UTM Up2Date 9.203 Released

Press Release:

We are pleased to announce that a new Up2Date package is available for Sophos UTM.

This update introduces several bug fixes and also includes the fix for the OpenSSL SSL/TLS vulnerability (CVE-2014-0224)

Please read on to see the full details of this release.

Sophos UTM 9.203

News

• Security Update

Remarks

• System will be rebooted
• Configuration will be upgraded
• Connected Wifi APs will perform firmware upgrade
• Connected RED devices will perform firmware upgrade
• Windows SSL VPN Client should be updated

Bugfixes

• 31027 FTP proxy active mode did not work and failed with the antivirus turned on
• 31460 Exception is detected but will be ignored on outgoing emails (when scan outgoing messages is active)
• 31571 Executive reports failed with error message “Bad file descriptor”
• 31594 Display of a SG Series shows ‘HA Slave Status Error’
• 31716 Permanent admin-reporter.pl restarts causing high cpu load
• 31938 OpenSSL SSL/TLS MITM vulnerability (CVE-2014-0224)

Download:

While you do not need to manually download Up2Date packages (they will automatically download and prepare themselves for you to install), for manual application of Up2Dates or for UTM installations without Internet connections, you can retrieve them using the link below.

Up2date link:
ftp://ftp.astaro.de/UTM/v9/up2date/u2d-sys-9.202028-203003.tgz.gpg

Up2date MD5sum:
003dd2c89a9281f2b34d7c92892fc563

File size:
≈60MB

Up2Date Installation:

Sophos Up2Date technology makes it easy to upgrade your Sophos UTM to the latest version.
There are two ways to apply an already-downloaded Up2Date package to the system:

1. Log on to WebAdmin, navigate to Management >> Up2Date >> Overview and use Update to latest version now to install the Firmware Up2Date. Click on the “Watch Up2Date Progress in new window” and an extra browser window will show the progress of the Up2Date installation. (The System administrator will receive a notification email once the Up2Date process has finished.)
2. Download the Up2Date package from our HTTP or FTP Server and install it under Management >> Up2Date >> Advanced:

Sophos UTM Up2Date FTP Mirrors:

Introducing Prime Music

New message coming from Amazon Prime now provides streaming music for Prime Members for free. Looks kind of interesting if you enjoy listening to music on your devices. Check out their info:

Three years ago we launched Prime Instant Video, adding unlimited streaming of thousands of movies and TV shows to the existing Prime benefit of Free Two-Day Shipping. It has turned out to be one of the most important things we've done for Amazon Prime members.

Now we are doing it again for music — introducing Prime Music, the newest benefit of your membership. Prime members now get unlimited, ad-free access to over a million songs and hundreds of playlists for free.

  Explore Prime Music 

Prime Music is available now for Prime members in the US. Kindle Fire HD/HDX devices will get Prime Music in an automatic, over-the-air update. To access Prime Music on your iOS or Android device please get the latest version of the Amazon Music app.

Lenovo Yoga Demo

Lenovo Miix 2 Demo Video

Lenovo Helix Demo Video

BioLite Stove

Here is a neat camping accessory for those of you that are still camping, I’m not but this is really something that I could see being useful for the outdoor Geek that is in some of us. At cost of just $129.95 you can have a way to charge your phone while cooking your meal along the trail. This is a very small stove and it sure would be a Godsend for those of you walking the Appalachian Trail.

For being such a small package it sure appears as though it is extremely useful when considering the extra weight it would add to your backpack. It is 5 inches in diameter, 8.25 inches high and weighs 33 oz. Here are a few other Tech Specs that you might be interested in:

Android 4.4.3 update rolling out to Nexus, Motorola, and Play devices now

Google’s Android 4.4.3 is under way now (my Nexus 7 (2013) is downloading it as I am typing). This new update is supposed to bring security enhancements and bug fixes for the devices.

"This latest software update brings an improved dialer with a new interface and new colors to enhance consistency and usability, as well as several stability, framework, security fixes, and enhancements to the power profile capabilities," said Steve Horowitz, Motorola Mobile's SVP of software engineering.

Read more on this at: ZDNet

Gaming News: Intel is shipping a new Core i7 chip…

IDG News Service - Intel is shipping a new Core i7 chip for gamers that runs at 4.4GHz -- and can be overclocked to 5GHz.

The Core i7-4790K is a quad-core chip based on the Haswell microarchitecture. It draws 88 watts of power and has 8MB of cache, integrated graphics, memory controllers and support for the latest I/O technologies. It also supports multithreading and allow cores to process two tasks at one time.

The chip, now Intel's flagship PC processor, is mainly for gaming and enthusiast desktops.

It's Intel's first chip capable of running at over 4GHz under normal conditions. It can be overclocked to 5GHz in air-cooled systems, said Renee James, president of Intel, during a keynote speech at the Computex trade show in Taipei.

Intel's not the first chip company to reach 5GHz though: Advanced Micro Devices offers FX chips for gamers with clock speeds of up to 5GHz.

Chip makers moved away from cranking up chip clock speeds in favor of adding cores as a way to boost performance about a decade ago. Bumping up clock speeds generated more heat and consumed more electricity. Performance improvements over time have also come by shrinking chips and integrating more components such as graphics cores.

But AMD and Intel haven't given up on clock speed altogether: They continue the battle on their flagship chips with the aim of capturing the performance crown.

Home Automation

With so many vendors wanting to grab you as a customer for home automation functions if you want to add these kinds of features to your home you’ll want someone to give you all of the options. PAConnect has always been a systems solution provider and we offer the perfect options for you to take advantage of automating your home in so many interesting ways.

In a couple of weeks we should have completed the initial setup of our new showroom experience that will give you an opportunity to see all of the different controls that you will want. Talk to our system integrators to help you decide what will be best for your situation and needs.

The combination of home security and and home control all under one application control is what we are all looking for. You want to have this information available on your phone, as well as control different functions remotely from the same app on your phone. You want as many options as possible, including receiving your alerts via text, push notification, email or a phone call. And you want a complete history of events so that you can go back and research a problem after you have become aware of it. You want a system that is simple to use but sophisticated enough to provide all of the features that you want. Then you want PAConnect! Make an appointment now with our home security and automation specialists  to design a personalized system just for you!

Android Phone are becoming a high target for Malware authors!

CNET’s Dennis O’Reilly recently reported that more and more Malware Authors are creating code for Android phones that are showing up even on Google Play for download.

If you are not installing a security application then your phone is exposed. If you or your office workers are connecting your phones to your company network you are not only risking your phone’s information but you could also be exposing your company’s network to attack.

We have many products to help keep your systems secure including your personal phones so please let us work with you to lock down your security before it is too late.

Remember, security starts with you. Be careful with what you download and the sites that you visit. Attacks can come in many shapes and sizes. Keeping the bad guys out requires a multilayer approach to security that includes using a security program, only using trustworthy sites for downloads, and be sure you keep watch of your credit cards and bank statements to ensure that they have not been compromised.

One of our favorite security companies is Sophos and they have a free security app that you can put on your phone to help keep it secure. But if you want more control over the company security and company provided phones we have some more advanced products that work very well to keep your data and personal information secure and safe from prying eyes.

Update: Adobe Login Outage

One of the biggest worries about using online applications or connections is losing access to them for a time.

This is a message I received this afternoon from Adobe, at least they are being upfront about the issue:

Reemergence of Cryptolocker called CryptoWall

Beware! This is some pretty bad stuff that is coming through your email.

It looks like the latest variant of Cryptolocker, called CryptoWall, is coming through email.  So far, we have seen emails coming through with subjects of “You received a voice mail” or “Balance Sheet”.  Since this is a new variant, it is not being picked up by many antivirus programs yet.

As a reminder, do NOT open any email attachments unless you are expecting them (even if the message looks to come from someone you know).  If you are unsure if a message may be a virus, please check with us prior to opening it. 

If you have an Vertical MBX phone system like ours, your forwarded voicemails come from mbx@mbx.com.

Microsoft fixes Internet Explorer Security Flaw

Everyone has been reporting on the issue with Internet Explorer on all versions running on XP, Vista Windows 7 and 8 machines and versions of IE  v6.0 and up. This flaw gave hackers the ability to take over your computer if you click on a bad link. A very serious issue indeed.

This flaw has been fixed, even on your XP machines, but you will need to be on the internet and you need to turn on automatic updates to receive the patch. cNet has reported that:

The patch, delivered at 10 a.m. Thursday, comes out of Microsoft's usual Patch Tuesday cycle because of its severity. It affected IE 6 through 11 and allowed attackers to install malware on your computer without your permission that could be used to steal personal data, track online behavior, or gain control of the computer.

Dustin Childs of Microsoft Trustworthy Computing, the company's security group, said in a blog post.

"If you're unsure if you have automatic updates, or you haven't enabled Automatic Update, now is the time."

Of the decision to fix Internet Explorer 6, 7, and 8, the only versions of the browser that still run on the 12-year-old Windows XP, Childs was terse.

"We have made the decision to issue a security update for Windows XP users," he said, noting that "Windows XP is no longer supported by Microsoft" and that Redmond "continue[s] to encourage customers to migrate to a modern operating system, such as Windows 7 or 8.1."

Of the decision to fix Internet Explorer 6, 7, and 8, the only versions of the browser that still run on the 12-year-old Windows XP, Childs was terse.

"We have made the decision to issue a security update for Windows XP users," he said, noting that "Windows XP is no longer supported by Microsoft" and that Redmond "continue[s] to encourage customers to migrate to a modern operating system, such as Windows 7 or 8.1."

Beware of a scam going around in which a "Microsoft Support Person" calls about windows system errors on your computer.

Microsoft will NEVER call YOU direct. Microsoft says people are now falling victim to it every day, as it can be very convincing. And while you may be tech savvy your friends and family members may still fall for this, especially the elderly . Pass this on! How The Scam Works Mr. Smith has had a lot of problems with his laptop, including lockups and blue screens. So he was relieved when the phone rang and the caller said he was with Microsoft Tech Support. "He said I'm from Microsoft, and we have noticed that you have had a lot of viruses," Mr. Smith said. The caller explained that Microsoft, during a routine scan of his system, found his filled with problems that were slowing it down. "I was gullible," Mr. Smith admits. "He said he could show me where the viruses were, and so I let him take control of the mouse." Mr. Smith says the man directed his to a webpage that, once he logged on, allowed the caller to take control of his computer (something security companies can do). The man then called up an internal page on the laptop that appeared to show it overrun with viruses. It showed hundreds of "errors" and "critical alerts." Mr. Smith was alarmed. "He said he could remove the viruses for a hundred dollars, on a credit card," Mr. Smith said. But something about it made Eyster suspicious at that point, and good thing: It was all a scam. So What's In Your Computer? The errors they show you are not viruses at all. "They are calling about Windows errors," "But everybody has Windows errors. So immediately you are listening." "He spent an hour on the phone and at the end of the hour they told him they were going to charge him $300,". Then she had to remove the "malware" that the caller installed. It's Not Microsoft Remember: Microsoft will never call you unsolicited. The company says this is a foreign scam to collect credit card numbers and install malware. But if you have PC problems, like Mr. Smith did, it's so convincing. "I believed it, and I bit like a fish," he said. Bottom line: If Microsoft calls you, hang up. If you are having computer problems bring it into our showroom and we can assess any virus or malware issues you may be having. Call: 724-838-7526

789 East Pittsburgh Street - Greensburg, PA  15601 Monday - Friday 9:00 AM - 6:00PM - Saturday and Sunday Closed

RingCentral Mailing on Heartbleed Bug

Dear Customer, In response to the Heartbleed Bug, we are reaching out to customers to communicate the status of RingCentral’s service. The OpenSSL Heartbleed Bug is a critical security vulnerability that affected many Internet sites. More information on the bug can be found at www.heartbleed.com. The RingCentral service was not vulnerable to the Heartbleed Bug. Additionally, we have worked with our phone manufacturers. Only Polycom VVX phone models have the vulnerability, and this is being addressed by Polycom. We will push out the update once available. Cisco phones and the remaining Polycom phones are not vulnerable. Note that customer messages are not stored on the desk phones. As always, we recommend that customers configure their local networks using best practices to ensure that the user interfaces on VoIP phones are protected by customer firewalls. Regards, The RingCentral Team   ©2014 RingCentral, Inc. All rights reserved. RingCentral is a registered trademark of RingCentral, Inc. 1400 Fashion Island Blvd, San Mateo, CA 94404. Terms of Service / Privacy Policy

Office Online will shortly be available as a chrome app…

I question the need for this but it could possibly be useful for some of you. While Office Online apps already work in Chrome they will shortly be available as a Chrome Application. I just tried using it on my Nexus 7 with no luck, all I was able to access was my mail, calendar and contacts. However, on a computer it came up just fine in Chrome. The Office Web Apps seem to be getting better and better with each iteration.

Since the Nexus screen is only 7 inches I’m not sure that it is a big loss not having it there but I would still like the option.

To access Office Online right now go to www.office.com and sign in with your account information. If you don’t have an online account you can sign up here.

Let me know what you think of this…

Update from LogMeIn about OpenSSL

As you may be aware, a major vulnerability has recently been discovered for OpenSSL, the popular encryption software that powers 2/3 of the web. Some LogMeIn services and products rely on OpenSSL, including the LogMeIn Free and Pro hosts used in our popular remote access products.
We take the security of our customer data very seriously and at this time have no evidence of any compromise, but like many web companies, our security team took immediate action to proactively address the issue.
We've updated the LogMeIn host and related services to close the vulnerability, and we're advising that customers take the following precautionary steps:

1. Check to confirm you're running on the latest version of LogMeIn.

You can do that by hovering your mouse over computers in your Central or My Computers page on the LogMeIn.com site.
OR by right clicking on the LogMeIn icon in your systems tray and opening LogMeIn Control Panel and click on the About tab.

Confirm version number 4.1.0.4144 and above for Windows or version number 4.1.0.4145 and above for Mac
If you are using an older version, please click the Check Updates button in the LogMeIn Control Panel (as described above), and update the software.

2. Change your Windows PCs or Macs passwords – This is for your computer login credentials only. You do not have to change your LogMeIn account login.

3. Take a minute to review our FAQ on the LogMeIn help site.

In addition, our security team continues to perform a rigorous diagnostic investigation to ensure the protection of our users, and will provide additional product-specific updates if necessary.
Thanks,
The LogMeIn Team

Bloomberg News Reports that some Android Devices might be susceptible to the Heartbleed issue as well…

Millions of smartphones and tablets running Google Inc.’s Android operating system have the Heartbleed software bug — a sign of how broadly the flaw extends beyond the Internet and into consumer devices.

Although Google said in a blog post last week that all versions of Android are immune to the flaw, it added that the “limited exception” is one version dubbed 4.1.1, which was released in 2012.

Security researchers said that version of Android is still used in millions of smartphones and tablets, including popular models made by Samsung Electronics Co., HTC Corp. and other manufacturers. Google statistics show that 34 percent of Android devices use variations of the 4.1 software. The company said less than 10 percent of active devices are vulnerable.

The Heartbleed vulnerability, which was made public last week, can expose users to hacking of their passwords and other sensitive information. While a fix was simultaneously made available and quickly implemented by the majority of Internet properties that were vulnerable to the bug, there is no easy solution for Android gadgets that carry the flaw, security experts said.

Even though Google has provided a patch, the company said it is up to handset makers and wireless carriers to update the devices.

Aruba Security: OpenSSL Vulnerability (Heartbleed) Update

We recently published an announcement for the OpenSSL 1.0.1 vulnerability ("Heartbleed Bug") that has been making big headlines this week.  This vulnerability is very serious because it can allow an attacker to get the private keys that are being used to secure the communication, making it possible to launch a man-in-the-middle or other impersonation attack.
Our engineering and support teams have reacted quickly and patch releases for all affected Aruba products have been made available. Our OEM partners, our customers with active support contracts and AirWave 8.0 beta customers have all been notified. Many members of our Airheads Community have already started taking action.
Which Aruba products are affected?

• Affected versions: ArubaOS 6.3.x, 6.4.x and ClearPass 6.1.x, 6.2.x, 6.3.x. Previous versions of these products used an earlier version of OpenSSL that is not vulnerable.
• Aruba Instant and Aruba Mobility Access Switches are NOT affected.
• Aruba Central cloud-based management has been upgraded successfully.
• Patch release for AirWave 8.0 beta is now available on our support site.
• Patch release for Aruba Mobility Controllers running 6.3.x and 6.4.x versions of ArubaOS, including FIPS version, is now available on our support site.
• Patch release for Aruba ClearPass 6.1.x, 6.2.x and 6.3.x versions of software is now available on our support site.

What’s your best course of action?

• Understand that this is an industry- and internet-wide vulnerability and Aruba is not the only one affected.

• We recommend that you review Aruba security bulletin before calling Aruba support. It is important that any affected infrastructure components are upgraded to the available patch release immediately.

• As a pre-caution, it is recommended that you update administrative access passwords to Mobility Controllers and ClearPass after the software upgrade.

• Security policy for some of you may require server certification on Mobility Controllers and ClearPass to be re-issued. If the ClearPass server certificate is updated, and you have utilized the “ClearPass Onboard” functionality to onboard employee mobile devices to the network will have to take one more step: you will have to educate your users to re-connect to the wireless network and onboard their devices again to download the latest server certificate.

Security update: Your Carbonite backup is safe

Dear Carbonite User,

As you may have seen in recent news, a major vulnerability has been exposed in OpenSSL, a popular web encryption software used widely across the internet. This vulnerability - dubbed Heartbleed - makes it possible for hackers to access information transmitted from your computer even though it is being encrypted via the HTTPS protocol.

Carbonite Personal and Pro subscriptions do not use the affected encryption software. Your personal data was never at risk. With Carbonite's Personal and Pro subscriptions, your data is protected by the following safeguards:

• Encryption: Your data is encrypted while on your computer and securely transmitted to our data centers, where it stays encrypted.
• Data centers: Our state-of-the-art data centers are guarded 24/7, employ temperature control and biometric scanners, and have backup generators in the event of a power disruption.
• Third-party compliance audit: We recently completed a six-month audit with an outside firm to ensure all of our practices meet the strict federal guidelines of HIPAA and the AICPA guidelines for SOC 2. The external auditor found that we met or exceeded the requirements.

If any of your other online vendors have been impacted by Heartbleed and you use the same password as you do for Carbonite, we recommend changing both passwords. Your Carbonite password should only be used for our service, and data security best practices state that a password should be at least 10 characters, with capital letters, numbers and symbols. For more on changing your password, please refer to the Knowledge Base.

Thank you for trusting us with your data.

Sincerely,

The Carbonite Customer Support Team