Security: RBC Royal Bank: Best laid plans of mice and men

We did some banking work with our bank, RBC Canada. In the process they sent us a few "Secure Document Access" requests that the agent provided the password for via a phone conversation.

When the first one came in, it was a bit of a system shock.

RBC Royal Bank "Secure Message"

The highlight is ours. Huh?!?

Given the nature of today's phishing attacks a phone call was very quick to happen to our contact after receiving the above to verify its legitimacy.

We received a number of subsequent "secure" e-mails using the same method.

The encryption process we use, and our clients use, on the ExchangeDefender (xD) system is a link to an Internet property owned by xD with the appropriate SSL properties in place to assure the recipient that they are in the right place. That's after we indicate to the recipient in a prior e-mail of the upcoming process to obtain the encrypted content.

The RBC Royal Bank method is close to that but why the .HTM attachment requirement? That's just plain weird. :S

Sure enough, this is what was in an Inbox here this morning:

Phishing Message

It's a poorly crafted phish attempt at best.

E-mail Header

The trail is pretty clear as far as where it came from and the "how" looks to be fairly clear as well.

All it would have taken was a bit better in the way of timing on the phisher's part and a bit of distraction on our part and BOOM we could have been hooked. :(

RBC Royal Bank Canada needs to change their secure document transmission methodologies please.

And, Microsoft, please give us built-in DKIM abilities for on-premises Exchange instead of keeping that to online properties only. That's not polite in the least.*See Note Below

Outlook Header How-To

Outlook users, here's how to get the header information shown above:

1. Double click on the e-mail
2. Click the Message tab
3. Click the break-out button on the bottom right of the Tags category
• 
4. Click anywhere in the small information window
• 
5. Keyboard:  CTRL+A then CTRL+C
6. Click Close and close the e-mail
7. Paste the content into the destined app (we use Notepad)

After examining a few headers it gets pretty easy to identify the legit and illegitimate messages hitting our Inbox every day. While the process may be a bit time consuming, figuring out whether something is legit or not could be the difference between DELETE and an encryption event or Inbox/Contacts harvesting.

Happy Monday everyone and thanks for reading! :)

2018-09-10 EDIT: Oops, that Microsoft sentence should have been CUT along with the other sentences that were in a previous paragraph. Suffice it to say, we've been working on DMARC/DKIM requests and discovered that Microsoft seems to be holding DKIM off from on-premises Exchange. Thus, we need to go third party to get to use that business critical security feature. :(

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.s2d.rocks !
Our Web Site
Our Cloud Service

Security: A Sample E-mail How-To Guide For End Users

With the plethora of e-mail born Office documents with active macros in them to pull down malware/ransomware we sent out the following e-mail to all of our clients for distribution internally.

***

Good day everyone,

It’s gotten to the point now where we are considering a universal restriction on incoming Office Documents. By that we mean plucking them right out of the e-mail via ExchangeDefender by default.

We have somehow travelled back to the 1990s where the bad guys are setting up Office documents with a Macro, an automatic script that runs when the document gets opened, that goes on to pull down their nefarious malware or ransomware.

Here are some steps to help protect us:

1. Microsoft Office has a Save As PDF feature built-in. Please have all outside folks send a PDF instead of an Office document
1. This is especially critical for Resumes. All job postings _must_ request PDF and note that Office documents would be deleted on the spot!
2. If collaboration is required for Office documents use ShareFile
3. Preferred over Dropbox since security is questionable with the Dropbox service
2. Most Office documents that have Macros built-in have an “m” in the extension
1. 
2. Save the Office document to Downloads and verify!
3. If extensions are not shown then right click the file and left click on Properties
4. 
3. Users _should_ be prompted:
1. 
4. Obviously, the answer should be to NOT click that button
5. If they do, there is one last cause for pause
1. 
6. This is what happens if I try and click on something that is Macro driven _before_ clicking Enable Content
1. 

Along with the need to be mindful of any Microsoft Office attachments in our e-mail we should also remember the following:

1. Never click on a link in an e-mail without at the least verifying its destination:
1. 
2. Hover the mouse cursor over the link to verify
3. As a rule: Never, ever, click on a link in an e-mail. Go to the web site after opening a new browser window (IE, Firefox, Chrome, Safari)
2. It may _look_ like it came from someone you know but never trust that. Call and ask!
1. There are a few exceptions to this rule thus make sure to hover your mouse over the link before clicking!
2. Advanced users can check the headers
1. 
2. 
3. Follow the flow from origin server to destination server
3. Don’t save important site’s information in the browser
1. Banking IDs and passwords
2. CRA and critical site’s IDs and passwords
3. Do not disable the secondary question for any computer
1. Banking sites use this feature to help protect the account as one example
2. Answer the question, it only takes a couple seconds and could save your savings!
4. Never call the 800 number that comes up in a Search for Support!
1. Go to the manufacturer’s web site and click on the Support link to find the correct phone number
5. Never believe a pop-up message that says your computer is infected with something!
1. And never, EVER, call the 800 number on that pop-up!
2. Don’t click anywhere, close and save your work if needed then, reboot!
3. Do NOT click anywhere in the pop-up window. Looks are deceiving as all areas of that pop-up = YES/ACCEPT/CONTINUE
6. Never volunteer a credit card number or banking information to anyone
1. Social Security/Social Insurance Numbers too!
2. Folks can garner a lot about us online. Never volunteer any information when asked via any incoming call/e-mail/forum
3. Always call them back!
7. Caller says they are from the bank, CRA, or other seemingly critical business?
1. Ask for their badge number, an 800 number to call, and an extension
2. Open a browser and verify the 800 number belongs to the bank/CRA/CritBiz.
3. Then call them back after hanging up if the number proves true!

While the above list is far from complete, by following these guidelines we can greatly reduce the chances of a malware or ransomware infection.

And, as always, e-mail or call if you are not sure about something!

***

Please feel free to use this as a template for training users!

Have a great weekend everyone. It’s +10C here and much like an awesome Spring day!

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Use Group Policy Preferences to Reveal Extensions in Windows Explorer

We have a number of different default Group Policy Objects that are set up and linked to specific Organizational Units.

With the advent of a flat OU setup in Windows Server Essentials we made an active decision to maintain a similar OU structure to Small Business Server Standard as it made more sense from so many perspectives.

One of our default GPOs that is created and linked at the domain level is the Default Domain User Security Policy. Once created we edit the GPO's properties to disable Computer Configuration settings and set a comment in place for the date created and by whom.

In this GPO we have a number of settings but the one we are focusing on here has to do with the recent RTF zero-day vulnerability we are hearing about.

Under User Configuration --> Preferences --> Control Panel Settings --> Folder Options we see the above.

We set Show hidden files and folders and uncheck Hide extensions for known file types.

Since these settings are user oriented they will be picked up by users on their next logon.

Note that while these settings help users to understand what they are seeing nothing replaces training users to hover over links, not click on links in an e-mail, or be cautious about the sites they visit.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Protecting Your Yahoo Account

So, apparently Yahoo has suffered yet another breach. A quick search of the news sites (Bing Search) would bring up more info.

Sign in to Yahoo and change the account password as soon as possible.

Then, enable Second Sign-In Verification:

We suggest using SMS as the primary method for protecting the account as opposed to the security questions.

Under Account Info:

Once the mobile is confirmed make the following setting:

This at least will provide a layer of protection unless the verification system itself also gets compromised. But, if that's the case Yahoo would probably have bigger problems on their hands! :S

While you're at it please enable 2FA (2 Factor Authentication) on all Microsoft IDs and download the Authentication App to your mobile device and _use_ it!

Now that online service providers are starting to allow us to protect ourselves with additional security steps the onus is on us to use those features!

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
Third Tier: Enterprise Solutions for Small Business

Our Client CryptoLocker Warning E-Mail

This is a copy of an e-mail we are sending out on a somewhat frequent basis to our clients to keep being Internet Street Smart at the top of their minds:

Hello all,

I may have mentioned this in the past while but it bears being mentioned again.

There is a really bad malware being spread via links in e-mail that take the user to a bad site or attachments in an e-mail that contain the bad software. Its name is CryptoLocker.

If the link is clicked on or the attachment is opened the software starts up and goes on to encrypt, that is make unavailable, EVERY file the user has access to. There are two ways to get out of the mess once the infected system is found and quarantined:
1.    Best Option: Recover the files from Previous Versions (Volume Shadow Copy snapshot) … may be out by a few hours.
2.    Okay Option: Recover or from Backup … may be a bit out of time in the form of hours.
3.    Worst Option: Pay the bad guys to decrypt the data and risk identity theft among other problems of handing over a credit card number.

Simple rule of thumb: NEVER click on a link in an e-mail and avoid opening attachments if at all possible (Especially ZIP archives). And, if a link must be clicked on in an e-mail hover the mouse cursor over the link to see where it leads to. If it looks suspicious please ask!

Our systems are designed to provide maximum recoverability however the snapshots and backups are timed throughout the day. So, if there is an infection some work may be lost!

As always, please be very careful and aware that bad folks out there are always on the hunt for more victims. No business large or small is exempt from these folks nefarious activities.

We are aware of firms, fortunately not our own clients, that are on the brink of possibly being lost due to CryptoLocker and bad or unavailable backups!

Thanks and have a wonderful day! :)

We do our best to keep folks aware of what is happening out there but things are getting even more nasty for e-mail transmissions.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

CryptoLocker Word Of Caution

One of the things we have done from the get-go when it comes to setting up ShadowProtect to stream backups to either a drive set connected to a standalone Hyper-V host or to the standalone DC in a Hyper-V cluster setting is to set the shares to allow the Domain Admin MOD.

Inheritance on the folder’s NTFS permission set is removed/copied out then Domain Users/Machine Users group will get removed altogether.

We do this for a number of reasons

• Users cannot connect to the ShadowProtect images
• They are password protected and are using at least AES128bit
• Users cannot delete the images

While we are into our client’s servers on a regular basis sometimes the occasional domain admin account password will expire in the interim.

ShadowProtect will start failing to back up to the shared folder as a result of not being able to log on so a small bonus in the mix.

We are seeing CryptoLocker problems abound lately where someone clicks on a link in an e-mail or is drawn to a compromised site. What that means is that _any_ file/folder set the user has permissions to access and modify may end up encrypted by the malware.

The _only_ way to “recover” from this situation is via Shadow Copies or backup.

If the backup drive and/or backup folder destinations for those ShadowProtect backup files, or any other product that lays down files for backup, is open for users to access then we all know what can happen.

Point of order: Any backup product that uses the volume snapshot service should have its backup times staggered over the Volume Shadow Copy snapshots as having two snapshots running simultaneously could end up with data toast on both sides.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Some Early Morning, Well Okay it's Early Here, Secure Browsing Related Reading

After posting about the Flash Cache clearing that we usually do via the online control panel we thought it would be a good idea to post some reading on safe browsing habits in general.

Security MVP Harry Waldron obliged a request for pointers with the following blog posts:

• Best Practices - Internet Safety for 2008 - Security Protection - Harry Waldron (CS)
• This is an excellent list of ways to protect ourselves both while browsing but also at our PC/Laptop level.
• This one is well worth the read.
• FBI Warning - Safety tips to avoid Scams and Internet Fraud - Security Protection - Harry Waldron (CS)
• Another excellent list of tips on protecting one's self from being scammed.
• Twitter - Best practices for using it safely - Security Protection - Harry Waldron (CS)
• The key elements for Twitter safety.
• Facebook - Best Practices in double locking account privacy - Security Protection - Harry Waldron (CS)
• Securing a Facebook profile.
• Security Protection – Harry Waldron (CS) – Blog Search Results for "Practices"
• Lots of good posts to delve into.

The following are pointers for Microsoft properties:

• Microsoft – Best Practices for Enterprise Security - Security Protection - Harry Waldron (CS)
• A check list for security audit
• Microsoft Security - Best Practices Home Page - Security Protection - Harry Waldron (CS)

The following article has some excellent tips on social networking:

• Zeltser Blog: 11 Security Tips for Online Social Networking
• This is an _excellent_ resource and reference for us and for our clients.

Have a great long weekend for those of us celebrating Canada Day Weekend and have a great Independence Day celebration/break next week to our US readers!

Thanks for reading. :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Adobe Flash Player Cache Management

It’s always been a bit strange that we need to go to a third party site in order to manage content on a local computer.

• Adobe Flash Player Help: Website Storage Settings panel

Using that control panel we are able to see just what kind of things have been happening, at least to some degree, via the Adobe Flash plugin.

Besides that, there is Start –> Internet Options and DELETE to remove history.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Wondering Out Loud: Are Adobe's and Oracle's Updates A Way To Get Chrome and the Ask Toolbar Installs Up?!?

Okay, so this post is facetious bordering on sarcasm.

The number of security related problems in Java is mind boggling. The fact that Oracle "bundles" the Ask Toolbar with a security update is just plain dumb.

No, I don't want to install Chrome with this particular update to Flash.

With the quality assurance department getting a failing grade at so many companies today one must wonder how we are ever going to get anything done with our credit card numbers being stolen, our identities being stolen, our Inboxes being inundated by compromised Yahoo account's link SPAM, and so much more InterWebs connected rubbish.

Maybe Oracle can employ one or two of these white hat type folks and pay them to find the vulnerabilities in their software _before_ the software goes out the door as garbage! Aren't software vendors supposed to employ folks to do that?

Or, why can't the developers find the bugs in their own the code?

Holy Sugar Smacks! What the chicken is going on here?!?

Someone's mom needs to give their kid in charge of finding bugs in Java a stern talking to at Oracle. They are obviously failing at their job. :P

Would someone _please_ buy Java away from Oracle and clean that crap up?!? Huh?!? PULEASE!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Royal Bank of Canada Business VISA – Electronic Statements Available with Live Balances . . . Finally

One of our alternate financial institution’s credit cards has had online statements and live available credit balance for years.

It’s good to see that the Royal Bank of Canada has just enabled electronic statements for our business VISA card.

So, instead of having to run all 12 month’s worth of VISA statements through the ScanSnap 1400 to create PDF documents we can download them straight out of the bank’s online portal.

We are most certainly glad to see that the bank is catching up with the smaller institutions that have had these features for a few years now. :)

Now, to figure out how to stop all of the RBC statement/billing notifications that come to our e-mail address.

They should be off by default. Folks need to take a bit of initiative with online banking so that the Phishing folks don’t have a leg to stand on.

And one more thing, it’s a good idea to subscribe to a credit bureau’s quarterly credit report along with the ability to be notified any time a credit search hit has been done against one’s credit profile. It’s one of the ways we can protect ourselves against identity theft.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

QuickBooks Support at 1-888-414-6596 Warning

We had a client call this evening that indicated that they were having QuickBooks problems. The user must have done a search and came up with:

The “technician” asked to call back. When they did they brought up the Task Manager and tried to scare the user into allowing them to initiate a remote session to fix virus infections (they pointed to regular Windows processes as being the infections).

Fortunately the user stopped them in their tracks by stating they had an IT department and would get in touch with them instead.

As always, be very cautious about search results.

It is a better idea to go to the product’s Web site and initiate support contact there.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Windows Live Writer

Quick Links to MalwareBytes Program and Definitions Download

We sometimes need to use the MalwareBytes product to verify that a system is clean.

• MalwareBytes Download Links

That site has links to both the program download on a third party site as well as the definition update file that can be important if a malware infection is afoot.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Security Video: TEDx – Avi Rubin – All Your Devices Can Be Hacked

This video is absolutely jaw dropping.

All Your Devices Are Belong To Us

Folks that develop systems, such as on board computer networks in vehicles or medical systems, that allow access via wire or wireless need to rethink the way those systems are made.

Fellow MVP Dana Epp also has some great security related videos that include simple step-by-step instructions on how to get past system security.

It’s getting to the point where the only “secure” way to live is to build a log cabin somewhere with a faraday cage and no inbound/outbound connections whatsoever. Note that there needs to be tree cover to deep keep the eyes in the sky out too.

Getting to know the risks is a part of what we do.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Some Thoughts on Google Drive and Internet “Privacy”

It seems that the new Google Drive service goes way beyond Dropbox and SkyDrive in their terms and conditions.

Your Content in our Services

Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.

When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide licence to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights that you grant in this licence are for the limited purpose of operating, promoting and improving our Services, and to develop new ones. This licence continues even if you stop using our Services (for example, for a business listing that you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure that you have the necessary rights to grant us this licence for any content you submit to our Services.

The originals are here: Google Terms of Service. Emphasis in the above is ours.

Article on the subject: CNET News: Who owns your files on Google Drive?

Dropbox and SkyDrive allow content on their services with no intent to use it to their own profit.

“Do no evil” eh Google?

We Bing for search, we Hotmail, we SkyDrive, and we Live Mesh our content sharing between systems. We avoid Google services as much as we can. Unfortunately moving off Blogger to another service would be a nightmare for the 2000+ posts on our blog so we leave that one lie.

If we are going to store information on Cloud services that requires keeping it from prying eyes we would set up a TrueCrypt container to encrypt the content prior to uploading.

We live in a day and age where SSL/TLS encryption between endpoints does not guarantee that a point in between has been compromised and is capable of decrypting and encrypting content passing through that point.

It pays to be aware of the consequences of posting everything and anything to _any_ Cloud service no matter what their Terms & Conditions are. Law Enforcement does not seem consider other folks’ content on Cloud servers when they are after something as we have seen in so many cases.

One last thing: Always assume that nothing, _nothing_ placed on any service anywhere on the Internet is secure.

So, those party pictures from last weekend? Assume they get out. The same goes for any image or video taken and shared via cell phone, tablet, or other image capture device.

Don’t want that content to get out? Then don’t post it!

There is no such thing as online privacy in the Internet Age. Period.

Hat tip: Dilip Naik of Niriva

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Online Banking “Security”

We are a bit puzzled at why our online banking services are not as secure, at least in our opinion, as we think they should be.

We just finished configuring a new online account at Scotiabank that is based here in Canada.

This is their suggested online password recommendation:

And, one we have finished our sign-up process we see:

But, Scotiabank, if security is important then why are we not allowed to use a pass phrase _with_ special characters?

Not only that, why are the number fields already populated in the online sign-in page?

The “Online Security Guarantee” is kind of cute. :)

“We will fully reimburse you . . . provided that you have met your security responsibilities.”

Okay, so we click the Safe Computing Practices link to find out what our responsibilities are and:

We pretty much follow all of the above with the exception of number 2. We have encountered enough problems with Trusteer’s Rapport Security Software (one example we have blogged) that we will not be trusting any of our systems to their software.

Now, one plus on Scotiabank’s side is that their online portal’s password request actually _is_ case sensitive. We work with other banks that do not pay attention to case in the password field.

Conclusion

Now, obviously the above critique is based on _our_ experience working in I.T. and all of the good, bad, and ugly that we encounter in the way of security situations.

The reality is that the banks have a business decision to make when it comes to reaching the average user.

Thus, in the end we have a good understanding of the _why_ the banks are closer to the lowest common denominator when it comes to online “security”.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Via Phone: Hi, We are the National Internet Service and You are Sending Our Systems a Virus!

One of our client’s users had the presence of mind to pause for a moment when they were called at home this morning and heard the line:

Hi, we are the National Internet Service and your computer is sending our systems a virus! Please sit down at your computer and . . .

They interrupted the speaker and told them that they would be calling their IT support folks ASAP and hung up.

When things like this happen it is important to get in touch with the authorities that handle fraud cases such as this:

• In Canada: Phone Busters

Contact for the Canadian Anti-Fraud Centre:

It's not always easy to spot a scam, and new ones are invented every day.

If you suspect that you may be a target of fraud, or if you have already sent funds, don't be embarrassed - you're not alone.

If you want to report a fraud, or if you need more information, contact The Canadian Anti- Fraud Centre:

Toll Free: 1-888-495-8501

Toll Free Fax: 1-888-654-9426
Email: info@antifraudcentre.ca

To report economic crime on-line please click here

One can only imagine how one can be fooled into providing all sorts of information to a caller like this.

A pearl of wisdom from my Dad: Never volunteer _anything_ in the way of information. Be specific, to the point, and KISS.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Mac Rogue Security Software

It was only a matter of time before folks started writing malware for Macs as Apple’s market share grew.

It is official: Sophos: Naked Security: Mother's Day search terms lead to Mac rogue security software

The following is a good demonstration of the malware’s attack on the Mac:

Malware Mac Attack

While Sophos goes on to plug their product for the Mac at the end of the article itself, this situation really begs the question: Will mainstream A/V vendors be in the same boat as they are today where we will need to go to a third party like Malwarebytes to remove the malware?

That is, will mainstream A/V products _still_ not be able to protect the Mac from this type of attack?

As is the case on the PC, one needs to be very aware of what they are doing at all times along with how to react when something like this happens.

In our opinion, Apple has lulled many into a false sense of security over the years. With their market share growing it was pretty obvious that these types of attacks were bound to happen. Now that they are we shall see if folks keep buying Macs.

UPDATE: Hat Tip: Jeremy of SFNIS via the SBS2K Yahoo List.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Windows Phone 7 Security Update Available

We are getting notice of an update that is related to fraudulent digital certificates:

• Microsoft Security Advisory (2524375): Fraudulent Digital Certificates Could Allow Spoofing

While the update helps to mitigate the malicious use of Web site SSL certificates ultimately we need to be very wary of any and all Web sites that we visit where we are planning on logging or making any purchases. It should be second nature to check that URL.

Hat Tip: Susan Bradley

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

US Government Document – Home Networking Security Best Practices

A PDF document created by the United States government on keeping a home network secure is actually a good read:

• NSA: Best Practices for Keeping Your Home Network Secure (PDF Document)

The document goes on to address Apple devices, home network structures and setup, Internet behaviour recommendations, e-mail usage, and more.

It is probably one of the best security documents that we have seen oriented to the home and/or home/office user base as it covers a broad range of devices, operating systems, and awareness of security elements involved with each piece of the home network.

It is worth the read for us as well as our client’s users.

Hat Tip: Ken Hansen

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Mobile Security–Best Practices by F-Secure

As more and more of our users are incorporating some form of mobile device whether Apple, BlackBerry, Android or other the need to be aware of our client’s security vulnerabilities through those becomes all the more acute.

• F-Secure Blog: Mobile Security Tips

The tips are as follows:

1. Keep your system updated
2. Install a security application in your phone
3. Watch where you click and land
4. Refrain from doing transactions on a public network
5. Install or obtain applications from trusted source
6. Make it a habit to check each applications' data access on your phone

The final point is one of interest since many users do not realize that the applications running on their handheld devices are indeed phoning home with the device’s unique ID and GPS data.

• Wired: Epicenter: Apple, App Makers Sued Over User-Tracking

As always, it is very important to read the Terms & Conditions for any supposedly “free” or even paid services and/or products from _any_ online or on-premise vendor.

• F-Secure Hat Tip: Harry Waldron.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer