, Microsoft has pledged to continue issuing security patches to these machines until January 2023, the end of the original Windows 8.1 extended support period.

Source & further info: TechRepublic

Petya ransomware

The Petya ransomware attack that crippled computers in 64 countries worldwide was spread by accounting software, according to Microsoft, highlighting the dangers posed by compromised third-party apps.
The outbreak started in Ukraine, where more than 12,500 machines were infected, and there is now evidence this new Petya malware variant was initially spread via an updater for the tax accounting software MEDoc.

 A large number of organizations were infected, many in Ukraine, including Danish transport company Maersk, Russian oil firm Rosneft, the Kiev metro system, National Bank of Ukraine, the law firm DLA Piper, US pharmaceutical company Merck and many others.

How to protect yourself

Once the ransomware infects a machine, it then attempts to spread itself to other PCs on the network. To propagate itself, it will try to steal credentials to gain local admin privileges, attempt to use file-shares to transfer the malicious file between PCs, and then remotely execute the file. The ransomware encrypts entire hard drives and demands a Bitcoin payment of $300 to release them.
The malware can also spread itself using the EternalBlue exploit for an SMB vulnerability, which was used by WannaCry to spread between machines. The vulnerability was patched by Microsoft in March this year.
Microsoft recommends applying this security update, but for those who aren't able to, it suggests firms "disable SMBv1 with the steps documented at Microsoft Knowledge Base Article 2696547" and "consider adding a rule on your router or firewall to block incoming SMB traffic on port 445".
Another workaround for blocking infection by Petya is to create an extensionless, read-only file called perfc in the C:\Windows folder, using the steps outlined here.
Microsoft also provides a detailed a breakdown of commands and network activity that indicate a Petya infection.


Other reports say that the provider of the email address shown to receive the ransom closed it down, deactivated it so there's no way to pay or ask decryption of your data from the attacker.

While steps were taken to be able to block the attack in your pc, so far there's no 'kill switch' to stop the virus from spreading.

Ofcourse the known story still comes up: "keep you windows machine" updated with security updates and also have a good antivirus solution to protect yourself like the one we offer.

Source: Techrepublic

“WannaCry” Ransomware

a ransomware attack has emerged that is worthy of tears. WannaCry ransomware has hit the scene, spreading like wildfire across 150 countries and infecting more than 250,000 machines, which includes a massive takedown of 16 UK NHS medical centers in just one day. Other major countries impacted include Spain, Russia, Ukraine, India, China, Italy, and Egypt.

Now, how is this massive attack possible? The ransomware attack exploits the Server Message Block (SMB) critical vulnerability–also known as the Equation Group’s ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers a couple of weeks ago. Basically, the attacker can use just one exploit to gain remote access into a system. Once access is gained, the cybercriminal then encrypts data with a file extension “.WCRY.” Not to mention, the decypter tool used can hit users in multiple countries at once, and translate its ransom note to the appropriate language for that country. The ransom is said to demand $300 to decrypt the files.

The good news is, consumers don’t have to worry about this attack affecting their personal data, as it leverages a flaw within the way organizations’ networks allow devices to talk to each other.

However, this attack does act as a reminder for consumers to prepare for personal ransomware attacks. In order to stay prepared and keep your personal data secure, follow these tips:

-Be careful what you click on. This malware was distributed by phishing emails. You should only click on emails that you are sure came from a trusted source. Click here to learn more about phishing emails. 

-Back up your files. Always make sure your files are backed up. That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup.

-Update your devices. There are a few lessons to take away from WannaCry, but making sure your operating system is up-to-date needs to be near the top of the list. The reason is simple: nearly every software update contains security improvements that help secure your computer and removes the means for ransomware variants to infect a device.

–Schedule automatic updates. It’s always a good practice to set your home systems to apply critical Windows Security Updates automatically. That way, whenever there is a vulnerability, you receive the patch immediately.

–Apply any Windows security patches that Microsoft has sent you. If you are using an older version of Microsoft’s operating systems, such as Windows XP or Windows 8, click here to download emergency security patches from Microsoft. 

–Keep security solutions up-to-date. 

source: McAfee