IT Support and Hardware for Clinics
31.3K views | +4 today
Follow
IT Support and Hardware for Clinics
News, Information and Updates on Hardware and IT Tools to help improve your Medical practice
Your new post is loading...
Your new post is loading...
Scoop.it!

Apple Malware Outbreak: Infected App Count Grows

Apple Malware Outbreak: Infected App Count Grows | IT Support and Hardware for Clinics | Scoop.it

The number of apps infected in the first large-scale Apple App Store malware outbreak is far higher than was first believed, according to the cybersecurity firm FireEye, which reports that at least 4,000 apps were infected with XcodeGhost malware.


In the wake of the discovery of a six-month malware campaign last week, early estimates were that dozens of apps had been infected with the XcodeGhost malware, which could be used by attackers to steal data from devices, including users' Apple passwords, as well as launch phishing attacks.


But FireEye now reports that the number of infected iOS apps is far higher than researchers initially suspected. "Immediately after learning of XcodeGhost, FireEye Labs identified more than 4,000 infected apps on the App Store," the company says in a Sept. 22 blog post.

Apple did not respond to a request for comment on that report and has so far declined to respond to questions about how many apps may have been infected.


FireEye has not released a full list of all infected apps, but spokeswoman Darshna Kamani tells Information Security Media Group that most of them are aimed at Chinese-language users. Previous reports, meanwhile, had warned that such popular apps as the WeChat messaging app and the Didi ride-hailing app were infected, and that infected apps were used not just by Chinese users, but globally.


The malware attack was perpetrated by attackers offering for download a pirated version of Apple's free Xcode software - which is used to build iOS and Mac OS X applications - that added malware to every app when it was compiled. An anonymous developer has claimed credit for the attack campaign, saying it was a "mistaken experiment," although numerous security experts have dismissed that claim.

Apple Squashes Bad Apps

Apple says that it has seen no evidence that any personal information was compromised. The company says it has been excising all apps that were built using a malicious version of Xcode and working with developers to ensure that they only use the official Xcode tool.

"We have no information to suggest that the malware has been used to do anything malicious or that this exploit would have delivered any personally identifiable information had it been used," Apple says in an XcodeGhost FAQ. "We're not aware of personally identifiable customer data being impacted and the code also did not have the ability to request customer credentials to gain iCloud and other service passwords. ... Malicious code could only have been able to deliver some general information such as the apps and general system information."


But other security firms have warned that the malware could have been used for malicious purposes. "XcodeGhost is reported to be the first instance of the iOS App Store distributing a large number of trojanized apps," FireEye says. "The malicious apps steal device and user information and send stolen data to a command and control server. These apps also accept remote commands, including the ability to open URLs sent by the [C&C] server. These URLs can be phishing webpages for stealing credentials, or a link to an enterprise-signed malicious app that can be installed on non-jailbroken devices."

Chinese social media and gaming giant - and WeChat developer - TenCent published a report on Sept. 20 warning that the malware could be used to remotely control devices and launch man-in-the-middle attacks against users. It also found that at least 76 of the top 5,000 apps in Apple's China app store were infected with XcodeGhost.

In its XcodeGhost FAQ, Apple has listed the top 25 most popular infected apps - which include WeChat, Didi, Railroad 12306, Baidu Music and NetEase Music - noting that "after the top 25 impacted apps, the number of impacted users drops significantly." It has also promised to make it easier - and quicker - for Chinese developers to download Xcode, because the difficulty of obtaining the official software reportedly drove developers to obtain it from non-official sources.


China is a massive and growing market for Apple, accounting for $13.2 billion in revenue in its last financial quarter, compared to $20.2 billion in the United States and $10.3 billion in Europe. In January 2014, Apple reported that Chinese developers had already launched 130,000 apps via Apple's app store.


Before this malware attack, only five malicious apps had ever successfully made it into the App Store, according to cybersecurity firm Palo Alto Networks.

Timeline: XcodeGhost Discovery

On Sept. 14, China's Computer Emergency Response Team issued a warning about the danger of using unofficial versions of Xcode. Just days later, Chinese researchers began reporting that at least a handful of apps had been infected with XcodeGhost malware, after which the count of infected apps has continued to skyrocket.


On Sept. 20, the XcodeGhost-Author account-holder on China's Weibo social media platform claimed credit for the malware campaign, saying the ability to trojanize the Xcode software had been an "accidental discovery," and that it had been distributed as "a one-time, mistaken experiment" to see if it could be used to push advertisements to infected devices, The Wall Street Journal reports.


The message claimed that the capability had never been exploited and noted that the malware was only ever designed to collect basic user and device data. "And 10 days ago, I actively shut down the server and deleted all the data, so it will not have any effect on anyone," it said.

While it is impossible to verify those claims, many security experts have dismissed them, saying the attacker's intentions were obviously nefarious. "The entire process was plotted and planned," mobile Internet security expert Lin Wei told China Central Television, pointing to a campaign that used multiple Internet accounts to make the software available - via multiple websites - over a six-month period, The Wall Street Journal reports.

Recommendation: Uninstall Apps

Pending updates from every developer that shipped an infected app, information security experts recommend that users uninstall all apps that were known to be infected. "Developers are releasing updated, clean versions of their apps. The best fix, if one of your apps is listed, is to uninstall it," says Lee Neely, a senior IT and security professional at the U.S. Department of Energy's Lawrence Livermore National Laboratory, in a recent SANS Institute newsletter.


Neely says that both iOS developers and Apple are to blame for the XcodeGhost malware outbreak. "This malware made it into the Apple App store due to social engineering of developers and a shortfall of Apple's code review process," he says. "When you own the compiler/IDE [integrated code environment], you own the apps created with it."

more...
No comment yet.
Scoop.it!

Netflix Is Dumping Anti-Virus, Presages Death Of An Industry

Netflix Is Dumping Anti-Virus, Presages Death Of An Industry | IT Support and Hardware for Clinics | Scoop.it

For years, nails have been hammering down on the coffin of anti-virus. But none have really put the beast to bed. An industry founded in the 1980s, a time when John McAfee was known as a pioneer rather than a tequila-downing rascal, has survived despite the rise of umpteen firms who claim to offer services that eradicate the need for anti-virus.

Now, however, movie streaming titan Netflix NFLX +7.34% is hammering a rather significant nail in that old coffin, one that could well lead to the industry’s final interment. Because Netflix, a well-known innovator in the tech sphere, is the first major web firm to openly dump its anti-virus, FORBES has learned. And where Netflix goes, others often follow; just look at the massive uptick of public cloud usage in recent years, following the company’s major investment in Amazon Web Services.


Let’s take a second to look at the decline of the anti-virus industry. Anti-virus has been the first line of defence for many firms over the last quarter of a century. Generally speaking, AV relies on malware signatures and behavioural analysis to uncover threats to people’s PCs and smartphones. But in the last 10 years, research has indicated AV is rarely successful in detecting smart malware. In 2014, Lastline Labs discovered only 51 per cent of AV scanners were able to detect new malware samples.

Despite its shortcomings, many are still required to keep hold of their AV product because they’re required to by compliance laws, in particular PCI DSS, the regulation covering payment card protections. There’s also the argument that AV is necessary to pick up the “background noise”, as Quocirca analyst Bob Tarzey describes it. “Despite more and more targeted attacks, random viruses are still rife and traditional AV is still good at dealing with these,” he claims. Major players, includingSymantec SYMC +5.00% and Kaspersky, continue to make significant sums, even if results aren’t stellar.


But it’s now possible to dump anti-virus altogether, and Netflix is about to prove it. The firm has found a vendor that covers those compliance demands in the form of SentinelOne. As SentinelOne CEO Tomer Weingarten told me, his firm was given third-party certification from the independent AV-TEST Institute, validating it can do just what anti-virus does in terms of protecting against known threats, whilst providing “an additional new layer of advanced threat protection”. Its end-point security doesn’t rely on signatures, it monitors every process on a device to check for irregularities and does not perform on-system scans or require massive updates like anti-virus, Weingarten said.


“Large enterprises are recognizing that anti-virus is not adding a lot of value to their security posture. Instead of just bolting on more and more layers, companies are looking for ways to reuse their anti-virus budget to achieve better security,” he added.


And that’s what Netflix has done. “It was three years ago we were doing a re-evaluation of anti-virus and out evaluation said that anti-virus is dead, so we’ve been trumpeting that for years,” Rob Fry, Netflix senior security architect, told FORBES. “The problem was there wasn’t really a replacement at the time. Fast-forward three years and now there’s next-generation everything. Then the next question is: how mature are they?


“The direction we decided to go was with a company called SentinelOne, who we’ve been working with for year and a half. They were a true replacement for end-point protection.

“We’re in the process of leaving anti-virus. We did not renew our anti-virus contract this year.”


He complained of poor support from his anti-virus provider, whom he chose not to name, noting Netflix simply “chose the one that sucked the least”. “The AV piece wasn’t even the most valuable thing, it was the URL filtering,” he added, referring to the blocking of malicious websites Netflix staff were visiting whilst on the corporate network.

For any CISOs out there, they’ll need some more convincing that SentinelOne really can do the job of finding low and high-grade malware. Aside from the AV-TEST Institute certification, there’s little in the way of third-party analysis of the company’s kit.


Skeptics on the death of anti-virus will have their voices heard too. “I don’t believe the era of anti-virus software is dead but that we need to evolve the technologies and other defences we use to properly address the variety and sophistication of the threats we face,” noted Brian Honan, security consultant.


But Netflix is unlikely to listen to naysayers. And it isn’t taking it easy on so-called “next-generation” kit either. In recent years, it decided to ditch FireEye, considered a major player in the post-AV anti-malware game. That’s not because of the quality of protection the firm offers, however, but the lack of application programming interfaces (APIs), Fry said.


APIs allow Netflix to hook up its various security systems so they worked concomitantly and could feed on each others’ data to provide more advanced security. When Fry goes looking for fresh vendors, there are two musts: a cloud strategy and APIs. As FireEye wasn’t willing to provide them at the time, Netflix moved over to ProtectWise, another advanced attack detection company, he told FORBES.

A FireEye spokesperson noted that since early 2014 FireEye has had a “rich, secure, documented and formally supported” API across the majority of its products. “These APIs are used by a broad selection of end-customers, reseller/managed service and technology integration partners,” they added.


What’s apparent with the spate of major cyberattacks seen this year, from Ashley Madison to Hacking Team TISI +% and theUS government, the world’s biggest firms are demanding more from the companies that have tried and failed to adequately protect them

more...
No comment yet.
Scoop.it!

Classic Shell and Start10 banish Windows 10 Live Tiles, bring back Windows 7 look

Classic Shell and Start10 banish Windows 10 Live Tiles, bring back Windows 7 look | IT Support and Hardware for Clinics | Scoop.it

For anyone having regrets about upgrading to Windows 10, there are now two good options for bringing back the look of Windows 7.

This week, Classic Shell officially added Windows 10 to support for its free Start menu and File Explorer replacement. With this program (pictured above), users can switch to Windows 7’s dual-column view, with pinned and recent applications on the left, and common folders and locations on the right. Classic Shell also includes a classic version of the Windows File Explorer, with a customizable toolbar and a more useful status bar that shows both free disk space and the size of any selected folder.


Meanwhile, Stardock has just released Start10 out of beta for $5. Much like Classic Shell, Start10 allows for a two-column view that resembles the Windows 7 Start menu, and brings back the ”all programs” menu that groups applications into folders. There’s also an option to hide Cortana from the Windows 10 taskbar, while restoring program and file search in the Start menu proper.



I gave each of these programs a quick go-round, and in practice the differences between them are subtle. If you’re just looking for the familiarity of Windows 7, either one should do the trick (though Classic Shell has the advantage of costing nothing). Start10 may be more useful for people who still want access to Windows Store apps, as you can preserve them in the right-hand column while tweaking other aspects of the Start menu. Both apps have plenty of customization options, however, and are far more flexible than the default Start menu.


While Classic Shell is free, Start10 does offer a 30-day free trial, so you can try them both to figure out which Start menu replacement suits your needs.


Why this matters: Although Microsoft has dialed back some of the radical changes that it made to the Start menu in Windows 8, it can still feel pretty unfamiliar coming from Windows 7. If you’re not really using Windows Store apps, the emphasis on Live Tiles in Windows 10 isn’t much help, especially since it comes at the expense of Jump Lists, quick Control Panel access and the old Recent Items shortcut. It’s unlikely that these replacements will see the tens of millions of downloads that they did with Windows 8, but they’re still helpful for people who’d rather keep things the way they used to be.

more...
Scoop.it!

What hospitals need to know about Windows 10

What hospitals need to know about Windows 10 | IT Support and Hardware for Clinics | Scoop.it

The arrival of a new Microsoft operating system does not exactly bring the same excitement that it once did.


Indeed, since about the time Windows Vista launched, subsequent operating systems have come – and in the odd case of Windows 9 essentially vanished – without the fanfare of Windows 95, XP or 2000.

The company has at least managed to create enough wattage around Windows 10, however, that some 5 million so-called Windows Insiders installed early versions to test the software in development – and word slipped out this week that the planned flagship Microsoft store on Fifth Avenue in Manhattan will open in the fall.


A critical piece of the renewed interest is how Microsoft is breaking new ground with a phased approach to what CEO Satya Nadella dubbed the "One Windows" strategy, beginning July 29 when the OS became available for PCs and tablets.


The aim is to upgrade systems currently running Windows 7 and 8 in the near-term and follow that with Windows 10 Mobile later this year, and devices from Microsoft’s harem of hardware partners are slated to become available before the holiday season. Beyond that, Microsoft intends Windows 10 to serve as the operating system for a range of Internet of Things devices, including its own Surface Hub conference systems and HoloLens holographic glasses, among others.


When that “One Windows” day comes, the sales pitch goes, hospitals will be able to consolidate varying devices onto Windows 10 and the fact that the upgrade is free for systems already running Windows 7, 8.1 or 8.1 Mobile should entice many IT shops to install it; for those still using an older OS, the price tag is $199 for the professional version.

Microsoft, in the meantime, has incorporated some healthcare-centric functionality into Windows 10.


On one of its web pages the company showed the operating system’s capability to “snap together” different applications and, in so doing, enable a clinician to view a patient’s EMR next to a home health app.

A Power BI function can "gather, analyze and visualize quality of care data," while the Power Map feature enables users to combine and compare a hospital's own information with population health statistics. Microsoft also pointed to programs including Office 365, OneNote, SharePoint and Skype that can be used for care management and information sharing.

Later this year, when Windows 10 Mobile becomes available, it will make syncing apps across smartphones, tablets and PCs easier. Now, that’s not likely to inspire CIOs to rip and replace existing smartphones anytime soon, but the ability to coordinate a Windows-based phone with a Surface tablet will invariably have some appeal to a select crowd.


That’s just a taste and Microsoft said that it will be showing more of Windows 10 health capabilities moving forward.


The new OS also brings many broader functions, such as the return of the old Start menu, the new Edge browser, Cortana virtual assistant, and the usual suspects of upgraded apps for mail. Maps, music, photos, and OneDrive to back them up.


Much like its competitors Apple, IBM, Google and Oracle, Microsoft has been ramping up efforts particular to healthcare lately. Earlier this month, for instance, when it unwrapped the Cortana Analytics Suite, Microsoft also revealed that Dartmouth-Hitchcock is already using the tools in a personalized medicine pilot project.


Whether Windows 10 will enjoy the widespread adoption of XP or languish like Vista remains to be seen. But at this point – and with Microsoft's marketing machine stating that the company is gunning to upgrade 1 billion devices to Windows 10  the former appears more likely than the latter. 


What's your perspective? Just another Microsoft OS or a great reason to upgrade?

more...
Scoop.it!

Adobe patches Flash zero-day found in Hacking Team data breach

Adobe patches Flash zero-day found in Hacking Team data breach | IT Support and Hardware for Clinics | Scoop.it

The massive Hacking Team data breach led to the release of 400GB worth of data including a zero-day vulnerability for Adobe Flash. Adobe has released an out-of-band patch for the flaw just two days after it was discovered.


The vulnerability was described by the Hacking Team in a readme file in the data dump as "the most beautiful Flash bug for the last four years". Accompanying the readme in the data was a proof-of-concept exploit of the flaw.


Adobe categorized the vulnerability (CVE-2015-5119) as critical and said it affects Flash Player versions 18.0.0.194 and earlier on Windows and Mac, and versions 11.2.202.468 and earlier on Linux. Successful exploitation of the flaw could allow remote code execution.


Security researcher Kafeine found that the vulnerability has already been added to the Angler, Fiddler, Nuclear and Neutrino exploit kits. Because of this, admins are recommended to apply the patch as soon as possible.


Also found in the Hacking Team data was another Adobe Flash zero-day (CVE-2015-0349), which was patched in April, and a zero-day affecting the Windows kernel. The inclusion of these zero-days has caused experts to question if these exploits are being used by Hacking Team clients, including law enforcement and governments.


"As many governments move to try and control malware and offensive security tools, some have been caught with their own hands in the cookie jar, leading many to wonder how and why governments and agencies listed as Hacking Team clients are using these tools and if they are doing so lawfully," said Ken Westin, security analyst for Tripwire. "Given the depth and amount of data compromised in this breach, it will reveal a great deal about the market for offensive tools designed for espionage with a great deal of fallout and embarrassment for some organizations."


Hacking Team spokesman Eric Rabe confirmed the breach and said that while law enforcement is investigating, the company suggests its clients suspend the use of its surveillance tools until it can be determined what exactly has been exposed.


In a new statement, Rabe warned that its software could be used by anyone because "sufficient code was released to permit anyone to deploy the software against any target of their choice.


"Before the attack, HackingTeam could control who had access to the technology that was sold exclusively to governments and government agencies," Rabe wrote. "Now, because of the work of criminals, that ability to control who uses the technology has been lost. Terrorists, extortionists and others can deploy this technology at will if they have the technical ability to do so. We believe this is an extremely dangerous situation."

more...
No comment yet.
Scoop.it!

This startup just raised $500 million from investors like Coca-Cola and Virgin to build a network of internet satellites

This startup just raised $500 million from investors like Coca-Cola and Virgin to build a network of internet satellites | IT Support and Hardware for Clinics | Scoop.it

A startup trying to bring internet access to even the most remote of places on Earth just raised a whopping $500 million from investors including Coca-Cola, Virgin Group, Airbus, and others.

OneWeb, which is a London-based company working to build a satellite network for global broadband connectivity, confirmed the gigantic Series A funding raise in a blog post Thursday.

OneWeb, in its press release, says that its purpose is to "develop key technologies to enable affordable broadband for rural and underdeveloped locations." 


The company added that it now plans to building a total of 900 "microsatellites" as part of a joint project with Airbus Defense and Space. It has also acquired 65 commercial rockets (the "largest commercial rocket acquisition") from both the French company Arianespace and Virgin Galactic. 

OneWeb isn’t the only project out there looking into global internet access. Google’s Project Loon, for instance, has been working to build a network connected by giant drifting balloons.

Facebook has also been looking into a similar project with Internet.org, although its been met with dissent due due to concerns with its lack of net neutrality. 


Elon Musk too has reportedly been looking into a global satellite internet project.

But now there's a third company hoping to bridge the connectivity gap and it has half a billion dollars to play around with.

OneWeb says that the plan is to formally launch its network by 2019.

more...
No comment yet.
Scoop.it!

Hack Attack Grounds Airplanes

Hack Attack Grounds Airplanes | IT Support and Hardware for Clinics | Scoop.it

Polish airline LOT claims that a hack attack disrupted the state-owned airline's ground-control computers, leaving it unable to issue flight plans and forcing it to cancel or delay flights, grounding 1,400 passengers.


The airline said the June 21 cyber-attack against its IT systems at Warsaw Chopin airport lasted about five hours and affected the computers that it uses to issue flight plans. "As a result, we're not able to create flight plans and outbound flights from Warsaw are not able to depart," the company said in a statement.


But the airline emphasized that the attack had "no influence on plane systems" and that no in-progress flights were affected by the incident. It also said that all flights bound for Warsaw were still able to land safely. The IT disruption did, however, result in the airline having to cancel 10 flights - destined for locations inside Poland, to multiple locations in Germany, as well as to Brussels, Copenhagen and Stockholm - and then delay 12 more flights.


An airline spokeswoman didn't immediately respond to a request for more information about the disruption, how LOT judged it to be a hack attack or who might be responsible. No group or individual appears to have taken credit for the disruption.


Airline spokesman Adrian Kubicki says that Polish law enforcement agencies are investigating the hack and warned that other airlines might be at risk from similar types of attacks. "We're using state-of-the-art computer systems, so this could potentially be a threat to others in the industry."

Follows Plane Hacking Report

It's been a busy year for airline-related hacking reports.

In May, information security expert Chris Roberts claimed to have exploited vulnerabilities in airplanes' onboard entertainment systems more than a dozen times in recent years, allowing him to access flight controls. Roberts claimed that his repeated warnings about the problems to manufacturers and aviation officials had resulted in no apparent fixes being put in place.

Question: Hack or IT Error?

Despite the presence of vulnerabilities in avionics systems, however, airline-related IT disruptions are often caused by internal problems, and some security experts are questioning whether that might be the case with the supposed cyber-attack against LOT. "The story doesn't make sense, and most of the actual info so far suggests a 'glitch' caused by an unauthorized user," says the Bangkok-based security expert who calls himself the Grugq, via Twitter.


On June 2, for example, a computer glitch grounded almost 150 United Airlines flights in the United States, representing about 8 percent of the company's planned morning flights. The airline blamed the problem on "dispatching information," and some fliers - such as software firm Cloudstitch CTO Ted Benson - reported via Twitter that pilots told passengers that the ground computers appeared to be spitting out fake flight plans.


As a result of the glitch, the Federal Aviation Administration reportedly grounded all United flights for 40 minutes, until related problems were corrected.

United Airlines Bug Bounty

That glitch followed United Airlines in May launching a bug bounty program - not for the software that runs its airplanes, in-flight entertainment systems, or ground-control computers, but rather its website. "If you think you have discovered a potential security bug that affects our websites, apps and/or online portals, please let us know. If the submission meets our requirements, we'll gladly reward you for your time and effort," United says on the bug bounty page.


Rather than offering cash rewards like many other bug-bounty programs, however, United is instead offering frequent-flier "award" miles - for example 50,000 miles for cross-site scripting attacks, 250,000 for authentication bypass attacks, and 1,000,000 for a remote-code execution attack.

more...
No comment yet.
Scoop.it!

Amazon Is Developing an Uber-Style Service for Package Delivery

Amazon Is Developing an Uber-Style Service for Package Delivery | IT Support and Hardware for Clinics | Scoop.it

Like Uber, but for delivering Amazon packages? In its ongoing effort to get packages to consumers as quickly as possible, Amazon may soon employ an Uber-like app that uses ordinary people as delivery drivers.

The Wall Street Journal reports that the plan is known as “On My Way” and would involve using urban retail stores as pseudo-distribution centers. Traditional delivery services would presumably drop off packages to rented storefronts where Amazon has temporarily leased space. From there, amateur drivers would pick up the packages and deliver them to their final destination.

Amazon declined to comment to the WSJ, but there’s already concern about how this would work in our new trust-based contractor economy. The expert that the Wall Street Journaltalked to asked, “What’s to stop these people from simply taking the packages for themselves instead of leaving it on someone’s porch?”

Well, the same things that would stop anyone at any job from stealing all of their employer’s goods. But yes, one can imagine that some people will try to scam the system. Just as there remain questions about how companies like Uber vet drivers through background checks, one imagines that this would become a minor question for Amazon’s efforts as well.

But if this delivery method ever became the norm you can expect that fewer people would begin to worry about the packages and more about the labor issues involved. Amazon has made a concerted effort in recent years to make same-day delivery the norm. And in so doing it has relied heavily on farming a lot of its work out to contractors at its new distribution facilities.

Interestingly, the WSJ notes that the way that delivery drivers would get paid hasn’t been completely figured out yet. One would imagine American currency would be preferred but apparently Amazon is toying with the idea that drivers would be paid in credit good at Amazon. Should the latter occur, we should probably take it as a sign that AmazonBucks could become our national currency any day now.

more...
No comment yet.
Scoop.it!

Apple is making it harder to steal the Apple Watch

t didn't make it into today's WWDC keynote address, but Apple is adding an important security feature to watchOS 2. The new version of the wearable OS will bring Activation Lock — a feature that has been on iPhones since 2013 — to the Apple Watch.


Activation Lock is an anti-theft measure that makes stolen devices less attractive to potential thieves. If someone were to steal your device and wipe it (something that can be done on a Watch in just a few taps), Activation Lock won't let the device be reactivated without first inputting the Apple ID and password that was originally used to set it up. It may not stop someone from stealing and selling your Watch for parts, and there's still no comparable feature to "Find my iPhone," but Activation Lock is a start.


IT'S NO FIND MY IPHONE, BUT IT'S A START

Just last month, users grew worried after9to5Mac pointed out how easy it is to wipe the settings, data, and passcode from an Apple Watch. From there, someone could pair a Watch to any new iPhone. In the user guide, Apple frames this as a way to restore your Watch's functionality should you forget your passcode, which is convenient. But for many people the function made it far too easy for someone else to wind up using your Watch as their own.


Users will have the choice to enable Activation Lock on their Watch or not, so it's ultimately up to them. The watchOS 2 developer beta is available today, and the final version will be released this fall.

more...
No comment yet.
Scoop.it!

President Obama calls for stronger American cybersecurity

President Obama calls for stronger American cybersecurity | IT Support and Hardware for Clinics | Scoop.it

Citing a series of embarrassinghigh profile incursions against US computer networks in recent months, President Obama called for "much more aggressive" efforts to shore up the government's vulnerable cyber-infrastructure. "This problem is not going to go away," the President told reporters at a G7 press conference in Germany. "It is going to accelerate. And that means that we have to be as nimble, as aggressive and as well-resourced as those who are trying to break into these systems." As such, he urged Congress to pass its pending cybersecurity legislation, such as the Cybersecurity Information Sharing Act of 2015.

more...
No comment yet.
Scoop.it!

When Windows 10 arrives, will your files and apps survive?

When Windows 10 arrives, will your files and apps survive? | IT Support and Hardware for Clinics | Scoop.it
You may run into some compatibility bumps if you upgrade to Windows 10. screenshot by Lance Whitney/CNET

Set to debut July 29, Windows 10 will be free for one year for anyone running Windows 7 or Windows 8.1. And it will be a direct upgrade, meaning you can run the Windows 10 installation in Windows 7 or 8.1, and you should end up with Windows 10 in the end.

Windows 10 marks Microsoft's big push to get itself back on course after the miscues of Windows 8, so every little thing counts -- including getting the installation correct right off the bat.

Not all software upgrades go smoothly, however. Compatibility problems sometimes rear up, especially when you upgrade from one operating system to another. Certain hardware may be not compatible. Certain software programs may not be supported or may need to be updated or reinstalled. How will you know if the hardware and software you run in Windows 7 or 8.1 will still work after the upgrade? Microsoft can help you determine if and how your PC or tablet will handle the move to Windows 10.

Check for compatibility issues

First, those of you running Windows 7 or Windows 8.1 should see a Windows 10 icon in the Windows system tray. This icon debuted June 1 to coax you to reserve your free copy of Windows 10 so that come July 29, the installation package is automatically downloaded to your PC. But whether or not you've made the reservation, you can still check your PC to see which hardware and software may not play ball with Windows 10.

Click the Get Windows 10 icon. In the Windows 10 upgrade window, click the icon with the three horizontal bars, aka the hamburger icon. From the left pane that appears, click the link to Check your PC.

A Compatibility Report opens to tell you if Windows 10 will work on this PC. You'll also probably see a list of any hardware and software that may not be fully compatible or may not work with Windows 10. For example, on my Lenovo laptop, the report told me that Bluetooth audio might not work correctly after the upgrade, that Norton Internet Security won't work and that I would need to reinstall VMware Player and Lenovo Messenger.

If you find a lot of compatibility issues, don't panic. Remember that Windows 10 is still in beta mode with a release date of July 29 before the final product is out. That gives Microsoft and third-party vendors almost two months to smooth out compatibility issues and resolve any potential bugs. And even when July 29 arrives, you may want to hold off on upgrading to Windows 10 right away. You do have a year to snag the free upgrade. Wait a few weeks or a month after the OS debuts, and some of those compatibility problems may get ironed out.

Check Microsoft's information

You'll also want to check the details on Windows 10 via Microsoft'sWindows 10 Specifications page. The Important Notes section on this page explains which items should make the leap to Windows 10 and which ones may not.

The good news is that your documents and personal files should all handle the transition to Windows 10 without any problems. Still, you may want to back up all of your personal files to an external drive or other source just to be on the safe side. Your Windows apps and settings should also remain intact following the upgrade. But Microsoft cautions that some applications or settings may not migrate.

As the company explains it:

The upgradeability of a device has factors beyond the system specification. This includes driver and firmware support, application compatibility, and feature support, regardless of whether or not the device meets the minimum system specification for Windows 10.


For example, third-party antivirus and anti-malware applications will be uninstalled during the upgrade and then reinstalled with the latest version after the upgrade is finished, according to Microsoft. That process assumes your subscription to the antivirus product is still valid. If not, then Microsoft's Windows Defender will be enabled instead. The Compatibility Report that I received told me that Norton Internet Security would not work, so presumably Windows 10 would install an updated version of Norton that does work.

Certain applications installed by your PC or tablet maker may need to be removed before the upgrade. My Lenovo laptop contains a suite of applications specific to Lenovo. The Compatibility Report told me that Lenovo Messenger would need to be reinstalled.

Any applications with Windows 10 compatibility issues will be removed before the upgrade. Therefore, you'll want to note the names of any such applications and check to see if new or updated versions are available that you can install after Windows 10 is in place.
 

Based on the latest Windows 10 Technical Preview builds, Microsoft seems to have addressed most of the gripes about Windows 8 and created an OS that seems fresher and decidedly more user-friendly. So as long as you can work through any compatibility issues, upgrading from Windows 8.1 and even from Windows 7 should be worth the effort.

more...
No comment yet.
Scoop.it!

Five Steps to Secure Your Data After I.R.S. Breach

Five Steps to Secure Your Data After I.R.S. Breach | IT Support and Hardware for Clinics | Scoop.it

The Internal Revenue Service has been added to a long list of companies and government agencies that hackers have breached in the last year.

And so, if there is any advice security experts have for those trying to keep their personal information safe, it is simply: You can’t.

“Your information has already been out there for years, available to anyone who wants to pay a couple dollars,” Brian Krebs, a security blogger who has been a frequent target of hackers, said Wednesday.

The attack on the I.R.S. is just the latest evidence that hackers already have all the information necessary to steal your identity. The agency said Tuesday that hackers used information stolen from previous breaches — including Social Securitynumbers, birth dates, street addresses and passwords — to complete a multistep authentication process and 


But consumers can make things harder for criminals. There may be a trade-off in convenience, but experts say the alternative is a lot worse.

1. Turn on multifactor authentication.

If a service offers added security features like multifactor authentication, turn them on. When you enter your password, you will receive a message, usually via text, with a one-time code that you must enter before you can log in.

Most banking sites and popular sites like Google, Apple, Twitter and Facebook offer two-factor authentication, and will ask for a second one-time code anytime you log in from a new computer.

2. Change your passwords again.

Yes, you need to change passwords again and they have to be passwords you have never used before. They need to be long and not words you would find in a dictionary. The first thing hackers do when trying to break into a site is use computer programs that can test every word in the dictionary.

Password managers like LastPass or Password Safe create long, unique passwords for the websites you visit and store them in a database that is protected by a master password you have memorized.

It may sound counterintuitive, but the truly paranoid write down their passwords.

Security experts advise creating anagrams based on song lyrics, movie quotations or sayings, and using symbols or numbers and alternating lower and upper cases to make the password more difficult. For instance, the “Casablanca” movie quotation “Of all the gin joints, in all the towns, in all the world, she walks into mine” becomes OaTgJ,iAtT,iAtW,sWiM.

Use stronger, longer passwords for sites that contain the most critical information, like bank or email accounts.

3. Forget about security questions.

Sites will often use security questions such as “What was the name of your first school?” or “What is your mother’s maiden name?” to recover a user’s account if the password is forgotten.

These questions are problematic because the Internet has made public record searches a snap and the answers are usually easy to guess.

In a recent study, security researchers at Google found that with a single guess, an attacker would have a 19.7 percent chance of duplicating an English-speaking user’s answer to the question, “What is your favorite food?” (It was pizza.)

With 10 tries, an attacker would have a 39 percent chance of guessing a Korean-speaking user’s answer to the question, “What is your city of birth?” and a 43 percent chance of guessing the favorite food.

Jonathan Zdziarski, a computer forensics expert, said he often answers these questions with an alternate password. If a site offers only multiple choice answers, or only requires short passwords, he won’t use it.

“You can tell a lot about the security of a site just by looking at the questions they’ll ask you,” he said.

4. Monitor your credit.

Typically a service will offer one year of free credit monitoring if it has been breached. But be aware that attackers do not dispose of your Social Security number, birth date or password a year after they acquire it.

It is better to monitor your credit aggressively at all times through free services like AnnualCreditReport.com.

5. Freeze your credit.

In the attack at the I.R.S., a credit freeze may not have thwarted thieves from filing for false tax refunds, but it could have stopped them from pulling tax transcripts or opening other accounts.

To freeze your credit, call Equifax, Experian or TransUnion and ask to have your account frozen. The credit agency will mail a one-time PIN or password to unfreeze your account later.

The fee to freeze and refreeze credit varies by state. If you plan on applying for a new job, renting an apartment or buying insurance, you will have to thaw a freeze temporarily and pay a fee to refreeze the account.

But if you have been a victim of identity theft, and can show a police report proving as much, most states will waive the freeze fee.


Via Paulo Félix
more...
No comment yet.
Scoop.it!

Samsung proposes an Android phone that transforms into a Windows laptop

Samsung has been thinking up new ways to transform smartphones into laptops. In a patent application filed last week, first spotted by Patently Mobile, Samsung describes a mobile device that runs Android and is able to switch over to Windows when inserted into a dock. Individually, these ideas aren't new — dual-OS devices and docking smartphones have been tried a number of times over the past several years — but they haven't been put together in a particularly straightforward way. Of course, this is only a patent application, so there's no guarantee that Samsung will actually make it.


IMAGINE HOW SICK THIS THING WOULD BE RUNNING TIZEN AND LINUX


Even so, Samsung actually goes into quite a bit of detail on how such a device would work. The core would be a smartphone or a tablet, which would hold everything needed to run both Android and Windows. The dock would have a keyboard, a large display, and possibly a trackpad. Those final two items are where it gets interesting. The dock may not need a trackpad because the smartphone's touchscreen could be used instead (given the state of Windows trackpads, this could even be a benefit). Alternatively, if the dock includes a trackpad, the smartphone could be used as a second display. Samsung proposes that it could display Android at the same time that the dock displays Windows, or that it could be an extension of the Windows desktop.



The patent application notes that other operating systems could be used in place of Windows and Android, but those are the two that it focuses on. That's not really a surprise: they're the dominant mobile and desktop operating systems, and Samsung has even played around with transitioning between the two of them before. In 2013, it introduced the Ativ Q, which could switch between functioning as a Windows notebook and an Android tablet. Of course, making both form factors actually good to use is difficult, especially when all of their power is coming from a mobile device. Still, the idea that a single device could eventually serve as the core of all our computing isn't unreasonable, and it's clearly something that Samsung is thinking about.

more...
No comment yet.
Scoop.it!

FBI Alert: Business Email Scam Losses Exceed $1.2 Billion

FBI Alert: Business Email Scam Losses Exceed $1.2 Billion | IT Support and Hardware for Clinics | Scoop.it

The FBI, in a new alert, estimates that fraud losses linked to so-called business email compromise scams worldwide totaled more than $1.2 billion from October 2013 to August 2015. But some financial fraud experts say the losses from this largely overlooked threat could be even higher because the incidents often are not reported.


David Pollino, bank fraud prevention officer at Bank of the West, who calls these scams "masquerading" schemes, has warned of upticks in this type of wire fraud since January 2014.


In May, he predicted that losses linked to masquerading, or business email compromise attacks, in 2015 alone would exceed $1 billion. "This is a global fraud trend," he said.


In a white paper Bank of the West recently posted about this fraud trend, Pollino notes that masquerading attacks are among the top three fraud threats facing small businesses today.


"Masquerading is a payments scheme in which a fraudster impersonates a company executive or outside vendor and requests a wire transfer through a phone call or email to a company controller, or someone else with authority to wire funds," Pollino writes. "The controller will usually tell the business' bank to wire the funds because the email or phone call seems legitimate."


Fraudsters' social-engineering methods include sending these bogus requests to accounting departments with a sense of urgency, Pollino notes. To speed up payments, the fraudsters often ask the bank or credit union to bypass the normal out-of-band authentication and transaction verification processes in place for wires, especially those being sent to overseas accounts, he says.


"For the third consecutive year, three in five companies were targets of payments fraud," which includes BEC scams, Pollino points out, quoting statistics in the Association for Financial Professionals' 2015 Payments Fraud and Control Survey.


To mitigate risks associated with these scams, Pollino recommends that businesses:


  • Develop an approval process for high-dollar wire transfers;
  • Use a purchase order model for wire transfers, to ensure that all transfers have an order reference number that can be verified before approval;
  • Confirm and reconfirm transfers through out-of-band channels, such as a confirmation emails or SMS/texts; and
  • Notify the banking institution if a request for a transfer seems suspicious or out-of-the-norm.
FBI Alert

In its Aug. 27 alert, the FBI notes that most of the companies that have fallen victim to BEC scams have been asked to send urgent wires to foreign bank accounts, most of which are based in China and Hong Kong.


"The BEC scam continues to grow and evolve and it targets businesses of all sizes," the FBI notes. "There has been a 270 percent increase in identified victims and exposed loss since January 2015. The scam has been reported in all 50 states and in 79 countries."

From October 2013 through August 2015, the FBI estimates that some 7,066 U.S. businesses and 1,113 international businesses fell victim to this socially engineered scheme.

Quantifying Losses a Challenge

But quantifying losses from BEC scams has proven challenging because many of the incidents are not reported.


"Certainly these losses are understated, because many companies are not reporting them to the FBI due to embarrassment, lack of knowledge of where to turn, or the realization that there is no chance of retrieving their funds," says financial fraud expert Shirley Inscoe, an analyst at consultancy Aite. "So much money is being stolen through this scam that it is only going to continue, costing businesses billions of dollars."


In an effort to curb losses associated with these socially engineered schemes, Inscoe says financial institutions must educate their commercial customers about how these types of attacks are waged.


And she contends that the Asian banks to which these fraudulent wires are being sent should be held accountable. "Clearly, these banks are assisting in laundering these ill-gotten gains," she says. "An appeal could be made to their regulators to crack down on them from amoney-laundering perspective, but I have no idea how receptive the regulators would be to that avenue of action."


Dave Jevans, co-founder of the Anti-Phishing Working Group and chief technology officer of mobile security firm Marble Security, says federal law enforcement agencies have been strengthening their relationships with agencies in Asian markets to help curb some of this fraud.


"They can always work more closely with the financial institutions in these regions to monitor activity. However, it is really up to the originating companies and their U.S. financial institutions to solve this problem," he says. "Law enforcement is about investigating and arresting criminals. They are not a regulatory agency, nor are they a fraud-detection agency."

Preventive Measures

Jevans argues that the solution to the BEC problem is ensuring that businesses have stronger internal controls and targeted attack prevention on their email systems. "Banks can help their customers get educated, and can strengthen their validation processes and requirements when funds are being requested to be sent to new, untrusted accounts," he says. "Only focusing on overseas accounts won't solve the problem, and many of the smaller BEC frauds are routed through money mule accounts here in the USA."


Tom Kellermann, chief cybersecurity officer at the security firm Trend Micro, says businesses have to understand that bypassing banks' procedures for wire-transfer confirmation is exposing them to fraud.

"Internal procedures should change to ensure that all requests for the transfer of funds be verified," Kellermann says.


Kellermann says businesses' employees should be trained to carefully examine the URLs from which emails are sent. Spoofed email addresses, for instance, will be slightly different yet resemble legitimate email addresses. And he says all external wire transfers should be required to have some type of out-of-band confirmation, through a secondary email, phone call or SMS/text, before they are approved and scheduled.


Stronger email authentication and adoption of DMARC, the Domain-based Message Authentication, Reporting & Conformance initiative, could have a big impact on reducing fraud losses related to BEC, Kellerman contends.


Fraud expert Avivah Litan, an analyst at the consultancy Gartner, says identify-proofing technology, which requires that an online account user provide a headshot or picture of a driver's license captured with a mobile phone, could make a difference.


More banking institutions are exploring identity-proofing to authenticate new-account customers, Litan says, by employing the same technology they use for the remote-deposit capture of check images from smart phones and PC scanners.


"Perhaps this technology for identity proofing and documents transfer [such as check images] can be rolled out to the customer sites," she says. "Now you start asking the person requesting the wire to prove who they are by saying, 'Sorry, CEO, but before I act on your instructions, I need to see your driver's license.'"

more...
Scoop.it!

We just learned more about Samsung's big competitor to Apple Pay

We just learned more about Samsung's big competitor to Apple Pay | IT Support and Hardware for Clinics | Scoop.it

Samsung announced its new mobile payments system months ago, but we just got our first look at how it actually works.

Samsung Pay will be available in the United States starting in September after first launching in South Korea this month.


Samsung's payment system is different than Apple's in one crucial way — it works at standard mobile payment terminals with magnetic stripe readers and NFC terminals. This means you can use Samsung Pay anywhere you can use a credit card, while you can only use Apple Pay and other payment solutions such as Google Wallet at retailers that have NFC terminals.


We've known about this for a while, but Samsung has just told us more about how you'll actually use the service when it launches. If you have Samsung Pay all set up, you can swipe up on the lock screen to select which card you want to pay with, as shown to the right.


This works even if your phone is asleep, so you don't have to turn on the display to start a payment transaction. From there, you can choose to authenticate your purchase by typing in a PIN or by pressing your fingerprint on the home button. Samsung also says its Knox software is integrated into Samsung Pay, which adds real-time hacking surveillance and encryption to the service.


Since Samsung Pay is compatible with both NFC and magnetic stripe terminals, your phone automatically decides to choose one or the other when you're making a purchase. 

more...
No comment yet.
Scoop.it!

Samsung Touts Video Chops With Two More Big Screen Phones

Samsung Touts Video Chops With Two More Big Screen Phones | IT Support and Hardware for Clinics | Scoop.it

As expected (and amply leaked), Samsung has today whipped back the curtain on a pair of new flagship smartphones, announcing two new phablets: the Galaxy Note 5 (pictured above) and the Galaxy S6 Edge+ at press events in New York and London.


The focus for Samsung here is bigger handsets that can do more with multimedia content, letting the user make use of additional screen real-estate for video editing or livestreaming, or multitasking with multiple content windows on screen.


The Korean giant doesn’t normally drop flagship smartphones in August but is presumably hoping to hog the limelight by announcing new kit in what is typically a fallow month for tech news — before the hype cycle spins up again come September, when Apple typically unboxes new iPhones. (In the event, Chinese mobile maker Xiaomi stole a march on Samsung’s phablet new by announcing its own pair of newbies earlier today.)


Here’s a quick rundown of the new additions to Samsung’s handset Galaxy, which will be landing in some 7,000 retail stores in the U.S. for preview starting from tomorrow (but on sale globally later this month):


Galaxy Note 5


The Galaxy Note 5 is the sequel to the 5.7-inch display Note 4, which launched back in September 2014. The display remains the same size (and same quad-HD res), but RAM has been beefed up to 4GB.


The design has also been tweaked to be thinner and slimmer, with a narrower bezel and curved back. The rear camera is still 16MP, but there’s now 5MP on the front. Both are f1.9.


The S-Pen stylus has also had an update — with an “all new” design, and, says Samsung, improved writing capabilities (albeit it said that at the last Note update…), including the ability to jot down info even when the screen is off.


Users can also now annotate PDF files using the S-Pen, and capture a whole website from top to bottom using a Scroll Capture feature. And the pen is easier to extract from its kennel inside the Note, thanks to a “one click” extraction mechanism.


Available colorways for the Note 5 are “Black Sapphire” and “White Pearl”. There are 32GB and 64GB variants (but no microSD card slot — a factor that’s going to continue to grate on long-time Samsung fans).


Galaxy S6 Edge+


The Galaxy S6 Edge+ updates one of two new flagships Samsung unboxed back in March at the Mobile World Congress trade show — namely the S6 Edge.

The flagship feature of that handset was a screen with curved edges. Those curves spill over now to the S6 Edge+ but the overall size of the screen has also been increased to phablet size — so it’s been bumped up from 5.1 inches to 5.7 inches. As with the S6 Edge, the curved edges can be used as a shortcut from any screen to access top contacts and apps, by swiping along the edge.


As with the Note 5, RAM has also been increased to 4GB. And the rear camera is 16MP, with a 5MP lens on the front.


Available colorways for the S6 Edge+ are “Black Sapphire” and “Gold Platinum” (below). And there are also 32GB and 64GB variants (but again no microSD card slot).


 

Multimedia focus


Both devices sport improved video stabilization when shooting from the front or rear camera, according to Samsung.  There’s also a new video collage mode that allows users to shoot and edit short videos more easily, adding various frames and effects. And a 4K Video filming feature to record content for 4K TVs.


A full HD Live Broadcast option lets users instantly stream video straight from the phone to any individual, group of contacts, or through YouTube Live — a la live streaming apps like Meerkat and Periscope. While Samsung touts other camera and audio improvements such as a quick launch feature (by double clicking the home button from any screen to jump into the camera), and support for UHQA for richer audio quality.


Both handsets also support Samsung Pay — the company’s forthcoming NFC and magnetic secure transmission mobile payment tech which it’s lining up as an Apple Pay rival.


There’s also embedded wireless charging on both, but wireless charger pads aren’t included — so that’s an additional accessory you’d have to have or buy yourself.

more...
No comment yet.
Scoop.it!

More Retailers Hit by New Third-Party Breach?

More Retailers Hit by New Third-Party Breach? | IT Support and Hardware for Clinics | Scoop.it

CVS, Rite-Aid, Sam's Club, Walmart Canada and other large retail chains have suspended their online photo services following a suspected hack attack against a third-party service provider that may, in some cases, have resulted in the compromise of payment card data.


The suspected breach centers on PNI Digital Media Inc., a Vancouver-based firm that manages and hosts online photo services for numerous retailers. The incident serves as a reminder of the security challenges that organizations face when it comes to managing their third-party vendors and entrusting them with sensitive customer information.


Numerous chains have confirmed that they are investigating potential breaches - some involving payment card data - after being warned by PNI Digital Media that it may have suffered a hack attack that resulted in the compromise of retailers' customers' names, addresses, phone numbers, email addresses, photo account passwords and credit card information. But none of the retailers involved have so far reported that they believe the breach would affect any of their in-store customers, including anyone who used in-store photo services.


PNI Digital Media did not immediately respond to a request for comment on its reported breach investigation. Until July 17, the company's investors page reported that it worked with numerous retailers, and while that page is now blank, a recent version cached by Google's search engine reads: "PNI Digital Media provides a proprietary transactional software platform that is used by leading retailers such as Costco, Walmart Canada, and CVS/pharmacy to sell millions of personalized products every year. Last year, the PNI Digital Media platform worked with over 19,000 retail locations and 8,000 kiosks to generate more than 18M transactions for personalized products."

CVS Confirms Investigation

On July 17, CVS spokesman Mike DeAngelis confirmed that CVSPhoto.com may have been affected by the suspected PNI Digital Media breach. "We disabled the site as a matter of precaution while this matter is being investigated," DeAngelis tells Information Security Media Group.


The cvsphoto.com site now reads in part: "We have been made aware that customer credit card information collected by the independent vendor who manages and hosts CVSPhoto.com may have been compromised. As a precaution, as our investigation is underway we are temporarily shutting down access to online and related mobile photo services. We apologize for the inconvenience."

CVS says PNI Digital Media collects credit and debit information for customers who purchase online photo services through CVSPhoto.com. Accordingly, CVS recommends that all customers of its online photo service review their credit card statements "for any fraudulent or suspicious activity" and notify their bank or card issuer if anything appears to be amiss. "Nothing is more central to us than protecting the privacy and security of our customer information, including financial information," CVS says. "We are working closely with the vendor and our financial partners and will share updates as we know more."

Rite Aid: No Suspected Card Theft

Drugstore chain Rite Aid has also taken its online and mobile photo services offline. "We recently were advised by PNI Digital Media, the third party that manages and hosts mywayphotos.riteaid.com, that it is investigating a possible compromise of certain online and mobile photo account customer data," Rite Aid's site reads. "The data that may have been affected is name, address, phone number, email address, photo account password and credit card information."


Unlike CVS, however, Rite Aid reports that it does not believe that its customers' payment-card data is at risk. "Unlike for other PNI customers, PNI does not process credit card information on Rite Aid's behalf and PNI has limited access to this information," it says, adding that it has received no related fraud reports from its customers.

Sam's Club has also taken its online photo service offline, "in an abundance of caution and as a result of recent reports suggesting a potential security compromise of the third-party vendor that hosts Sam's Photo website." As with Rite Aid, however, Sam's Club reports that "at this time, we do not believe customer credit card data has been put at risk."


Costco and Tesco Photo have also suspended their online photo services.


Walmart Canada, which also outsources online photo services to PNI, also may have been affected by the possible breach, according to the The Toronto Star, and the retailer has since suspended its online photo services website. "We were recently informed of a potential compromise of customer credit card data involving Walmart Canada's Photocentre website, www.walmartphotocentre.ca," Walmart states. "We immediately launched an investigation and will be contacting customers who may be impacted. At this time, we have no reason to believe that Walmart.ca, Walmart.com or in-store transactions are affected.


Walmart did not respond to Information Security Media Group's request for comment. ISMG also reached out to office supplier Staples, which owns PNI, but did not get a response.

"PNI is investigating a potential credit card data security issue," a Staples spokesperson told The Toronto Star.

Growing Third-Party Breach Concerns

PNI's potential breach comes just a week after Denver-based managed services provider Service Systems Associates announced that a breach linked to a malware attack against its network had likely affected about 12 of the payments systems it operates for gifts shops at retail locations, which include zoos, museums and parks, across the country.


Service Systems Associates says debit and credit purchases made between March 23 and June 25 may have been compromised.

On July 7, the Financial Services Information Sharing and Analysis Center, along with Visa, the U.S. Secret Service and The Retail Cyber Intelligence Sharing Center, which provides threat intelligence for retailers, issued a cybersecurity alert about risks merchants face when dealing with third parties.


The alert lists a number of security recommendations for managing third-party risks, including using multifactor authentication for remote-access login to point-of-sale systems and including specific policies related to outdated operating systems and software in contracts with vendors.


Earlier this month, Chris Bretz, director of payment risk at the FS-ISAC, warned that managed service providers that offer outsourced services to numerous merchants are increasingly being targeted by cybercriminals.


"Criminals continue to find success by targeting smaller retailers that use common IT and payments systems," Bretz said in an interview with ISMG. "Merchants in industry verticals often use managed service provider systems. There might be 100 merchants that use a managed service provider that provides IT and payment services for their business."

more...
No comment yet.
Scoop.it!

Windows 10 likely to land at PC makers this week

Windows 10 likely to land at PC makers this week | IT Support and Hardware for Clinics | Scoop.it

Microsoft keeps wending its way past the mile markers en route to getting Windows 10 out to the public on time.


The software titan is putting the finishing touches on the operating system software and will finalize its prerelease development by July 10, The Verge is reporting, citing people who claim to have knowledge of the company's plans. This version ofWindows 10, called "release to manufacturing," will then be sent to PC makers to be bundled into their products.


Windows 10, which is slated to launch on July 29, comes at a critical time for Microsoft. While Windows overall remains the dominant force in desktop operating systems, running on over 90 percent of computers worldwide, according to NetMarketShare, the last big release -- Windows 8 -- proved a marked disappointment. According to NetMarketShare, Windows 8 musters just 13 percent market share worldwide, far behind the 61 percent share for Windows 7 and just ahead the 12 percent share for the now ancient Windows XP.


The issues with Windows 8 were numerous, ranging from Microsoft's design choice, called Metro, to a steep learning curve for those used to the old days of Windows. Windows 8, which launched in 2012, also came as consumers and business users were increasingly attracted to tablets and smartphones, which typically ran either Apple's iOS software or Google's Android.


Microsoft tried to respond by offering its own tablet, the Surface, and partner with third-party tablet manufacturers. The efforts, however, have done little to kick Android and iOS from the top spots.

Realizing its own miscues and the changing market dynamics, Microsoft has tried to address its Windows 8 woes with Windows 10.


The Start button is back and the design a bit more traditional, while Microsoft CEO Satya Nadella has made clear that Microsoft is a "mobile-first (and cloud-first)" company that will allow for Windows 10 to run on multiple device types without sacrificing features. To boost adoption, Microsoft will offer free upgrades to customers currently running Windows 7 and Windows 8 -- a first for the company. Microsoft has even softened its stance in its longstanding battle with pirates, saying that any pirated copy of Windows can be upgraded to Windows 10 free-of-charge.


For months now, Microsoft has been offering preview versions of Windows 10 to developers and consumers who want to take the operating system for a test drive. Operating systems go through a series of "builds," or versions, during their development phase. Once the company's development team has finalized the operating system, it goes into RTM phase, which means it's ready to be passed on to hardware vendors for bundling into the PCs they sell. Assuming the report is accurate, hitting the RTM phase this week would ensure Windows 10 would be available later this month, as anticipated.

That said, while Microsoft seems to be on-pace for a July 29 launch, the company has cautioned thatthe rollout could be slow going.


Microsoft said last week that it "will start rolling out Windows 10" on July 29, but will roll out the operating system "in waves" after that date.

"Each day of the rollout, we will listen, learn and update the experience for all Windows 10 users," the company said in a blog post. "If you reserved your copy of Windows 10, we will notify you once our compatibility work confirms you will have a great experience, and Windows 10 has been downloaded on your system."


The blog post seems to indicate that while Windows 10 may be released to PC vendors soon, it will continue to fine-tune the operating system after the July 29 launch date.


Microsoft has yet to say when its operating system will hit the RTM phase, but in the past, the company has announced the milestone on its site. Microsoft will likely do the same with Windows 10, once it has officially gone RTM.

more...
No comment yet.
Scoop.it!

Will Sony Settle Cyber-Attack Lawsuit?

Will Sony Settle Cyber-Attack Lawsuit? | IT Support and Hardware for Clinics | Scoop.it

Did Sony underspend on information security, thus contributing to the success of the devastating hack attack against it, which came to light in November 2014? And can a business be held legally accountable by employees for their employer's information security shortcomings?


Those questions are central to a lawsuit filed by Michael Corona and eight other former Sony employees in the wake of what plaintiffs rightly dub a data breach "epic nightmare, much better suited to a cinematic thriller than to real life." Their suit accuses Sony of having failed to put an effective information security program in place, despite having previously suffered repeated, serious attacks.


 An epic nightmare, much better suited to a cinematic thriller than to real life. 


"Sony failed to secure its computer systems, servers and databases, despite weaknesses that it has known about for years," the lawsuit alleges, citing in part a September 2014 audit by PricewatershouseCoopers, which found that Sony's information security and monitoring practices fell below "prudent industry standards."


The lawsuit further alleges that nearly 100 terabytes of data was stolen, including 47,000 Social Security numbers and personally identifiable information for at least 15,000 current and former employees, some of whom had not worked for the studio since 1955. As a result, breach victims "face ongoing future vulnerability to identity theft, medical theft, tax fraud, and financial theft," the lawsuit plaintiffs allege. "In fact, plaintiffs' PII has already been traded on black market websites and used by identity thieves."

Lawsuit Ruling

Sony asked a court to dismiss the suit, and U.S. District Judge R. Gary Klausner this week did dismiss some parts, including allegations of breach of contract and that Sony failed to notify breach victims in a timely manner.


But in a setback for Sony, the judge ruled that other parts of the lawsuit can proceed, although he has yet to rule on the merits of these claims, including plaintiffs' allegation that Sony "made a business decision to accept the risk of losses associated with being hacked." The federal judge also agreed with the former employees' allegation that "to receive compensation and employment benefits, they were required to provide their PII to Sony." While many data breach lawsuits get dismissed on the grounds that the breach did not cause any economic harm to people whose information was stolen, Klausner said that by requiring employees' PII, Sony created a "special relationship that provides an exception to the economic loss doctrine."


Michael Sobol, an attorney for the plaintiffs, told the BBC, "We are pleased that the court has properly recognized the harm to Sony's employees."


A spokeswoman for Sony Pictures Entertainment did not immediately respond to a request for comment on the ruling.


In the wake of the 2014 attack, at least nine other lawsuits were filed against Sony by individual former employees. Like the Corona suit, all of these lawsuits seek class-action status, meaning they would include all current and former employees who were affected by the cyber-attack.

Wiper Malware Attack

To recap: Sony suffered a devastating wiper malware attack in November 2014, ostensibly designed to punish the company for releasing "The Interview," a satiric film starring James Franco and Seth Rogan that featured the fictional death of North Korean leader Kim Jong-un.


But before the attackers unleashed their wiper malware and began erasing Sony hard drives and bricking laptops, they penetrated Sony's network and stolen tens of terabytes of data, including copies of unreleased movies and the script for the upcoming James Bond film "Spectre," as well as numerous private email exchanges, all of which the attackers began leaking.


Sony, in a December 2014 breach notification filed with California state authorities, reported that the breach appeared to compromise current and former employees' names, addresses, Social Security numbers, driver's licenses and passport numbers, corporate credit card information, usernames and passwords, and salaries. Sony also warned that individuals' "HIPAA-protected health information" may have been exposed, including medical diagnoses, dates of birth, health plan identification numbers, and personal and health-related information.


As noted in Corona's lawsuit, large amounts of this information were leaked to the Internet by attackers and likely remain in circulation.

Lawsuit Resolution: Unclear

What will happen next in the Sony class-action lawsuit saga, of course, is not clear. But based on past breach-related lawsuits, it's likely that unless the lawsuit gets dismissed, Sony will ultimately settle, rather than risk a jury trial and ruling that might give breach victims more rights.


If Sony did make a business decision to underspend on security, it was a costly move. In February, Sony said in an earnings report that it expected to spend $35 million in cleanup costs through the end of its fiscal year in March, largely related to restoring the company's "financial and IT systems." But as the multiple lawsuits highlight, Sony faces continuing legal costs, as well as the risk that it will eventually have to pay damages or settlements.


But any such settlement likely would not happen soon. Indeed, Sony only settled a lawsuit filed in the wake of its April 2011 breach - a year in which the company fell victim to more than a dozen breaches - in June 2014. That breach exposed personal information for 77 million users of the Sony PlayStation Network and Qriocity services.


By that timeline, the lawsuits stemming from the 2014 Sony cyber-attack may not be resolved until at least 2017.

more...
No comment yet.
Scoop.it!

Can the Power Grid Survive a Cyberattack?

Can the Power Grid Survive a Cyberattack? | IT Support and Hardware for Clinics | Scoop.it

It’s very hard to overstate how important the US power grid is to American society and its economy. Every critical infrastructure, from communications to water, is built on it and every important business function from banking to milking cows is completely dependent on it.

And the dependence on the grid continues to grow as more machines, including equipment on the power grid, get connected to the Internet. A report last year prepared for the President and Congress emphasized the vulnerability of the grid to a long-term power outage, saying “For those who would seek to do our Nation significant physical, economic, and psychological harm, the electrical grid is an obvious target.”

The damage to modern society from an extended power outage can be dramatic, as millions of people found in the wake of Hurricane Sandy in 2012. The Department of Energy earlier this year said cybersecurity was one of the top challenges facing the power grid, which is exacerbated by the interdependence between the grid and water, telecommunications, transportation, and emergency response systems.

So what are modern grid-dependent societies up against? Can power grids survive a major attack? What are the biggest threats today?

The grid’s vulnerability to nature and physical damage by man, including a sniper attack in a California substation in 2013, has been repeatedly demonstrated. But it’s the threat of cyberattack that keeps many of the most serious people up at night, including the US Department of Defense.

Why the grid so vulnerable to cyberattack

Grid operation depends on control systems – called Supervisory Control And Data Acquisition (SCADA) – that monitor and control the physical infrastructure. At the heart of these SCADA systems are specialized computers known as programmable logic controllers (PLCs). Initially developed by the automobile industry, PLCs are now ubiquitous in manufacturing, the power grid and other areas of critical infrastructure, as well as various areas of technology, especially where systems are automated and remotely controlled.

One of the most well-known industrial cyberattacks involved these PLCs: the attack, discovered in 2010, on the centrifuges the Iranians were using to enrich uranium. The Stuxnet computer worm, a type of malware categorized as an Advanced Persistent Threat (APT), targeted the Siemens SIMATIC WinCC SCADA system.

Stuxnet was able to take over the PLCs controlling the centrifuges, reprogramming them in order to speed up the centrifuges, leading to the destruction of many, and yet displaying a normal operating speed in order to trick the centrifuge operators. So these new forms of malware can not only shut things down but can alter their function and permanently damage industrial equipment. This was also demonstrated at the now famous Aurora experiment at Idaho National Lab in 2007.

Securely upgrading PLC software and securely reprogramming PLCs has long been of concern to PLC manufacturers, which have to contend with malware and other efforts to defeat encrypted networks.

The oft-cited solution of an air-gap between critical systems, or physically isolating a secure network from the internet, was precisely what the Stuxnet worm was designed to defeat. The worm was specifically created to hunt for predetermined network pathways, such as someone using a thumb drive, that would allow the malware to move from an internet-connected system to the critical system on the other side of the air-gap.

Internet of many things

The growth of smart grid – the idea of overlaying computing and communications to the power grid – has created many more access points for penetrating into the grid computer systems. Currently knowing the provenance of data from smart grid devices is limiting what is known about who is really sending the data and whether that data is legitimate or an attempted attack.


This concern is growing even faster with the Internet of Things (IoT), because there are many different types of sensors proliferating in unimaginable numbers. How do you know when the message from a sensor is legitimate or part of a coordinated attack? A system attack could be disguised as something as simple as a large number of apparent customers lowering their thermostat settings in a short period on a peak hot day.

Defending the power grid as a whole is challenging from an organizational point of view. There are about 3,200 utilities, all of which operate a portion of the electricity grid, but most of these individual networks are interconnected.

The US Government has set up numerous efforts to help protect the US from cyberattacks. With regard to the grid specifically, there is the Department of Energy’s Cybersecurity Risk Information Sharing Program (CRISP) and the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) programs in which utilities voluntarily share information that allows patterns and methods of potential attackers to be identified and securely shared.

On the technology side, the National Institutes for Standards and Technology (NIST) and IEEE are working on smart grid and other new technology standards that have a strong focus on security. Various government agencies also sponsor research into understanding the attack modes of malware and better ways to protect systems.

But the gravity of the situation really comes to the forefront when you realize that the Department of Defense has stood up a new command to address cyberthreats, the United States Cyber Command (USCYBERCOM). Now in addition to land, sea, air, and space, there is a fifth command: cyber.

The latest version of The Department of Defense’s Cyber Strategy has as its third strategic goal, “Be prepared to defend the US homeland and US vital interests from disruptive or destructive cyberattacks of significant consequence.”

There is already a well-established theater of operations where significant, destructive cyberattacks against SCADA systems have taken place.


In a 2012 report, the National Academy of Sciences called for more research to make the grid more resilient to attack and for utilities to modernize their systems to make them safer. Indeed, as society becomes increasingly reliant on the power grid and an array of devices are connected to the internet, security and protection must be a high priority.

more...
No comment yet.
Scoop.it!

Microsoft's Surface Hub will cost up to $19,999 when it ships in September

Microsoft's Surface Hub will cost up to $19,999 when it ships in September | IT Support and Hardware for Clinics | Scoop.it

If there was any doubt that Microsoft’s Surface Hub computers were strictly for deep-pocketed businesses, the asking price should clear things up.


Microsoft will charge $19,999 for the 84-inch, 4K version of the Surface Hub. For businesses on a tighter budget, a 55-inch version with a 1080p display will cost $6,999. Pre-orders will begin on July 1, and of course, both models will have Windows 10 on board when they ship in September.


What good is a giant, wall-mounted, touchscreen PC? Aside from running all the usual Windows applications, Microsoft has designed the device around office collaboration. It comes with two pressure-sensitive pens, and lights up a whiteboard in OneNote when someone takes a pen from its magnetic holster. The touchscreen supports 100 touch points, so several people can interact with the display at once.


The Surface Hub also has some slick tools for teleconferencing. It has two wide-angle 1080p cameras inside for picking up an entire room of attendees, and depth sensors for figuring out who’s in the room and where to direct the microphones. Anything drawn on the whiteboard can show up in real time on employees’ computer screens, and they can also beam their screen content back to the Surface Hub using Miracast.


As for tech specs, the Surface Hub has fourth-generation Intel Core processors (i5 for the smaller model, i7 for the larger), Intel HD 4600 or NVIDIA Quadro K2200 graphics, 128GB of solid state storage, 8GB of RAM, four USB ports (USB 3.0 for two of them), Bluetooth 4.0, 802.11n Wi-Fi, and gigabit Ethernet. The smaller model weighs 105 pounds, while the larger weighs a whopping 280 pounds.


Microsoft will sell the Hub exclusively through major enterprise hardware distributors in 24 markets. But you may not need a well-endowed business to check it out yourself;Engadget reports that it’ll eventually be on display in Microsoft Stores.


Why this matters: Microsoft isn’t the only one making jumbo touch PCs for enterprises. InFocus, for instance, has been producing similar devices in its MondoPad and BigTouchlines for years, and in many cases for less money. The difference with the Surface Hub is its focus on collaboration, with a marriage of hardware and software that other companies won’t be able to pull off. It could be worth a little extra cash if it lives up to the promise of less excruciating meetings.

more...
No comment yet.
Scoop.it!

Why Apple believes smarter services and devices won't compromise your privacy

Why Apple believes smarter services and devices won't compromise your privacy | IT Support and Hardware for Clinics | Scoop.it

Apple's message today was abundantly clear: We value your privacy more than anyone else.


Amid a flurry of announcements ranging from a new music service to a smarter, more proactive version of Siri, Apple executives hammered the point home on Monday during the company's Worldwide Developers Conference that it takes your personal information seriously.


"If we do look up something on your behalf, such as traffic, it's anonymous," said Craig Federighi, senior vice president of software for Apple, at the event in San Francisco. "You are in control."


Apple's mission to maintain your privacy, a theme that was set up by CEO Tim Cook last week when he said "morality demanded" that people have the right to keep their affairs to themselves, is a key advantage in the escalating battle over a slate of services that are designed to manage your connected life, which can range from your smartphone to your car. It's also a less-than-subtle shot at Google, a company that similarly wants to be everything in your life -- but is keen to use your information to enable more relevant ads.


"Apple is drawing the line as to what belongs to customers and Apple vs. everyone else," said Ramon Llamas, an analyst at IDC. "It's a sense of trust that Apple is evangelizing, perhaps as a way to set itself apart from other platforms."


At the same time, Apple wants its services and programs to be more effective at helping you. Another theme of the conference keynote speech was heightened intelligence, whether it's the ability to ask a question in natural language to either its Siri digital assistant or Spotlight app, to even the curated playlist and song recommendations delivered to you via Apple Music. It's part of a broader trend of smarter, more proactive assistants, which include Google Now and its Now On Tap service, and Microsoft's Cortana.


Unlike the other services, Apple was clear that many of the actions taken by its smarter assistants occur within the device, or traveling through the cloud without its knowledge. It's a function of its core business model: generating revenue and profits off its devices, with software and services driving demand for those products.

That stands in contrast with Google, which typically generates advertising off its many free services, or Microsoft, which makes money off the services that you use.


"There's a difference between the device knowing you vs. the company behind the device," said Carolina Milanesi, an analyst at Kantar WorldPanel. "That is very subtle."

Siri, Spotlight get smarter

A highlight of Apple's announcements was the ability to ask questions in a natural language to Siri, the company's virtual assistant. The new functions include the ability to set reminders or pull up photos from a specific location. It can also offer suggestions on contacts for meetings or apps you should be using.


The new features come as Google and Microsoft tout the expanded capabilities of their own assistants. Microsoft, for instance, said its Cortana assistant will live on both smartphones and other Windows 10-powered devices.


For Apple, it's also part of a broader push to make iOS 9 anticipate your needs.

more...
No comment yet.
Scoop.it!

Here Are The Features Microsoft Is Cutting From Windows 10

Here Are The Features Microsoft Is Cutting From Windows 10 | IT Support and Hardware for Clinics | Scoop.it

Windows 10 is fast approaching and while there’s no immediate need to upgrade from 8.1, or even 7, odds are you’ll want to make the jump eventually. Before you do, you’d best check out the Windows 10 “feature deprecation section”, to make sure your favourite features aren’t being cut from the latest release.

It’s to be expected you’ll run into a few driver incompatibilities and unsupported hardware and software, but what can sometimes catch you off guard is when entire features are dropped from the core operating system.

Probably the biggest cut is Windows Media Center, but it’s not the only thing getting the boot. From Microsoft’s Windows 10 specification page:

Feature deprecation section

  • If you have Windows 7 Home Premium, Windows 7 Professional, Windows 7 Ultimate, Windows 8 Pro with Media Center, or Windows 8.1 Pro with Media Center and you install Windows 10, Windows Media Center will be removed.
  • Watching DVDs requires separate playback software
  • Windows 7 desktop gadgets will be removed as part of installing Windows 10.
  • Windows 10 Home users will have updates from Windows Update automatically available. Windows 10 Pro and Windows 10 Enterprise users will have the ability to defer updates.
  • Solitaire, Minesweeper, and Hearts Games that come pre-installed on Windows 7 will be removed as part of installing the Windows 10 upgrade. Microsoft has released our version of Solitaire and Minesweeper called the “Microsoft Solitaire Collection” and “Microsoft Minesweeper.”
  • If you have a USB floppy drive, you will need to download the latest driver from Windows Update or from the manufacturer’s website.
  • If you have Windows Live Essentials installed on your system, the OneDrive application is removed and replaced with the inbox version of OneDrive.

Nothing particularly drastic, though if you love desktop gadgets in Windows 7, you might want to think twice about upgrading to Windows 10 — at least until you find some replacements. I doubt the floppy drive thing will bother anyone… I expect more people will be put out by the loss of Solitaire.

more...
No comment yet.
Scoop.it!

SSH support is finally coming to Windows

SSH support is finally coming to Windows | IT Support and Hardware for Clinics | Scoop.it

Furthering Microsoft’s push to support open source, the company hasannounced that it plans to add Secure Shell (SSH) support to Windows in the future.


SSH is a protocol that allows users to access the command line of remote computers.


The team behind Powershell, Microsoft’s shell environment, said that it’s been working to add SSH for a number of years but it didn’t make the cut in both the first or second versions of Powershell.


The SSH library used by Windows will be OpenSSH as it’s ‘industry proven’ and Microsoft plans to give back to the project by contributing to the core library.


There’s no hard date for SSH support landing in Windows, as it’s only in the “early planning phase,” but the news will be music to the ears of network administrators and those that support Windows at scale.

more...
No comment yet.
Scoop.it!

Internet used by 3.2 billion people in 2015 - BBC News

Internet used by 3.2 billion people in 2015 - BBC News | IT Support and Hardware for Clinics | Scoop.it

The International Telecommunication Union (ITU), a United Nations body, predicts that 3.2 billion people will be online. The population currently stands at 7.2 billion.


About 2 billion of those will be in the developing world, the report added.


But just 89 million will be in countries such as Somalia and Nepal.

These are part of a group of nations described as "least developed countries" by the United Nations, with a combined population of 940 million.

Mobile

There will also be more than 7 billion mobile device subscriptions, the ITU said.


It found that 78 out of 100 people in the US and Europe already use mobile broadband, and 69% of the world has 3G coverage - but only 29% of rural areas are served.


Africa lags behind with just 17.4% mobile broadband penetration.

By the end of the year 80% of households in developed countries and 34% of those in developing countries will have internet access in some form, the report continued.


The study focused on the growth of the Information and Communication Technology (ICT) sector over the past 15 years.

In the year 2000 there were just 400 million internet users worldwide, it said - an eighth of the current figure.


"Over the past 15 years the ICT revolution has driven global development in an unprecedented way," said Brahima Sanou, director of the ITU telecommunication development bureau.


"ICTs will play an even more significant role in the post 2015 development agenda and in achieving future sustainable development goals as the world moves faster and faster towards a digital society."

more...
No comment yet.