Simplivity’s response to the Shellshock issue

Shellshock Advisory

SimpliVity is issuing this message as part of our Product Security Incident Response process to help protect our customers from a software vulnerability publicly disclosed yesterday (September 24, 2014) known as "Shellshock".  

The vulnerability is in the GNU Bourne Again Shell (Bash), the command-line shell used in many Linux and Unix operating systems. Details of the vulnerability can be found at the Common Vulnerabilities and Exposures website - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271.

The SimpliVity OmniCube software uses a version of Linux that is impacted by this vulnerability. This vulnerability is not specific to the SimpliVity product. It affects a large number of software products that leverage Linux/Unix operating systems.

SimpliVity takes product security seriously.  We are in the process of developing a software update that remediates this vulnerability and will make it available to all customers via SimpliVity’s Global Services Customer Support team.  

While this vulnerability represents a large risk to the general marketplace, its potential impact on SimpliVity OmniCube deployments is significantly lower because this vulnerability cannot be exploited on the OmniCube Software by an unauthenticated user.

Should you have any further questions, please contact SimpliVity Customer Support at 1-855-SVT-SERVICE (USA) or 1-508-536-4151 (International), or email support@simplivity.com. 

Best Regards,

Randy Boutin

VP, Customer Support

SimpliVity Corporation

Press Release: Sophos on ShellShock

Bash Shellshock – What Is It? Shellshock is a serious security bug in Bash, a shell commonly used in computers running Linux, UNIX and OS X. Shellshock could allow an attacker to execute malicious commands across the Internet on remote computers, notably web servers. The Threat Cybercriminals are trying to exploit Shellshock to steal data and compromise servers with malware. SophosLabs has seen malware in the wild that seeks to exploit Shellshock to gain access to a server and call home for instructions. This kind of malware could infect servers to create a botnet, which cybercriminals use to distribute zombie malware, or for turning the botnet into a weapon for launching distributed denial-of-service (DDoS) attacks on web servers. Sophos Can Help Sophos products protect against Shellshock attacks in several ways: • Sophos Antivirus blocks malware-related payloads exploiting Shellshock in Linux, UNIX and OS X     • Web Application Firewall (WAF) and Intrusion Prevention System (IPS) rules in Sophos UTM stop Shellshock requests before they reach the server     • Advanced Threat Protection (ATP) in Sophos UTM blocks malware call-home attempts, and creates a threat alert for malicious traffic Visit Sophos.com/shellshock for the latest news and security advice from the experts at Sophos.

Square has a new update in both hardware and software available for free!

Check out what we’ve been working on and then sign in to your Square account to request your new free card reader.

• Send Invoices for free
• Receive next business day deposits directly to your bank account
• Accept payments without an internet connection
• Manage inventory and keep stock of items
• Integrate with your favorite third-party services like QuickBooks and Xero

If you haven’t taken a look at Square recently you might be in for quite a surprise. I know that I was. I have had a test account with them for quite awhile and was set back with all of the new capabilities and functions available from Square.Take a few minutes and see what the new Square has to offer.

Simplivity and Shellshock Advisory

Shellshock Advisory

SimpliVity is issuing this message as part of our Product Security Incident Response process to help protect our customers from a software vulnerability publicly disclosed yesterday (September 24, 2014) known as "Shellshock". 

The vulnerability is in the GNU Bourne Again Shell (Bash), the command-line shell used in many Linux and Unix operating systems. Details of the vulnerability can be found at the Common Vulnerabilities and Exposures website - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271.

The SimpliVity OmniCube software uses a version of Linux that is impacted by this vulnerability. This vulnerability is not specific to the SimpliVity product. It affects a large number of software products that leverage Linux/Unix operating systems.

SimpliVity takes product security seriously.  We are in the process of developing a software update that remediates this vulnerability and will make it available to all customers via SimpliVity’s Global Services Customer Support team. 

While this vulnerability represents a large risk to the general marketplace, its potential impact on SimpliVity OmniCube deployments is significantly lower because this vulnerability cannot be exploited on the OmniCube Software by an unauthenticated user.

Should you have any further questions, please contact SimpliVity Customer Support at 1-855-SVT-SERVICE (USA) or 1-508-536-4151 (International), or email support@simplivity.com.

Best Regards,

Randy Boutin

VP, Customer Support

SimpliVity Corporation

Sophos products and the Bash vulnerability (Shellshock)

• Article ID: 121444
• Updated: 26 Sep 2014

In the light of the recent Bash vulnerability known as "Shellshock" (CVE-2014-6271 and CVE-2014-7169), we have reviewed its products to understand if any are at risk.

As far as we are aware, none of our products can be exploited by means of this bug.

As a matter of good security practice, we will be updating the various Sophos-supplied versions of Bash as soon as a stable and effective patch is available from the Bash maintainers.

For more information, see our Naked Security post: http://nakedsecurity.sophos.com/2014/09/25/bash-shellshock-vulnerability-what-you-need-to-know/

If you need more information or guidance, then please contact technical support.

CNet is reporting that Bash bug is “Bigger than Heartblead”

CNet writers Claire Reilly and Steven Musil just reported that a quarter of a century old vulnerability known as the Bash or Shellshock bug could cause major havoc. This is a big deal because it can cause problems with almost all installed system that have Internet access.

See more about this problem at: read more

OneDrive now allows you to upload 10GB size files

Microsoft sent out notification yesterday announcing that they have increased your file size upload to 10GB files and  if you have the free Outlook.com email account you only have a 15GB storage limit. If you have upgraded to Office365 then you have a 1TB storage limit. Do you think that it is worth $60/year to have a 1TB of cloud Storage?

Sophos is a Leader (again!) in Gartner Magic Quadrant for UTM

We are so happy that Sophos Products are recognized as a leader in the Security Industry. That is one of reasons their products are part of security product offerings. Security is such an important issue we need to be concerned with that you’ll always will to include the best for your business. Gartner helps us keep track of those company’s products that we should consider at the top of our list of choices.

Gartner has named Sophos as a Leader in the Magic Quadrant for Unified Threat Management – for the third year in a row.

Read the full report here »

TechSmith Snagit–Graphics Screen Grab Software

Snagit has been a part of my tool box of applications that I use for many years. I am not sure how I would work if I didn’t have it available to me. Some of the features that I like include scrolling back through screen grabs to reuse an image, editing and image either by cropping or creating special effects. This is great for inserting an image into a quote or a document quickly with little work.

TechSmith’s library of tutorials are especially helpful to get you up and running or get a quick refresher on how a particular part of the program works. They have both written and video tutorials to draw on for all of their programs so don’t be shy accessing them since they are free for your use.  http://www.techsmith.com/tutorial-snagit-current.html

Microsoft sets Windows 9 reveal for Sept. 30

Are you ready for a new update? Most of the world says yes but what will it look like? Invitations went out on Monday for a September 30th event where Microsoft will show off the next version of Windows. One of the ongoing questions being bandied about is how much is the new version going to cost. If they decide to give it away for free or very low nominal cost then it would go along way to heal the rift that has opened up on how Corporate Users look at version 8 and 8.1.

Microsoft is going to presumably release it sometime during the first half of 2015. Corporate users as a whole don’t much care for the split personality (User Interface) of Version 8 and if Version 9 converges the functions within a single user interface than it might be a more widely accepted product. If Microsoft doesn’t provide a product that Corporate wants to use than we might see a real decline in Microsoft’s presence in the workplace.

There have been some images leaked showing what the new operating screen is going to look like but I still take a wait and see attitude before I jump aboard. What everyone is saying should happen will hopefully happen and we will get a good product that makes us all very happy users.

How do you keep up on the News that you are interested in?

One of the rules that are part of my mantra in choosing the tools that I use on a daily basis is that it must be available to be used on any device that I pick up. I don't like having to go to one specific device to be able to use any one application. So what I'm looking at a solution, that solution must be available on my phone, on my tablets, my computers, in Android, iOS, Windows or Mac OS. What good is a tool if it is not available to you when and where you want to use it?

So when Google got rid of its Google reader program I had to go looking for an alternative. I came upon an app called Feedly. At the time it was perfect because it pulled all my RSS feeds from Google Reader so I didn’t have to set them up again. Other great features let you group them so that if you are looking for specific information it is easier to go to the group to see what information flows in. It allows you to see just the unread posts and provides the number of articles in each group and feed.

So what is an RSS feed? RSS stands for Rich Site Summary and is a format for delivering regularly changing web content.  It is great for collecting posting from sites that weblogs or are news services. So if the information source has made its content available in RSS format you can then subscribe to that site using a program that consolidates the feeds you have subscribed to. This saves you time from having to visit each site individually. I personally subscribe to a narrow range of topics including local news sources, IT topics, Business Management, Sales Management and Photography. Almost any subject has someone producing information that you can subscribe to in this manner.

One of the aspects of Feedly that I use a lot is the share function. This allows me to grab the posting and store it for future use in other applications to make it easier for me to use it. I use Instapaper for my long term storage documents, Pocket for my short term subjects and sometimes OneNote depending on the subject matter. Other share functions that you can use include GooglePlus, LinkedIn and of course email. So this program allows to me to sift though a large amount of information very quickly and share or save it very simply as well.

I hope this brief explanation helps you and if you have any questions please don’t hesitate contacting me.

Amazon Mobile LLC now available for your Android Phone

If you have been waiting on the edge of your seat for an APP to allow you access to the World of Amazon Shopping you no longer have to wait.

Amazon describes the APP as follows:

Shop the millions of digital and physical products in Amazon’s catalog and manage your orders from anywhere. The Amazon App for Android phone combines the fast and easy mobile shopping experience customers have come to know and love with access to unlimited streaming of tens of thousands of movies and TV episodes from Prime Instant Video. After installing this version of the Amazon App for Android, customers wishing to stream Prime Instant Video movies and TV episodes can install the Prime Instant Video player, which is delivered exclusively via the Amazon Appstore. To start streaming movies and TV episodes, just search for your favorite video and tap play; the Amazon app will guide you through the setup process.
• US customers can now use a single app to discover and shop for hundreds of millions of physical and digital items.
• Prime members in the US can stream unlimited Prime Instant Video from inside the Amazon app using the Prime Instant Video player, including HBO shows The Sopranos, Boardwalk Empire, Six Feet Under, and The Wire
• Customers can shop any of Amazon's sites around the world from a single app
• Quickly search, get product details, and read reviews on millions of products sold by Amazon and other merchants
• Take advantage of 1-Click ordering, order tracking, delivery information, customer support, Wish Lists, and Push Notifications
• Compare prices and check availability instantly by scanning a barcode, using Flow, or typing your search
• Buy with confidence, knowing that all transactions are securely processed

Dyre malware adds corporate espionage

Viruses and Trojans are continually being repurposed for all kinds of nastiness.  A Zeus variant known now as Dyre, is a banking trojan that first got noticed in June when security companies warned that the Zeus knockoff found a way to bypass Web encryption, know as secure sockets layer (SSL). At that time, it was used to target some of the largest banks concerns including: Bank of America, Ulsterbank, RBS, Natwest and Citibank. An even newer version of Dyre has begun targeting Salesforce, a popular cloud service for storing customer information. We use this program to manage many of our vendor’s CRM functions. Watch out, another whole new breed is coming out.

Aruba: Leader in 4 out of 6 o Garner’s Critical Capabilities

Gartner, Critical Capabilities for Wired/Wireless LAN Access Infrastructure, Aug 2014

GET THE REPORT

The 2014 Gartner Critical Capabilities Wired and Wireless Access Infrastructure report is an extension of the Magic Quadrant which investigates product and service ratings based on key network capabilities set to differentiated use cases. This report allows network decision makers to more deeply explore vendor offerings based on specific network access needs.

Aruba Networks received the highest scores for the following 4 out of 6 use cases:

• Enterprise WLAN-Only Access
• Small or Remote Office
• Guest or Hot Spot Access Only
• High-Density Volume

Click the button below to download the full report*

GET THE REPORT >

ioSafe’s CEO Robb Moore on Discovery Channel

ioSafe is being featured on the Discovery Channel program Daily Planet. You can watch our CEO, Robb Moore, with the host burning, dousing with water, and even dropping our 1513 form 30 feet all in an effort to try and render the data useless. The data SURVIVED intact!  A video is worth a million words in this case! Here is the link to the video: http://www.discovery.ca/Video?vid=433556

New Notice on Dropbox Pro updates

What’s new with Dropbox Pro?

• We're giving you 10x the space — for the same price. You'll have 1 TB of space for your photos, videos, docs, and any other files you want to keep safe in Dropbox.
• With new sharing controls, we’re making it easier to manage access to the stuff you share. You can set passwords and expiration dates on your shared links and grant view-only access to shared folders.
• Keeping your stuff safe is our top priority. For extra peace of mind, remote wipe lets you delete your Dropbox files off a lost or stolen device.

Learn more about Pro changes

Follow up on IRS Scam Call

Now a call came in from Federal Magistrate Office. Is there such a thing?

I can’t believe they are still trying this. Here is an article my accountant sent me from the IRS.

IRS Newswire August 28, 2014

News Essentials What's Hot News Releases IRS - The Basics IRS Guidance Media Contacts Facts & Figures Problem Alerts Around The Nation e-News Subscriptions The Newsroom Topics Tax Tips 2012 Radio PSAs Fact Sheets Armed Forces Disaster Relief Scams / Consumer Alerts Tax Shelters IRS Resources Compliance & Enforcement Contact My Local Office Filing Options Forms & Pubs Frequently Asked Questions News Taxpayer Advocate Where to File IRS Social Media

Issue Number:    IR-2014-84 Inside This Issue Scam Phone Calls Continue; IRS Identifies Five Easy Ways to Spot   Suspicious Calls WASHINGTON — The Internal Revenue Service issued a consumer alert today providing taxpayers with additional tips to protect themselves from telephone scam artists calling and pretending to be with the IRS. These callers may demand money or may say you have a refund due and try to trick you into sharing private information. These con artists can sound convincing when they call. They may know a lot about you, and they usually alter the caller ID to make it look like the IRS is calling. They use fake names and bogus IRS identification badge numbers. If you don’t answer, they often leave an “urgent” callback request. “These telephone scams are being seen in every part of the country, and we urge people not to be deceived by these threatening phone calls,” IRS Commissioner John Koskinen said. “We have formal processes in place for people with tax issues. The IRS respects taxpayer rights, and these angry, shake-down calls are not how we do business.” The IRS reminds people that they can know pretty easily when a supposed IRS caller is a fake. Here are five things the scammers often do but the IRS will not do. Any one of these five things is a tell-tale sign of a scam. The IRS will never: 1. Call you about taxes you owe without first mailing you an official notice. 2. Demand that you pay taxes without giving you the opportunity to question or appeal the amount they say you owe. 3. Require you to use a specific payment method for your taxes, such as a prepaid debit card. 4. Ask for credit or debit card numbers over the phone. 5. Threaten to bring in local police or other law-enforcement groups to have you arrested for not paying. If you get a phone call from someone claiming to be from the IRS and asking for money, here’s what you should do: If you know you owe taxes or think you might owe, call the IRS at 1.800.829.1040. The IRS workers can help you with a payment issue. If you know you don’t owe taxes or have no reason to believe that you do, report the incident to the Treasury Inspector General for Tax Administration (TIGTA) at 1.800.366.4484 or at www.tigta.gov. If you’ve been targeted by this scam, also contact the Federal Trade Commission and use their “FTC Complaint Assistant” at FTC.gov. Please add "IRS Telephone Scam" to the comments of your complaint. Remember, too, the IRS does not use email, text messages or any social media to discuss your personal tax issue. For more information on reporting tax scams, go to www.irs.gov and type “scam” in the search box. Additional information about tax scams are available on IRS social media sites, including YouTube http://youtu.be/UHlxTX4rTRU?list=PL2A3E7A9BD8A8D41D. and Tumblr http://internalrevenueservice.tumblr.com where people can search “scam” to find all the scam-related posts. Back to Top Thank you for subscribing to the IRS Newswire, an IRS e-mail service. If you know someone who might want to subscribe to this mailing list, please forward this message to them so they can subscribe. This message was distributed automatically from the mailing list IRS Newswire. Please Do Not Reply To This Message.

---

Update your subscriptions, modify your password or email address, or stop subscriptions at any time on your Subscriber Preferences Page. You will need to use your email address to log in. If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com.

This service is provided to you at no charge by the Internal Revenue Service (IRS).

Beware of Scam Phone Callers identifying themselves as calling from the Legal Affairs Agency (IRS)

This past Sunday I received a call from a foreign gentleman stating he was from the Legal Affairs Agency and told me that the IRS had issued a warrant for my arrest for fraudulent tax reporting and they wanted me to wait at my house for two agents from the IRS to come and identify me and take me to jail for 6 months.

After being hung up on from the caller, (I called him back on the number he left me), I realized that this was a total scam. After spending a little time researching the phone number and referencing IRS Scam it seems that this has been going on for a very long time. It is a well documented scam so beware if you get the call. They are very convincing and for most of us, the bare mention of the IRS has us scared sh!!!less. If you have ever been through an IRS audit you will find that if they want to, they’ll find something to justify their looking at you. So when something like this happens you might have a tendency to jump to the wrong conclusion.

They never did ask for money from me but they have from other reports. Can’t imagine why they didn’t try with me but I was giving them a lot of guff. First off, the government is not going to haul you off without notification. Second, a foreign accent coming from the Southwest and not local or in DC is just not going to happen. When my accountant confronted they on the phone by asking for their supervisors name and number they just hung up. This would probably be a great way to shut them up very quickly. Anyway, I just wanted to make you aware that these guys handle social engineering real will and can get you going if you don’t sit back and think about what they are telling you.

How do you prevent being aggravated from this? If you don’t recognize the number on your caller don’t pickup! They will get discouraged if they don’t ever talk to someone and eventually go away. If you want to find out who the caller was Google the number. It should give you hint as to where it is coming from. If you are not expecting a call like this, of course you’re not, just don’t respond. Take a deep breath and erase the message and go on with your life.

Sophos Receives Multiple Top Honors in CRN 2014 Annual Report Card

Boston – August 20, 2014 – Sophos today announced it has taken the highest awards in the CRN 2014 Annual Report Card (ARC).  The company was named overall winner in the Client Security Software and Network Security Appliances categories and swept the subcategories of product innovation, support and partnership. It is the first time in the history of the ARC that a company has swept both awards. For nearly three decades, this distinguished study has served as a benchmark for excellence throughout the IT channel, recognizing the technology vendors most highly praised by their solution provider partners.

Honorees were selected based on the results of an in-depth survey by The Channel Company’s research team.  More than 2,500 solution providers were asked to evaluate their satisfaction with 81 vendor partners on each of the 18 criteria in terms of product innovation, support and partnership.  The winners were honored by CRN, the top news source for solution providers and the IT channel, on Aug. 19 at The Channel Company’s XChange conference in San Antonio.  To view the results of the study as well as the list of this year’s ARC honorees, visit www.crn.com.

“IT today is about solving business problems, and it requires more than just stellar products.  Solution providers are looking for vendor partners that embrace the IT channel, working with them hand-in-hand to meet their customers’ needs,” said Robert Faletra, CEO of The Channel Company, publisher of CRN.  “CRN’s Annual Report Card is the definitive word on who those vendors are, coming straight from the solution providers themselves.  The ARC has been recognizing the vendors that deliver their solutions through the channel in the most effective ways for 29 years, and we congratulate Sophos as one of 2014’s top honorees.”

Sophos is dedicated to the channel, as evidenced by the company’s channel-first reseller strategy.  We assist our partners in identifying opportunities to retain and grow their customer base and increase profits.  In an increasingly complex security environment, we work with partners to make security simple to deliver, implement and manage. Our Partner Program provides partners with protection for deal registrations, attractive margins and joint lead generation initiatives. We also provide up-to-date certification, to ensure partner sales and technical teams are fully trained across our latest solutions.

“It’s an honor to sweep these important security categories,” said Michael Valentine, senior vice president, worldwide sales, Sophos.  “At Sophos, 100 percent of our focus is on the channel.  These awards are a testament to the trust of our partners, the strength of our solutions, and the investment that we continue to make in our partner organization.  We are excited for the future as we continue to innovate to make security simple to manage, deploy and use.”

TechSmith has uploaded 10 Ways to Use Video in Education

If you are in any kind of education in a school or business environment this product can be enormously helpful in getting your information across. I use it quite a bit to capture issues, training or other informational videos that I put together for internal use.

This video highlights 10 ways educators and students are using TechSmith tools to create, share and assess with video.

10. Flip a Lesson
9. Teach While You're Absent
8. Personalize Feedback
7. Parent & Community Communication
6. Stop Repeating Yourself
5. Record Experiments
4. Authentic Assessment
3. Create a Professional Development Library
2. Student Video Projects
1. Formative Assessment