Understanding how to keep your WiFi more secure

Understanding how to keep your WiFi more secure

When you log into WiFi at a public place, such as a library, a school, a business, a restaurant, or the like, it’s likely your anti-virus software will warn you of logging into an unsecure network.

But, did you ever think that when logging onto the WiFi at your home or business you may still be facing some security issues? Are you aware of the risks involved with not securing your WiFi? It’s important to keep in mind that WiFi is a target for hackers. Securing your WiFi may be way easier than you think.

Here are a few tips on how to do that.

 

Change the name

One of the first steps is to create a strong name for the WiFi network to replace the default network name, such as xfinitywifi, AT&T or Netgear (My neighbor uses FBI as his network name). Fossbytes says most hackers have access to tools such as “rainbow table” that can break into most any network simply by knowing the default SSID name.

 

Protected Access

Another security measure to use is enabling your WiFi protected access. When setting up the router, the setting can be seen as WPA2 or WPA-PSK. Fossbytes said older routers will have something called WEP, or Wired Equivalent Privacy, but that’s not much of an effective deterrent to modern hackers.

 

Firewalls

One tool to use, if it’s built-in, is a firewall for your router, which can obscure a hacker’s view of the network, Fossbytes said. Another thing to consider is turning off the Universal Plug and Play protocol on the router. Although this is meant to make connecting devices easier, Fossbytes said the use of it makes a potential entry point for hackers.

 

VPN

Another way to protect your WiFi network is to create a Virtual Private Network, which encrypts data traveling between a computer and a server. Through a VPN, even if a computer is logged onto a public WiFi, any hacker paying attention to traffic will only see encrypted data shared, Techify said in a recent article on ways to protect a WiFi network. VPN works by “giving your location anonymity on its server and even creates its own firewall to protect your network traffic,” Fossbytes said.

 

Change your password

Lastly, one simple, but crucial point of protection, and one that we here at ITonDemand stress over and over again, change your password. Using a strong password, or perhaps an even stronger pass phrase, can cut down on a hacker’s ability to penetrate a network or computer.

If you’re still concerned about setting up a secure network, don’t hesitate to reach out to ITonDemand for help. It’s better to be safe than sorry.

 

(800) 297-8293  ·  info@ITonDemand.com

Public Charging Stations: Are they secure?

Public Charging Stations: Are they secure?

If you have spent any time traveling through an airport, you have seen a public charging kiosk. you might think, how convenient. Especially if your alternative is moving onto the floor closer to an outlet in the terminal.

But before you plug your phone into one of these kiosks, there are some security issues to discuss.

One such security threat is, “juice-jacking”. TechAdvisory.org defines juice-jacking as the process by which, “user access is gained on your phone by leveraging the USB data/power cable to illegitimately access your phone’s data and/or inject malicious code onto the device.”

Juice-jacking can affect any phone, both Android or iPhone. They both have the same weak spot: the charging cable. Data runs through this cable same as the power supply.  Once the hacker has been able to access your data, it doesn’t matter that you have unplugged from the kiosk.

Juice-jacking is a security concern worth noting. But juice-jacking is not as large a problem as getting your phone/tablet stolen or downloading corrupt software by mistake. Still, we all should take precautions. Consider some of the safety measures:

  • Keep your device charged. Have your phone charged and ready to go before making a trip or going to an event. This prevents the need to charge in public.

  • Carry a personal charger. These nifty devices are inexpensive and take up very little space in your bag. You can charge on the go without tethering yourself down to a public kiosk.

  • Keep a spare battery for all of your devices.

  • Lock your phone. If you lock your phone (type in a passcode to open), it will not pair with the kiosk.
    Tip: Make sure you lock your phone before plugging it in. Pairing only takes seconds!

 

If you feel you have a corrupted phone after charging at a public kiosk, we would be glad to assist in solving the issue.

 

Bad Rabbit Cyber Attack Targeting Windows Machines

Bad Rabbit Cyber Attack Targeting Windows Machines

On October 24th, a new cyber threat was released. It is called Bad Rabbit. Bad Rabbit targets Windows machines, impersonating as an Adobe Flash update. After initial infection, it attempts to spread itself through your network. Once it has spread, it begins to encrypt commonly used Microsoft Office files, pictures, video, and emails on the infected workstations. These files can only be unlocked after the user pays a fee in Bitcoin to the rasomware’s authors.

The imitation Adobe Flash Update screen (almost an exact copy of the real Flash update) can be seen below:

The following is an example of Bad Rabbit’s lock screen and ransom note:

 

We at ITOnDemand are monitoring the situation. We have taken the necessary steps to make sure that our partners are protected. Please contact us immediately if you feel that your computers or network have been compromised.

For more information about Bad Rabbit, please see the following link.

Your Wifi Security Is Our Top Priority

Your Wifi Security Is Our Top Priority

As you arrive home tonight and turn on the news, you may be greeted with the unpleasant news that ‘Wireless Internet Isn’t Safe, It’s Been Hacked!’

Please be assured that we are monitoring the situation, and patching all related systems that we manage to insure that you are protected.

This security breech is different from the normal methods that culprits and criminals have historically used to access your data (brute force, social engineering, phishing, etc…) in that the vulnerability is on the client machine, not the Wireless Access Point.

This means that each device you have connecting to your Wi-Fi is a potential security risk, and should be updated as soon as possible.

– For ITonDemand customers using Windows workstations, updates pushed to your computers on October 10th included the applicable security updates. Please be sure that you have rebooted to apply any patches that we have deployed to you.

– For customers using Mac or any other platform, as the updates become available for your particular hardware they will be automatically pushed out by those vendors as they become available.

All available patches for ITonDemand managed Wi-Fi devices have been applied and will be pushed out to your managed devices this evening to insure that they are protected from this attack as well.

In the event that you have a non-managed access point (wireless router) or would like to consult with us on your best options to be sure that your business and data are protected, please feel free to reach out to us and we will be happy to assist.

As always, thank you for being an ITonDemand customer!

Petya virus spreads across the globe

Petya virus spreads across the globe

Yet another ransomware attack is spreading across the globe hitting Russia, Europe, and the U.S. Thus far there are confirmed reports of the virus hitting Ukrainian ministries, radiation monitoring at Chernobly nuclear facility, metro systems, and banks. A number of large companies like the Russian energy company Rosneft has also reported being hit.

Ukrainian vice prime minister Rozenko Pavlo tweeted an image of a computer that has been infected with the ransomware.

In the United States the pharmacutical company Merck confirmed its global computer networks had been hit as did lawfirm DLA Piper.

Symantec has reported that this ransomware is also using the same hacking tool, Enternal Blue, that was used in theWannaCry ransomware attacks. The tool was created by the National Security Agency (NSA).

The New York Times wrote:

The attack is actually “an improved and more lethal version of WannaCry” according to Matthieu Suiche, a security researcher who helped contain the spread of the WannaCry ransomware last month when he created a “kill switch” that stopped the attacks from spreading.

The vulnerability used by Eternal Blue was patched by Microsoft last April but many organizations have failed to apply the patch.

ITonDemand & Petya

We are happy to report that to our knowledge all our clients who use our basic services avoided the Petya attack. We were able to provide protection via patching, backup, antivirus, and disaster recovery.

If you have not, make sure to update your computer this week and be wary of email attachments. Learn more about ransomware or contact us to carefully plan and execute a comprehensive security plan to mitigate the risks ransomware presents.

Scriptkiddies try to resurrect WannaCry

Scriptkiddies try to resurrect WannaCry

Last week, ransomware WannaCry made headlines as it spread rapidly across 150 countries and attacked over 300,000 computers in a very short time.

Security researcher Marcus Hutchins put a stop to the ransomware spreading by registering a domain that he found in the malicious code. He explained the process saying that “a sinkhole is a server designed to capture malicious traffic and prevent control of infected computers by the criminals who infected them.”

Registering the domain effectively acted as a killswitch since the malware was setup to ping the domain before continuing to spread.

Today that domain was the target of DDoS attack aimed at knocking it offline which could have potentially let the ransomware spread again.

Since the ransomware hasn’t been able to keep up with the amount of decryption requests, Hutchins speculated that low level hackers, or scriptkiddies, were doing it for laughs. Hutchins did not seem worried about the DDoS attack succeeding, but it serves as reminder to have plan in place in case your business or organization is hit by a ransomware attack.

ITonDemand & WannaCry

WannaCry exploited a vulnerability that was identified in March by Mircrosoft. Due to our strict adherence to keeping our software and hardware up to date, we are able to provide protection from ransomware via patching, backup, antivirus, and disaster recovery.

If you have not, make sure to update your computer this week and be wary of email attachments. Learn more about ransomware or contact us to carefully plan and execute a comprehensive security plan to mitigate the risks ransomware presents.