Technical Alert: Outgoing emails sent via Sophos UTM being recognized as confirmed SPAM

Sophos issued the following announcement to us:

We are seeing an increasing number of incidents where outgoing emails sent via Sophos UTM with anti-SPAM activated are classified as ‘confirmed SPAM’.

At the moment we have no confirmation that this affects all emails or that it affects incoming emails but we currently cannot exclude this possibility.

Our development team is working with urgency to solve this issue which appears to be caused by the SPAM patterns used. This means that a fix will be provided via live cloud lookup once available, rather than requiring a product or pattern update.

Further information about how you or your customers can report this problem and updates on this issue until it is solved can be found in the following KBA: https://www.sophos.com/en-us/support/knowledgebase/122687.aspx

Thank you for your understanding.

Sophos

What is Miracast ?

Intel has been promoting their Wireless Display (WiDi) technology for quite a while now and we are starting to see some traction in the industry to include it in display devices and other types of components. 

So what is Miracast? Wikipedia describes it as such:

Miracast is a certification program of the Wi-Fi Alliance based on their Wifi-Display specification. It defines a protocol to connect an external monitor or TV to a device, and therefore can roughly be described as "HDMI over Wifi", replacing the cable from the computer to the display

So what do you do if your notebook has this capability but your wall mounted TV does not? Actiontec has a product called ScreenBeam Pro that turns any HDMI connection into a WiDi receiver. Priced under $100, you can easily connect a laptop or android device to that screen or projector with an HDMI connector and wirelessly transmit your video/audio signal to that device. 

Actiontec also has kits that will provide your with a USB transmitter that will connect your laptop that doesn't have the WiDi capability built in so that it will work with the receiver. This is a great solution for providing this capability.

Actiontec Brochure

Daffodil TC03 - Universal Mobile Phone Charger - USB Cell Phone Charging Cable - Multicharger for: HTC / Samsung / iPhone / iPod / Nokia / ZTE / LG / Blackberry

We were considering creating a series of charging stations that patrons could use at site to recharge their phones and other devices. One of the issues that we thought might come up is that even though recently most phones are now using mini-USB connectors for their recharging port, it used to be an issue that many phone manufacturers used to use proprietary connectors.

Here is a cable that takes that into account! This cable has 10 different cable ends attached to give you compatibility with the following devices:

E01-Sony Ericsson

C702,C902,C905,G502,G700,G900,K330,K530,K550,K660,K770,K800,K810,R306,S500,T303,T250,T270,T280,T650,T700,W350,W380,W580,W595,W610,W660,W760,W880,W890,W902,W910,W980,Z555,Z750,Z770,Z780,F305,G705,R300

LG01-LG

KF700,KM380T,KM501,KM710,KS20,KT520,KU250,KU380,KU970Shine,KU990Viewty,KE850Prada,KE970Shine

SA02-Samsung SGH-

F258,F488,G608,G808,i458,i908Omnia,L768

MT02(Micro-USB)-Nokia

8600Luna,8800Arte, Carbon Arte,Sapphire Arte,8800 Sirocco,Sirocco Gold,Prism-series,6500 Classic Motorola Vorager 855 stereo bluetooth headset

SA01-Samsung

SCH-F609,SCH-F639,SCH-S209,SCH-S299,SCH-S399,SGH-B289,SGH-S268,SGH-C408,i608,i620,i718,U608,U708,U808,D838,D848,D908,D988,E218,E258,E768,E848,E908,E958,Z368,Z728,X838

PSP-Sony PSP Kodak camara

NK02 cable-Nokia

2100,2112,2115i,2116,21161,2125,2125i,21261,2128i,2260,2270,2275,2280,2285,2300,2310,2600,2610,2626,2630,2650,2651,3100,3105,3108,3110,3120,3200,6235i,6236i,6250,6255i,6256m,6260,6310,6310i,6340, 6340i,6360,6370,6385,6400,6500,6510,6560,6585,6590,6590i,6600,6610,6610i,6620,6630,6650,6651,6670,6680,6681,6682,6800,6810,6820,6822

MT01(Min-USB)-HTC

Touch Diamond,Touch Pro,Touch Cruise,Touch Dual,Touch Viva Asus M530w,P320,P527,P526,P535,P550,P750 MotorolaW181,W210,W213,W220,W230,W231,W270,W355,W362,W375,W396,W510,Z6,ZS,ZN200,E6,E8,EM30,K1,L7,L72,maxx K3,maxx V3,U6,Ug,V3,Blackberry 8300,8310,Pearl 8120,Bold 9000 glofish M500,M700,M800,XS00,X600,X800 Gsmart i-series,MW998,T600 MS-Series Sony Ericsson X1Xperia HPTMIpaq512,612,912,rw682802 Atom,Atom Pure,Xda Atom Life,Xda Flame,Xda Stealth,Xda Zinc

NK01-Nokia

2610,2626,2630,2680slide,2760,3110,3120,3150,3155,3155i,3250,5220,5300,5310,5320,5500,E61,E65,E71,6060,6070,6080,6085,6290-3G,6300,6500,6500VI,3155i,N70,N71,N72,N73,N76,N77,N80,N81,N82,N85,N90,N91,N92,N93,N93i,N95,N96

IPSG-ipod/iphone series

Are you looking for a better solution to charge your mobile devices.

Our world is becoming more and more craze with all the mobile devices that we seem to be accumulating. My household is probably like yours with both my wife and I having cell phones, Kindles and tablets that we are needing to keep charged. One are of our kitchen is set aside for that main purpose charging (3) Kindles, (2) cell phones, a Nexus 7, Samsung Note8, and an iPad. Quite a bit of craziness in one small area.

So I am constantly looking for a better way to consolidate and accommodate the charging of so many devices. I found a 7-Port USB Charger made by Satechi that allows you to charge 7 devices simultaneously. Four of the ports provides 5 volts/1 amp and the other 3 ports provides 5 volts/2.4 amps of power.

Powerful Charge Three 2.4A ports can charge high-powered devices such as tablets, while four 1A ports can charge smartphones, music players, and other devices. Charge a total of 7 devices simultaneously.

Compact, Space-Saving Design This charging station is only 7.4 x 5.5-inches, providing a powerful charge to all your devices without taking up desk space.

This unit is compatible with the following devices:

• Apple: iPhone 6 Plus, 6, 5S, 5C, 5, 4S, 4, 3, iPad Mini, iPad, iPod
• Samsung: Galaxy S5, S4, S3, S2, Note 2, Note
• Blackberry: Playbook, Torch
• HTC: One, SV, Flyer, Inspire 4G, Sensation, First, Desire
• Motorola: Droid, Razr
• Nokia: Lumia
• LG: Optimus, Ludic
• Google: Nexus
• and many more

Priced around $54.95 this could be a great solution for messy kitchen countertop.

LG has an interesting new keyboard design for your tablet

LG has announced that it is planning to release a new bluetooth keyboard rolls up into a nice tight package when traveling and rolls out to a full size keyboard that automatically switches on and connects to your nearest bluetooth capable device when it is rolled open.

The keys are made of solid plastic (not the flat, squishy kind), which LG hopes will offer a typing experience close to what you're used to on your PC. The keyboard is just the start: the company says it plans to offer even more "input devices" in the next few months. The Rolly will launch this September in the US first, rolling out to the rest of the world soon after. 

Windows 10 Speech Recognition

If you put past articles that have written, you’ll see that I have many different postings talking about speech recognition and used on either a computer or mobile device.  When I write about the speech recognition program I like to use the program itself to write the article which helps to test how well the program works.

In this case are done the same thing and I am writing the article using Microsoft Windows 10’s Speech Recognition application.  I will only run through the initial training session to give the system of brief analysis of my voice characteristics.  While with some programs like Dragon Naturally Speaking, this is sometimes sufficient to give an accurate response, I think Microsoft’s product will need multiple sessions to get to the same level of recognition capabilities that some of these better programs offer.

The basic control commands all seemed to work well and it may be that some of my issues are that I’m also using a new blue tooth headset that might not be transmitting as clear as I would hope.  I probably should listen to my voice in conjunction with what the system was typing out.  However, I do not see that as an option.

All in all, I find that the program is working sufficiently to use it but it does seem to get lost every so often and I have to bring the system back to the program started up again.  This is a frustrating issue but quick on the screen bring everything back to life.  My suggestion is to run multiple training sessions to increase the accuracy of the system so that you have a lower threshold of frustration when you begin using it.

Sophos has announce the EOS date for their Red 10

This is not a big worry but realize that after November 1, 2015 you will need to be considering the soon to be released Sophos Red 15 as a replacement. While supplies in the distribution chain may have some Red 10''s available after that date you will need to be aware that this might not happen though.

One of the benefits of the new Red series is that there will be a wireless version available. In the smaller environments that you normally place this unit this will provide an integrated solution at a very reasonable price.

Successor: RED 15 and prerequisite for deployment The next generation of our entry-level RED product is the RED 15. It will offer all the same features and connectivity options as the current product but have significantly improved performance.

The RED 15 will be available in two versions:

• RED 15 (non-wireless) – available from early September The RED 15 requires you to upgrade to UTM v9.35 but until 9.35 is generally available (plan is end of September), you will need to manually download and install it here. This should be possible starting with the soft release which is planned for early September. • RED 15w (wireless) – availability TBC, plan Q1 CY2016 The support for the new RED 15w that has an integrated wireless N access point is scheduled for the UTM v9.4 release, currently estimated at an early 2016 launch.

Further information about the RED 15 will be provided as soon as possible.

How to prevent Skype from launching when you start your machine...

A question came in today about how to prevent Skype from launching automatically when you turn on your computer. It is a simple thing to do in both the consumer version of Skype as well as Skype for Business. View the how to video listed below.

Surprise! People choose predictable Android lockscreen patterns

by John Zorabedian on August 22, 2015 | Leave a comment

Filed Under: Android, Featured, Google, Mobile, Privacy

It's been well established that people are really bad at creating and remembering secure passwords and PINs.

We're also bad at choosing (and answering) password recovery questions.

New research shows that the patterns people create to lock and unlock Androids, much like the passwords people choose, aren't very complex - and might be a little too easy to guess.

A lockscreen pattern allows you to lock/unlock your device by swiping your finger on the screen - you draw a pattern that touches at least four and up to nine "nodes."

With four-to-nine nodes, there are 389,112 possible patterns you could draw - the more nodes you touch in your pattern, the more secure your lock, because a higher number of combinations means your pattern would be much harder for a snoop or thief to guess.

Marte Løge, a recent graduate from the Norwegian University of Science and Technology, spent a year studying how people create lockscreen patterns, and her findings suggest that they aren't a secure alternative to passcodes at all.

Løge presented her findings earlier this month at the Defcon and Passwords conferences, during a talk she titled "Tell Me Who You Are, and I Will Tell You Your Lock Pattern."

She studied 3400 user-selected patterns and discovered that the most commonly selected patterns used only four nodes.

As Ars Technica reports, not only did most people choose the least number of nodes, the patterns they created had some predictable consistencies:

• the average number of nodes was five, with fewer than 9000 possible combinations
• people tend to start at the upper left corner - and 77% of patterns start in one of the four corners
• patterns usually move left-to-right and top-to-bottom (even among left-handed people)
• people often created patterns in the shape of a letter from the alphabet (choosing letters such as their initials)
• rarely do the patterns backtrack (e.g., going from node 2 to 3 and back to 1)

Løge told Ars that the way we create and remember patterns is similar to how we create and remember passwords - and more complex patterns are hard to remember, just like complex passwords:

It was a really fun thing to see that people use the same type of strategy for remembering a pattern as a password. You see the same type of behavior.

It's also worth pointing out that the oils in your fingers leave visible streaks on your device screen - if you don't use a complex pattern with backtracks, a thief wouldn't need to guess your pattern - it's right there for anyone to see!

Does this mean we should abandon lockscreen patterns?

Well, using a pattern to lock your Android is more advisable than using no screen lock at all.

After all, you need to turn on screen locking using PIN, password or pattern in order to encrypt your Android - and it's a very good idea to do so.

If you decide to use a PIN or password, remember that longer is stronger.

For PINs, every extra number in your PIN makes cracking your code 10 times harder!

Google says passwords are the most secure option (if your password isn't easy to guess).

For passwords or PINs, use as many characters as you can - Android allows you up to 16 characters, so why not use them all?

How to secure your smartphones

Keep your devices safe by following our 10 tips for securing your smartphone.

And check out our step-by-step guide to improve your privacy and security on your iPhone, Android or Windows Phone.

There are many different ways to attack Piracy of Movies and Popcorn Time is becoming another source that is being gone after...

Lisa Vaas of naked security at Sophos wrote and interesting post about the law going after people discussing how to access Popcorn Time and even accessing it to view illegally accessed movies.

According to Lisa in the US movie makers have filed a lawsuit against 11 Popcorn users, alleging they used the software to watch the 2014 Adam Sandler comedy The Cobbler.

This is enough to cause me not to use this kind of service, not just because of the moral issues of stealing, but also, one just doesn't need the hassle.

Be careful of even describing how to access or use the service because people doing this our now being prosecuted as well.

How one school district is monitoring social media of students and teachers

by Lisa Vaas on July 31, 2015 | 6 Comments

FILED UNDER: Facebook, Featured, Law & order, Privacy, Social networks, Twitter

Does your child ever tweet that she "hates" her math teacher?

Does he write that he's so embarrassed he could jump off a bridge?

Do her posts ever mention being bullied, or does she use them to make fun of other kids?

Are you, as a parent, even aware of everything your kids post?

Even if you aren't on top of everything your child posts, your kid's school well might be, given all the social media monitoring software on the market.

If you live in Florida's Orange County, those kind of posts could mean school officials come looking into whatever's going on.

That's because Orange County is one of the latest school districts to start monitoring all of the thousands of social media posts made by both students and teachers.

It's doing so with a new monitoring software called Snaptrends that monitors social media posts from all accounts in its location.

The school district reportedly paid $14,000 for a one-year Snaptrends license.

That buys the district's schools the ability to search thousands of posts on sites like Twitter, Facebook and Instagram, hunting for keywords that might indicate trouble.

School officials say that the goal is to flag potential dangers including cyberbullying, suicide and crime.

Joie Cadle of the Orange County School Board told WESH TV that the monitoring will alert school administrators to kids sending potentially serious threats via social media:

If they are sitting in a classroom and they are tweeting because they are mad at their teacher or their girlfriend for whatever reason, and there are some threatening words there, we need to be able to know if it is credible.

It's not like the posts are private. As Snaptrends' privacy policy notes, the technology only sifts through public posts.

But opponents of the school's new snooping effort, which was announced in April, say it's not the fact that their kids are being surveilled that's disturbing them.

Rather, it's the unanswered question of just what, exactly the school district plans to do with the information it collects.

WESH TV quotes Cindy Hamilton, co-founder of Opt Out Orlando:

My privacy issues aren't with the fact that they're just out there looking at it, because frankly, with social media it's not private. But what are they going to do with the information they look at? That's what we're concerned about.

When it announced the monitoring, the school district said it will:

[U]se the software to conduct routine monitoring for purposes of prevention or early intervention of potential issues where students or staff could be at risk to themselves or to others.

The company will assist district law enforcement and security personnel in monitoring publicly available social media communications that are relevant to school operations and personnel.

Florida isn't the only state to turn to monitoring in the face of school shootings, violence and bullying.

As CNN reported last year, the school system in Huntsville, Alabama, hired a retired FBI agent for security work, which included reviewing social media "when a high priority tip is received about an emerging threat to a school, student or staff member," as a school district spokesman said.

As well, the Glendale school district in Los Angeles in 2012 made the controversial decision to pay the firm Geo Listening $40,500 to monitor its students' social media activity on sites like Twitter, Facebook and Instagram.

The impetus to look into the technology was the suicides of two students. The final decision to pay for the monitoring was made after a pilot program helped administrators step in when yet another student used social media to talk about "ending his life."

The Orange County School District hasn't detailed how officials will decide what, precisely, to review.

Some technologies might just search social media posts, but others are more akin to tools you might expect to see in the arsenals of government surveillance agencies.

Safe Outlook Corporation's monitoring software CompuGuardian, for example, gives school administrators not only the ability to search keywords connected to cyberbullying and drug use, but also to delve into students' search histories to see if they're researching topics about dangers such as school violence.

CNN quotes Safe Outlook President David Jones:

You can identify a student, and you can jump into their activity logs and see exactly what they've typed, exactly where they've gone, exactly what they've done, and it gives you some history that you can go back to that child and use some disciplinary action.

You can bring in the parent and say, 'Hey, look, this is what your child's doing. You need to talk to them about it.'

Interestingly enough, and hardly surprising, is the fact that Snaptrends is reportedly also in use by the Central Florida Intelligence Exchange, which is the local law enforcement Fusion Center.

A Fusion Center is a center set up to "analyze information and identify trends to share timely intelligence with federal, state, and local law enforcement including [Department of Homeland Security], which then further shares this information with other members of the Intelligence Community."

As such, it's not surprising that, just like with the Feds' propensity to amass vast troves of surveillance data about citizens, so too are opponents pointing to monitoring software's collection of anything and everything, including both potentially threatening or perfectly innocent content.

From a post against the surveillance, written by Florida attorney Scott Martin:

Snaptrends is a type of social media scraper/aggregator that collects social media information in mass. The data are scooped up by an automated process without regard to the nature of the content - good, bad, or indifferent.

But what guarantees are there that the social media information collected by the District will be limited to ... benevolent purposes? What policies are in place? Who can access the data? What conclusions are being drawn from the data? Who is drawing those conclusions? What standards are they using in making decisions based on captured data?

All these questions should be answered before any such tool is put in place, Martin says.

I agree. What's your view?

Press Release: Sophos Wins All Three Security Categories in 2015 CRN® Annual Report Card

OXFORD, U.K. August 10, 2015 – Sophos has won all three security focused categories in The Channel Company's esteemed 2015 CRN® Annual Report Card. Sophos swept the board for the second year running as the winners of "Overall Category: Client Security Software" and "Overall Category: Network Security Appliances," and extended its recognition this year adding "Overall winner: Network Security Software" to its accolades. Sophos is the only vendor to have received top ratings in all client and network security categories, demonstrating the consistency of the channel experience across its portfolio.

The Annual Report Card summarizes results from a comprehensive study that details solution provider satisfaction with hardware, services and software vendors. The vendors with the highest marks are named to the prestigious Annual Report Card list and celebrated as best in class by their partners. The results also provide the IT vendor community with valuable feedback—directly from their solution providers—that can be used to hone product offerings and improve communication with partners.

"Our partner community is absolutely critical to our success in helping businesses and government agencies of all sizes protect their systems and information from cyber-attack," said Mike Valentine, senior vice president of worldwide sales for Sophos. "The unprecedented high marks awarded by our partners for the 2015 Annual Report Card reflects our companywide commitment to the channel. This year, CRN and its readers have recognized many of our key marketing and sales people for their accomplishments and impact within the channel, and now to receive such credit in all client and network security categories, is an honor for our entire company."

This year's elite group of honorees was selected based on the results of an in-depth invitation-only survey by The Channel Company's research team. More than 2,400 solution providers were asked to evaluate their satisfaction with 72 vendor partners in approximately 22 major product categories. The winners will be honored throughout The Channel Company's XChange 2015 event Aug. 9-11 in Washington, D.C., and highlighted in the leading media outlet for the IT channel, CRN. To view the results of the study as well as the list of this year's honorees, visit www.crn.com.

"Today's solution providers are juggling multiple vendors, product lines and customer demands. They are looking for true partnerships with their vendors in order to tailor solutions that will meet and exceed their customers' expectations," said Robert Faletra, CEO of The Channel Company. "CRN's Annual Report Card continues to give solution providers an outlet to deliver feedback to vendors and recognizes those vendors at the top of their game. We join these solution providers in applauding 2015 honoree Sophos and recognize them for their stellar performance."

Microsoft Makes DVD Player for Windows 10 Free for Some

While many mobile devices today don't have DVD Drives built in anymore, most desktop units still do and if you want to be able to play DVD's on you computer it may cost you to do so on your newly purchased or upgraded Windows 10 machine.

You can download Microsoft's DVD Player for Windows 10 from the Windows Store for free unless...

• Your using Windows Enterprise
• If you do a clean install of Windows 10 instead of an upgrade, again you don't get it free

The player app is free only for Windows 7 or Windows 8/8.1 users that had Media Center on their machines prior to an upgrade to Windows 10. You also need to upgrade during the free period that Microsoft has outlined. Otherwise you will will have to open your wallet and shell out $14.99 in the Windows Store.

If you don't want to pay, try downloading the free VLC media player for Windows. This is an open source product that you can donate to and they currently have a player that supports Windows 10.

Microsoft Releases Sway to Office 365 and Windows 10 Users

Sway lets you compose text and graphics on the fly that can be used free if you have a Microsoft account. This product is viewed  as a presentation tool to be used primarily by businesses and education users. Subscribers to Microsoft's Office 365 plans that that include "Office Online, Office 365 Business or Office 365 ProPlus" have access to this new Sway commercial release.

Sway users create presentations, called "Sways," from various text and graphics sources. The Sway application sets up the layout based on integrated design principles. Typically, a viewer would scroll vertically or horizontally through a Sway presentation, but a new added feature with this release is the ability to show Sways in an individual slide-by-slide manner.

Also with this release, Microsoft now permits a single device to handle multiple Sway accounts for home and work purposes. Microsoft has also enhanced the Share button in Sway so that presentations can be shared via Docs.com, which is a free Office documents sharing portal.

I would love to hear from anyone that is actually using this product and how you are using it.

Windows 10

As more resources become available to us I will be posting them up to this site for you to access.

Below is a link for accessing the Windows 10 free location for you to get your very own free update.

windows.com/windows10upgrade

Or download a brochure from Microsoft with all of this information here.

Latest Flash hole already exploited to deliver ransomware - update now!

By Paul Ducklin, nakedsecurity.sophos.com

Thanks to Andrew O'Donnell and Fraser Howard of SophosLabs for their behind-the-scenes work on this article.

Are you still using Flash in your browser?

If so, make certain you've got the latest update from Adobe, even though it only came out last week.

Ideally, you'll have 18.0.0.194, announced in Adobe Security Bulletin APSB15-14, issued on 2015-06-23.

→ Windows and Mac users can optionally choose the Extended Support Release, which is an old version retrofitted with the latest necessary security fixes. That one is numbered 13.0.0.296. Linux users are stuck back on Flash 11, for which the current update is 11.2.202.468.

Adobe still delivers its routine patches on Update Tuesday, the second Tuesday of every month, so last week's patch was of the unexpected, emergency sort.

Targted attacks to start with

The bug that was fixed is designated CVE-2015-3133, and it is a remote code execution (RCE) bug that Adobe admitted was "being actively exploited in the wild via limited, targeted attacks."

However, Adobe went on to temper that statement by adding, "Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets."

Whether that's because the threat mitigations in Windows 8 and above make this vulnerability too hard to exploit, or simply because the victims being targeted were known in advance to be running older versions of Windows, is not clear.

One thing is for sure, though: there's still a lot of XP about.

The announcement that the US Navy just paid for a year of extended support for XP - more than a year after official support ended anyway - was a blunt reminder of that.

As colleague Chester Wisniewski pointed out [0'43"] in this week's Chet Chat podcast:

After all the news of the breaches in all these different government agencies..., it was a little concerning to think that we're not down to the shortlist of the last 500 machines over here in the corner, but 100,000 [Navy computers] still running XP.

(Audio player above not working? Download MP3 or listen on Soundcloud.)

In fact, by some accounts, Windows XP is still more widely used worldwide than all versions of OS X out there, and only a shade behind Windows 8 and 8.1 combined.

Cybercrooks join the attacks

As documented by well-known independent malware researcher Kafeine,attack code using of the CVE-2015-3113 Flash bug has already been packaged by crooks into an exploit kit called Magnitude.

Exploit kits, don't forget, are part of the "pay-per-install" ecosystem of modern crimeware.

Instead of battling to build a specific exploit into your own malware so you can attack unsuspecting users with a drive-by download, you just buy or rent access to an exploit kit (EK).

Typically, that's a server, perhaps "borrowed" from an unsuspecting system administrator whose Linux security isn't up to scratch, that is already rigged up with malicious JavaScript pages designed to unleash any of a number of pre-packaged exploits.

The JavaScript in the EK usually tries to work out which exploits are most likely to work in a victim's browser, for example by checking version numbers and available plug-ins, and then runs the most promising exploits in turn until one of them works.

At that point, if you're the crook, it's up to you what you want the EK to deliver.

Weapon of choice

So far, it looks as though the malware of choice that's pushed out by the crooks behind these attacks is ransomware of the Crypto Defense family.

Cryptoransomware, of course, is a particularly odious sort of malware that leaves your computer running fine, but scrambles your data files and thendemands a fee for the decryption key to unlock them.

If you don't have a backup, and the crooks have done their cryptographic programming correctly, then paying up is about the only way to see your files again.

What to do?

Prevention, obviously, is what you want, especially where the data-scrambling payload of ransomware is concerned.

Here are some tips:

• If you don't need Flash, don't install it at all. To find out if you actually need it, rather than assuming you need it, try living without it for a week or two. You may get a pleasant surprise.
• If you need Flash only occasionally, use click-to-play. That's where your browser asks you every time whether you want to let a page use Flash. Or turn the Flash plugin off altogether except for the times you know you need it.
• If you have Flash, don't lag behind on updates. Even automatic updates can take a while to turn up, becaue Adobe spreads the load randomly amongst its users. You can jump the queue by checking for updates manually.
• If you're still running Windows XP, please don't. Vulnerabilities that are really difficult for crooks to exploit on Windows 7 and later - as good as impossible, in fact - can often be still turned into working attacksagainst Windows XP.
• Keep your anti-virus turned on and up-to-date. A good anti-virus can block this sort of attack at multiple points, e.g. by blocking the web page where the EK is hosted; blocking the EK's JavaScript component; blocking the Flash exploit itself; and blocking the ransomware it would grab next.
• Don't skip making backups. If you don't have a good enough backupto recover from ransomware, you are at risk of any number of other potential data disasters, too. These include accidental deletion, a failed hard drive, and a lost or stolen laptop.

NB. Sophos products block the threat components mentioned above under numerous names. Detections you may see include: Mal/ExpJS-BU (exploit kit JavaScript), Exp/20153113-A (Flash files exploiting CVE-2015-3113) and Troj/Ransom-AXO (ransomware seen in attacks).

Free Virus Removal Tool

The Sophos Free Virus Removal Tool works alongside your existing anti-virus to find and get rid of any threats lurking on your computer.

Download and run it, wait for it to grab the very latest updates from Sophos, and then let it scan through memory and your hard disk. If it finds any threats, you can click a button to clean them up.

SSCC 210 - So many cool new Windows 10 features to opt out of [PODCAST]

This weeks Sophos Security Chet Chat Episode 210 - August 5, 2015

I love that Sophos provides this information to us to learn from. It gives you deep understanding about features, issues and things that you need to think about in using and protecting your systems.

LISTEN NOW

(Audio player above not working? Download MP3 or listen on Soundcloud.)

Encrypt like everyone's watching! 60 Sec Security [VIDEO]

• By Paul Ducklin, nakedsecurity.sophos.com
• View Original
• June 27th, 2015

Watch this week's 60 Second Security...

 

→ Can't view the video on this page? Watch directly from YouTube. Can't hear the audio? Click on the Captions icon for closed captions.

The "Stagefright" hole in Android - what you need to know

The conference circuit can be a competitive arena, especially when there are multiple parallel streams.

For example, back in 2010, I was at Black Hat in Las Vegas, and I attended the talk next door to the late Barnaby Jack's now legendary "ATM Jackpotting" talk.

Jack famously made unmodified ATMs that he bought off eBay cough up banknotes live on stage.

Those of us next door had to wait until the ovation and commotion died down before our presenter could continue lecturing to his meagre audience. (At least there was a good choice of seats.)

Exploit Disclosure Silly Season

So it's not surprising that July tends to be Exploit Disclosure Silly Season.

Presenters at Black Hat and Def Con try to convince the media to tell the world that theirs is the talk to choose, stressing the severity of the hole they've found without giving too much away.

There's nothing wrong with that: good talks based on solid reverse engineering aren't easy to put together, and if you're prepared to do a live demo to go with it, you're entitled to your "jackpot" moment.

So, imagine that you've got exploit talks accepted at Black Hat and Def Con, that your hack is a remote code execution hole in the world's most widespread mobile operating system, and, best of all...

...that the operating system component in which you found the bug is called "Stagefright".

That's a better name for an exploit than POODLE or LOGJAM – heck, it's a better name than Heartbleed' (although the bugs don't really compare at all, whatever you may have read).

You can use a name like "Stagefright" in your press releases without being accused of hyperbole.

Unsurprisingly, then, that's what researchers at Zimperium have done.

They found a bunch of security holes, now designated with seven different CVE numbers (CVE-2015-1538, -1539, -3824, -3826, -3827, -3828 and -3829).

It's become the "Stagefright" hole.

Multimedia Messaging System

The bugs are in an unfortunate part of Android: a part that is used by the Multimedia Messaging System, or MMS.

Remember MMS?

Like SMS but with videos, sounds, pictures, and no annoying 160-character limit?

It's an aging system that doesn't get a lot of attention these days, because internet-based programs like WhatsApp, Snapchat and Instagram have swept it aside.

But most Android phones are still set up to receive MMS messages, and will process them automatically by default.

Technically speaking, an MMS arrives as a link, so that the actual content of the message (which might cost you money) is fetched only later on, when you decide that you want to look at it

That's a bit like email clients that fetch only subject lines at first, so you can ignore or delete unimportant messages without racking up download charges.

But the default SMS/MMS apps in Android 4.4 (KitKat) and 5.x (Lollipop) are Messaging and Hangouts respectively, and their default configuration is to download MMS content in the background as soon as the messages arrive.

Remote Code Execution

Unfortunately, the bugs found by Zimperium allow shellcode – executable instructions disguised as harmless multimedia data – to take control of your device as soon as the content of a booby-trapped message is downloaded.

So, you may be able to trigger malicious activity as soon as a victim's device receives your poisoned message, even if they later decide to delete it.

That's what's known as a Remote Code Execution (RCE) vulnerability, almost always the worst sort.

The bug has been around for some time, and Zimperium is claiming that 950,000,000 devices may be at risk.

(That precise sounding number seems to be simply a 95% vulnerability rate multiplied by a round one billion Androids.)

Patches coming

Google knows about the bugs, and has prepared patches.

Indeed, if you have a Google Nexus, and you have updated recently, it sounds as though you are already safe.

Sadly, we can't be sure which other device vendors have already patched, unless they choose to say so, because Zimperium is keeping the exploits under wraps until Black Hat, when the whole world will find out about them (and presumably, how to exploit them) at the same time.

It also sounds as though rebuilding Android from the open source project (AOSP) won't help yet.

Google told The Guardian:

This vulnerability was identified in a laboratory setting on older Android devices, and as far as we know, no one has been affected. As soon as we were made aware of the vulnerability we took immediate action and sent a fix to our partners to protect users.

As part of a regularly scheduled security update, we plan to push further safeguards to Nexus devices starting next week. And, we'll be releasing it in open source when the details are made public by the researcher at BlackHat.

In short, this sounds like a serious bug, and you should be looking for a patch as soon as you can get one.

What to do?

• Try asking your device vendor whether a patch is available already. You may be able to get ahead of the game.
• If you can't get a patch right now, find out when to expect it so that you can apply it as soon as you can.
• If your messaging app supports it (Messaging and Hangouts both do), turn off Automatically retrieve MMS messages.
• If your device supports it, consider blocking messages from unknown senders if you haven't already.
• If your SMS/MMS app doesn't allow you to turn off Automatically retrieve messages, consider simply switching back to Android Messaging, which does.

Unless your digital lifestyle hinges on MMS, we think that you will be able to live without it, and that blocking the auto-download of potentially booby-trapped MMS content is a great start.

Of course, even if you've turned MMS auto-downloading off, you still need to avoid clicking on suspicious MMSes – doing so would initiate the potentially dangerous download anyway.

So, if you see an MMS from a sender who's never communicated with you before, consider deleting it.

And don't forget that "Stagefright" isn't specific to MMS messaging, but rather to the way Android renders the sort of content typically delivered by MMS.

Firefox for Android, for example, has recently been updated; it too was apparently vulnerable via web pages containing booby-trapped videos.

So, keep your eyes peeled for those patches!

Yet Another Encryption Scam

ZDNet reports that another encryption scheme has arisen to rear its ugly head using Windows 10 upgrade as the teaser. Hackers are targeting users attempting to upgrade to Windows 10 with ransomeware malware that encrypts files until a ransom is paid. The "bad guys" appear to be impersonating Microsoft in and an attempt to grab your money. 

Emails are being sent out tempting the email recipient with an attachment that is an installer that will allow them to get the new Windows 10 operating system sooner. What is making this scheme work is the fact that Microsoft is making users wait in queue for their turn to upgrade their systems. Impatience on the part of waiting users is causing plenty of heartache for those that succomb to the tempation of running the installer.

Once you download and open the attached executable file, the malware payload opens, and begins encypting data on the affected computer and locking you out of those files.

Typically you are required to pay the ransom using bitcoin which is much harder to track. And to make it even harder to track the bad guys, they are usually using the TOR network which makes it nearly impossible to trace.

Cisco research Nick Biasini said the malware payload, called CTB-Locker, is being delivered at a "high rate." "The functionality is standard however, using asymmetric encryption that allows the adversaries to encrypt the user's files without having the decryption key reside on the infected system." 

Ransomeware attacks have been on an increase since 2014 and is a quick and easy near-untraceable way to generate a lot of money in a very short time. So hackers are going to keep coming up with new ways to attack your systems. So beware of what you are clicking on and accepting, you may their very next victim!