Browser security – an update for 2014

It’s been pointed out that we haven’t updated this topic for awhile. In case you have been wondering, some interesting changes, and some interesting consistency, here:

https://www.nsslabs.com/reports/browser-security-comparative-analysis-report-socially-engineered-malware

For this key source of malware – Socially Engineered Malware, Internet Explorer remains at the very top, as it has been for some time, Chrome is a pretty good third place, and Firefox and Safari are, as they have been for several years, at the very bottom. Our recommendations for browser use are unchanged: use the most secure browser available on your platform, keep your operating system up to date, and use Norton Internet Security.

(Note: at this point we do not have enough information about the two new Chinese browsers to make a recommendation regarding them one way or another)

“Heartbleed” vulnerability

There has been a great deal of press about this vulnerability in recent days, and it’s difficult to determine exactly what an individual’s exposure is, reading through the coverage. Think of the Year 2000 issues but imagine if everyone had just realized the issue on December 31, 1999. On a smaller scale, that’s pretty close to the chaos that’s ensued since this was identified.

Generally, there is little a user of the internet can do directly to protect him/herself from this, since this exposure happens on a service provider’s serverand not on the user’s computer. Further, while many security vulnerabilities give the bad guys access to stored information (credit card numbers, passwords, account numbers, etc.), this one gives unauthorized access only to a snapshot of what happens to be in a server’s memory at a point in time. A subtle difference, but an important one when considering the exposure.

Our best advice: if you’re worried about a given password – either because it’s for a service that was affected, or because you use it in multiple places, or “just because”, then change it. Change it to a “good” password. One that is 8 or more characters long, and uses three of these four groups: upper case letters, lower case letters, numbers, special characters. Don’t use your name, or your dog’s name, or your birthday (or your dog’s birthday) in the password. If you use a word or number in the password, make sure it’s not one that can easily be tied back to you. For example, DAF!090657 technically would be a “strong” password, but it could be cracked, if I used it, in a fraction of a second by password cracking software. Passwords that are a random jumble of letters, numbers and special characters are best, but are hard to manage unless one uses a password manager like Roboform or LastPass.

Keep in mind that if a provider of service for you has identified but not yet patched this exposure, you’ll have to change the password again after the service is patched. If you use the same password (as you should not) for multiple online services, then you put yourself at additional risk for two reasons: 1) because a password mined using a vulnerability like this could be used to access your information at multiple online services, and 2) because, if you change your passwords now but one or more smaller services you use hasn’t patched this vulnerability yet, you’ll have to change them all again. You should never use the same password at multiple sites, for just these reasons. For now, changing your password at larger, affected sites, monitoring email traffic about online services, and monitoring credit card statements, is about as much as a user can do.

Broadly speaking, Amazon.com, Apple services (me.com, icloud.com), eBay, Evernote, LinkedIn, Microsoft services (msn.com, hotmail.com, outlook.com), PayPal, Twitter were not affected by this.

Broadly speaking, Amazon Web Services, Dropbox, Facebook, Twitter, Google/Gmail, and Yahoo were affected, and have patched their systems to eliminate the exposure. It would be a good idea to change your passwords at these services.

You’ll notice I mentioned Twitter in each group, above. See how hard it is to tell?

If you have a service provider that is not one of the big ones (a regional bank, or smaller provider of some service), you should contact that provider to determine its status.

From a service provider perspective, the services that are at the heart of what Interconnected Technologies uses and recommends for our clients were not and are not vulnerable to this issue. Zendesk (our helpdesk service), Freshbooks (our time tracking and billing service), PayPal and Stripe (our credit card processing service), Wells Fargo (our banking service) Rackspace (Exchange service), Jungledisk (backup service), Egnyte (file services) and all services from Microsoft were not affected by this issue.

Only one service widely used by some Interconnected Technologies clients, Google Apps, was vulnerable to this, since it’s based on Gmail. Google patched the vulnerability immediately, and so the cautious approach would be to change any Google / Gmail / Google Apps passwords now. Contact us if you have questions about this or need help doing this.

These are some reference sites for this issue. A quick look will show that things are still in a state of flux as of this writing:

• https://lastpass.com/heartbleed/
• https://filippo.io/Heartbleed/
• http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/

This is a very fluid and murky situation in which we find ourselves. The outline above is a good general guide, but as always we stand ready to provide our clients with tailored advice and solutions for their unique situations and needs.

Hacker’s Playground – an update

We’ve posted this before – on April 8, 2014 support for Windows XP ends:

http://www.interconnected.com/interconnectnow/2013/12/14/hackerrsquos-playground.html

Here’s some more information which, if it comes to pass, could cause additional ripples. Stay tuned folks – should be interesting.

http://www.networkworld.com/community/blog/why-april-9th-might-be-its-worst-day-2014?t51hb 

And, of course, if you are an Interconnected Technologies client and have Windows XP machines, or have concerns about this event – ask us. If you’re a Managed Services client, we’re keeping on top of your computers. If not, we might want to talk about this in the first quarter!

XFINITY EasySolve: just because you can do a thing . . .

Comcast is sending out emails announcing a new service called EasySolve. It’s a self-help tool that purports to help resolve multiple types of issues that users may face. While this may be a good and valuable tool, the first question should be: “Is it necessary?” For Interconnected Technologies clients the answer is, for now, “no”.

Just as with the ConstantGuard offering from Comcast, EasySolve may or may not ultimately be a part of what we recommend to clients. For now, though, there is enough concern about stability and function to cause is to advise staying away from both offerings, with one key exception, which we’ll discuss below.

The Comcast home and Business internet service remain rock solid, and we recommend them. It’s just the add-on products of which one must be wary. Not because they’re bad, but because they’re new, relatively untested, and at least for now largely unnecessary. They may prove to be useful, or they may prove to be at best unnecessary, and at worst potentially destructive (like Registry Mechanic, Driver Detective and other well-meaning but overly-invasive programs).

One principle on which we base our service is that we should obtain services from the best specialists in each area, bundling those services only where it makes clear sense. Comcast is an excellent Internet Service Provider, and their phone service is quite good, but as they grow into other areas: product provider, Exchange provider, support provider, backup provider, etc., those other areas must be evaluated individually: are they the best provider of that service?

The one exception? Norton Security Suite, which is at the core of the ConstantGuard offering, is absolutely necessary, which is why our Comcast residential clients use that one piece of the ConstantGuard suite of products.

Navigating all this can be complex and fraught with difficulty, unless you have Interconnected Technologies guiding you through it!

Flamer virus not an issue for Interconnected Technologies’ clients

There has been a great deal of press lately about the Flame or Flamer virus taking over the world and doing all sorts of nefarious things. Interconnected Technologies clients need not worry about this, however, since we always ensure that Norton Antivirus, Norton Internet Security, Norton Security Suite or Norton Business Suite (depending on the client, the internet service and the business need) is installed and protecting all client machines.

Here is a recent communication from Symantec about this:

This is one of the many benefits of doing business with Interconnected Technologies, and we thank our clients for entrusting their I/T security, among other things, to us!