Trusted IT Solutions
The March 2019 Edition of Business Solutions from ITS focuses on the approaching Windows 7 End-of-Support.
View online or download the PDF.
Do you recognize your version of Windows below? If you think you are running Windows 7, try these steps to confirm:
1. Click the Start button, enter “Computer” in the search box, right-click “Computer”, and thenclick “Properties”.
2. Look under Windows edition for the version and edition of Windows that your PC is running.
We have received several calls and emails to ask about Momo – How can we protect our students? What do we need to know?
This most recent round of
Like many, I personally spent a large chunk of time on Wednesday and Thursday this week reading articles, clicking links, watching Peppa Pig, and logging into gaming sites. I also visited some schools virtually and in-person to check web history and firewall traffic. If a child searches for Momo on the Internet, they will find images of Momo, will find haunting videos and will likely find the same Peppa Pig video that everyone has been sharing with the spliced content. Much of this content is the same content shared in multiple ways by news sources, school districts and public safety organizations attempting to alert parents and keep children safe.
The Momo Challenge first hit the news cycle in July of 2018 as a viral challenge that threatened harm if you told others that you had seen Momo or did not follow-through with requested actions. Multiple people portrayed Momo through the popular communication service WhatsApp. The viral nature encouraged people to “become” Momo and seek to threaten and scare others, while also encouraging younger children and teens to seek out interactions with Momo on social media.
Momo is not the first viral challenge, and will not be the last. Some viral challenges have been good, raising awareness and funds for specific causes like the “Ice Bucket Challenge.” Other challenges have encouraged children to perform dangerous tasks, run away for 48 hours, or bully others. It is important to discuss peer pressure in relation to viral challenges with our students. This was a good list of popular viral challenges:https://www.commonsensemedia.org/blog/viral-youtube-challenges-internet-stunts-popular-with-kids
We require students to use and cite multiple sources when doing research at school; why should parents, law enforcement, news outlets, and schools share safety warnings without first performing minimal research? Where should we check to find trustworthy opinions on cyber safety? Some sites we have used to cross-reference viral posts or learn more about online threats:
It is also important to help children know how to report unsafe content and actions. When on YouTube, for example, users are asked to flag inappropriate content – the response is generally very quick! YouTube has also changed several policies in the past week to try and eliminate issues related to Momo and other inappropriate content that may be targeting children. You may see comments gone from some types of videos and may see that YouTube requires you to sign-in as proof of age.
Classrooms should have a procedure in place that allows students to report unsafe sites and unsafe content anonymously. We often hear reports that one student finds something online (at school, or brings from home on a personal device) and shows another student. The offended student is embarrassed and scared to report the incident with staff for fear of getting in trouble also. Students are more likely to report inappropriate sites and content, or gaming sites that waste educational time, if they can report
Children that play online games at home should know how to report inappropriate users or content, and should also be aware that community-generated games may not take action to remove reported content or users and it may be better to leave the game entirely. Many games also have built-in chat components; we always recommend that users do not use their real name or any personally identifying information in their username or chat sessions.
While the Momo Challenge news did not represent an actual threat at this time, online communities are always looking for new opportunities to engage and manipulate youth. Please, don’t hesitate to reach out if you are trying to block specific content, looking at YouTube account settings, or have general online safety questions for
I recently attended a webinar on new cybersecurity threats, and watched a “live hack” as part of the learning session.
The hacker was a Certified Ethical Hacker (CEH) and Computer Hacking Forensic Investigator (CHFI); two certifications that we also hold in our office. The featured hacker works for a security firm that performs intrusion and penetration tests on networks and runs a phishing/social engineering training service.
The live hack took seven minutes from start to finish; we watched the hacker visit a company website to grab email addresses for specific roles within the company. The hacker sent an email to a random person on staff in order to receive a reply with a company signature line. He then created a spoofed email address, appearing to send a message from the CEO to various members of the sales team – included in that email was a copy of the signature line he had just received, to keep the email consistent with the company “look”. The email attachment contained an Excel file with macros and appeared to contain company data regarding sales for the end-of-the-quarter. After the hacker clicked send, it was only a matter of time before the sales staff received and opened the infected email.
As soon as the recipients clicked to enable macros, the hacker received backdoor entrance to their computers. While logged in, the hacker had several different options. He could remain hidden and use a key logger to collect usernames and passwords, he could install an encryption file and hold the recipients’ files ransom, he could begin using the computer to mine bitcoin or host bots and viruses, or he could try to reach across the domain to infect other computers on the network.
One click and seven minutes were all it took to seriously compromise the data, network, and users of this specific business. As we followed the hacker back to the beginning, he illustrated the clues the users should have seen to indicate that this was a phishing email and not real sales data. We could hover over the sender name and see that the address did not match the expected domain. We could have hovered over the links in the signature line and noticed that they were not live – that the signature line was a screenshot.
Many of the webinar attendees questioned why the virus-scan on the recipients’ machines did not block the infected file. The hacker showed us that the recipients were indeed using a virus scan, but a free version that was only comparing files to a known database. His infection was so new that the signature had not yet been listed in these virus databases. If the recipients had been using sandbox-based endpoint protection (antivirus), the file would have been opened in the cloud away from the physical computer and checked for behavioral characteristics before releasing the file for download.
What can clients do to protect themselves from sneakier and trickier cyber threats?
I have also attached a PDF that discusses several of these tools and policies in greater detail.
Leslie is Marketing Manager at ITS, with a background in K-6 Education. Leslie’s daughter recently attended a STEM career/experience day, and came home announcing that she was the “fastest hacker” – a sure sign that she does listen to her parents at home!
I recently presented to local
If you are looking for the highlights, I’ve listed the major threats and some protection advice below. The best protection method is to always think before clicking, whether installing an app or following a web link.
While Google Play and Apple’s iTunes/App Store have security guidelines in place for app developers, users are still vulnerable to fake or hidden apps on their mobile devices.
One method is for scammers to send a text message with an invitational link to download an app. This app may look like a legitimate banking app and the text may appear to be from a national banking chain, but the app may be specially designed to trick you into entering your banking credentials and other passwords. This threat is especially prevalent in the Android market. Take time to look up the app in the app store, read reviews and download statistics, and check the app description for grammatical errors or typos.
Popular games like Fortnite also create a flurry of fake apps and add-ons. As Epic (developer of the popular Fortnite game) moved the game outside of the Google Play store for Android users, opportunities developed for scammers to advertise their version of the Fortnite game. You should always download games and apps directly from the app store or game developer website.
The McAfee report also indicates that many smart home assistants (Amazon Alexa, Google Home) are setup with minimal security settings. The password may be weak and insecure, the wireless network itself may be easy to hack, or failure to run firmware upgrades on your IoT devices might allow hackers to use known vulnerabilities.
As IoT device offerings continue to grow in the home-device market, it is important to do your research and make sure you are buying a product with a reputable security controls. An off-brand product may be taking advantage of explosive growth in the market to offer a cheaper product with little security oversight.
Tools that allow users to segment or subnet their home network are increasing in ease-of-use and availability. Most business networks will have some items in a subnet, to increase network efficiency and prevent open communication to specific types of devices/users.
While your 12-year-old may be able to add devices to your wifi if you provide the username and password, there is often more to setup than just network access. Read through the installation manual, look online for an authorized support forum if you have questions, and make sure that you know how to check a log of activity on your device. Constant (network) connection also requires constant vigilance.
Leslie is Marketing Manager at ITS, with a background in K-6 Education. She enjoys designing classroom activities and presentations that help students develop an interest and awareness in IT Security.
It’s another snowy day in Iowa, and some of our staff are working safely from home instead of risking the slick commute. When you call our office, we are still able to transfer you to your assigned technician to talk helpdesk tickets, to your account manager to discuss IT needs, or to sales staff to talk new Windows 10 purchases. Unless we tell you otherwise, you would never know who is working from Palo, Cedar Rapids, Central City or Louisiana. Although, on snowy days in Iowa, the teleworker from Louisiana is probably the happiest!
How do we stay connected? Our 3CX phone system!
All of our mobile employees, whether they travel to work helpdesk tickets or meet with clients, have the 3CX mobile app installed. This allows their work extension to ring-through on their cell phone and complete conversations and text/voice/video chats through a wireless connection. When no wireless connection is available, the same conversations can utilize a cellular connection.
Our remote workers have another option in addition to the mobile app on their cell phones: the 3CX App for Mac and App for Windows. These users typically integrate a headset to make calls from their computer. Again, we have access to their extension from our dispatch board just as if they were sitting next to us in the office!
When staff
Contact our sales team to learn more about 3CX for your communication needs!
