When the chips are down…. Intel processor security flaws – what you need to know!

Graeme D Anderson



F**CKWIT, aka KAISER, aka KPTI, Meltdown & Spectre – Intel CPU flaw needs low-level OS patches.

A fundamental design flaw in Intel’s processor chips has forced a significant redesign of the Linux and Windows kernels to resolve the chip-level security bug. Similar operating systems, such as Apple’s 64-bit macOS, will also need to be updated – the flaw is in the Intel hardware and the only was to fix it is at the Operating System level – or worst case to be totally sure you can go buy a new processor without the design fault. Unchanged: A fundamental design flaw in Intel’s processor chips has forced a significant redesign of the Linux and Windows kernels to resolve the chip-level security bug. Similar operating systems, such as Apple’s 64-bit macOS, will also need to be updated – the flaw is in the Intel hardware and the only was to fix it is at the Operating System level – or worst case to be totally sure you can go buy a new processor without the design fault.

Microsoft have already released an update which will automatically be applied to Windows 10 machines. For users running any other Operating System we recommend you manually check and apply any pending system updates to ensure you are protected. Antivirus providers are also reacting by releasing software updates to combat any potential risks from the newly discovered flaw. Unchanged: Microsoft have already released an update which will automatically be applied to Windows 10 machines. For users running any other Operating System we recommend you manually check and apply any pending system updates to ensure you are protected. Antivirus providers are also reacting by releasing software updates to combat any potential risks from the newly discovered flaw.

If you run Sophos (our recommended security software) then you are already protected as updates were released on January 5th. You can read more here – https://community.sophos.com/kb/en-us/128053

Ransomware cyber-attack threat escalating – customer guidance for WannaCrypt attacks.

Graeme D Anderson

There have recently been a huge increase in ransomware and cryptolocker attacks. This is rapidly becoming one of the most significant threats to UK organisations.

Friday’s high profile cyber-attack has affected more than 200,000 victims in 150 countries as of Sunday PM 14/05/17.

It is imperative if you are running an affected system that you apply the latest security patch from Microsoft as there are reports of a new version of the ransomware already in circulation.

Microsoft have released guidance for those that may be affected.

Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible.

For those organizations who have not yet applied the security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010. Customers running Windows 10 are not affected by this attack and need take no action.

 

Download English language security updates here:

Windows Server 2003 SP2 x64

Windows Server 2003 SP2 x86

Windows XP SP2 x64

Windows XP SP3 x86

Windows XP Embedded SP3 x86

Windows 8 x86

Windows 8 x64

Three easy things you can do to protect yourself online:

1, Install security patches – keeping your operating system up to date with the latest security hot-fixes and patches is one of the most effective ways to stay safe online.  Automatic updates are enabled by default on the latest Microsoft operating systems.

2, Don’t open unexpected attachments – if you don’t expect to receive an attachment don’t open it. Also do not click on links from within an email. Instead type the website address manually into your web browser if you are unsure.

3, Update to the latest operating system – running older operating systems such as Windows XP means you are more vulnerable to these sorts of attacks. Upgrade where possible to the latest operating system for the most secure experience.

As a silver Sophos partner we have the expertise and experience to plan, deploy and manage your security solution. To find out how boxportable can help secure your business contact us today or to find out more about our recommended security solutions click here.

Firefox 0 Day Vulnerability

Graeme D Anderson

safety-bulletinA vulnerability has been identified in the Firefox web browser which could potentially leave your Windows PC open to attack. This is a 0 day vulnerability, meaning it is new and has as yet not been patched by the Firefox developers. While they are working on a fix the recommended course of action is to use a different web browser, such as Internet Explorer, Chrome or Safari.

If you use Firefox, we recommend you temporarily switch browsers to Chrome, Safari or a non-firefox based browser that is secure until the Firefox dev team can release an update. The vulnerability allows an attacker to execute code on your Windows workstation. The exploit is in the wild, meaning it’s now public and every hacker on the planet has access to it. There is no fix at the time of this writing.

More information is available at: https://www.wordfence.com/blog/2016/11/emergency-bulletin-firefox-0-day-wild/

Randsomware emails

Graeme D Anderson

There have recently been a huge increase in ransomware and cryptolocker attacks. This is rapidly becoming one of the most significant threats to UK organisations.

 

The latest strain is known as Locky. The most common way that a Locky virus will arrive is by email. You may well receive an email containing an attachment with varying filenames.

If you open this it will look like gobbledegook at which point you will possibly be prompted to enable macros if the data encoding is incorrect. If you enable macros, you don’t actually correct the text and instead you allow the virus to run.

 

Locky scrambles all files that match a long list of extensions, including videos, images, source code, and Office files making your data completely unreadable!

You are then held to ransom and asked to pay a fee to retrieve your data.

 

So how can you protect against this type of attack?

  • Backup regularly – keep a recent backup copy off-site/disconnected from your network.
  • Don’t enable macros in document attachments received via email.
  • Ensure you have robust up to date antivirus protection in place.
  • Be cautious about unsolicited attachments. Generally delete any email or attachment you are not expecting to receive.

 

Unsure what to do next? Contact us to discuss how we can help protect your systems.