Phone Scams Seem to be on the Rise

I want to let you know that scammers are trying to utilize the phone systems to get your money.  They are calling your office and letting you know that you have some kind of computer problem.  They try to tell you that you have a virus or your computer has been hacked.  They try to get you to go to websites or go to obscure settings on your computer to prove that you computer problems.  I received a phone call from one of these scammers last week they said that they were Microsoft.  I was in an odd mood and I stayed on the line with him and messed with him for 4 minutes.  At the end of the phone call he called me a couple of bad words and hung up on me.

Here is another call where Thinkgeek really messed with them.  http://www.howtogeek.com/180514/

I had a client call me today and let me know that they had a call from Comcast saying that they had a server that was sending out spam from a NTP server.  When the tech support person sent the "official" email of the problem to the client it was sent from a Gmail account.  

I had another client who had one of their clients send them an email to redirect money to a different bank.  Their clients' email was compromised and the scammer was reading their normal conversations and fooled them.

Here are my recommendations:

• Be SKEPTICAL without being rude
• Do not share your email passwords and keep them complex
• Do NOT use POP email - the passwords are transmitted in clear text with every email
• Secure your mobile devices with a password
• If someone calls you check the caller ID
• If you don't know what they are saying is true, then get their number and we will call them back.
• Don't let someone that you don't know login to your computer.
• Read emails carefully.  
• I have received scam emails from:  Banks, Intuit, Microsoft, IRS and many other businesses that we know.
• Do not install toolbars or any programs or games that you do not need on your computer.  
• If you are running Quickbooks or other financial programs on your computer I suggest that is all that you do on that computer.

Microsofts warning concerning scammers - http://www.microsoft.com/security/online-privacy/avoid-phone-scams.aspx

Here is the email that my client received today:

From: Jeremy C [mailto:csatech278@gmail.com]

Sent: Tuesday, January 28, 2014 3:17 PM

To: xxxx@gmail.com

Subject: NTP server issue

A public NTP server on your network, running on IP address 50.197.243.26, p=

articipated in a very large-scale attack against a customer of ours today, =

generating UDP responses to spoofed "monlist" requests that claimed to be f=

rom the attack target.

Please consider reconfiguring this NTP server in one or more of these ways:

1. If you run ntpd, upgrading to the latest version, which removes the "mon=

list" command that is used for these attacks; alternately, disabling the mo=

nitoring function by adding "disable monitor" to your /etc/ntp.conf file.

2. Setting the NTP installation to act as a client only. With ntpd, that ca=

n be done with "restrict default ignore" in /etc/ntp.conf; other daemons sh=

ould have a similar configuration option. More information on configuring d=

ifferent devices can be found here: https://www.team-cymru.org/ReadingRoom/=

Templates/secure-ntp-template.html.

3. Adjusting your firewall or NTP server configuration so that it only serv=

es your users and does not respond to outside IP addresses.

If you don't mean to run a public NTP server, we recommend #1 and #2. If yo=

u do mean to run a public NTP server, we recommend #1, and also that you ra=

te-limit responses to individual source IP addresses -- silently discarding=

those that exceed a low number, such as one request per IP address per sec=

ond. Rate-limit functionality is built into many recently-released NTP daem=

ons, including ntpd, but needs to be enabled; it would help with different =

types of attacks than this one.

Fixing open NTP servers is important; with the 456x amplification factor of=

NTP DRDoS attacks -- one 40-byte-long request generates 18252 bytes worth =

of response traffic -- it only takes one machine on an unfiltered 1 Gbps li=

nk to create a 450 Gbps attack!

If you are an ISP, please also look at your network configuration and make =

sure that you do not allow spoofed traffic (that pretends to be from extern=

al IP addresses) to leave the network. Hosts that allow spoofed traffic mak=

e possible this type of attack.

Further reading:

https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks

https://isc.sans.org/forums/diary/NTP+reflection+attack/17300

http://www.symantec.com/connect/blogs/hackers-spend-christmas-break-launchi=

ng-large-scale-ntp-reflection-attacks

Cyptolocker Virus

The "Cryptolocker Virus" has gotten a lot of press lately.  It is a bad thing but it is not a new thing.  We have cleaned up a few of these.  We have also seen files encrypted and lost forever.  The virus gets installed by downloading a picture or .PDF.  It can come from anywhere.  Users get tricked into running and installing a program.  The people who spread this virus are very tricky and I would not wag my finger at a user telling them that it was all their own fault and they should know better.  The virus comes along as emails for UPS delivery notifications, Intuit Payroll confirmations and Late notifications from a bank just to name a few.    It can also be embedded into websites where simply browsing the page prompts users to install it.  They do a good job of making it look legit.  

The worst thing is that this virus can do is lock down your files by encryption.  When this happens your files are gone.  If you pay these people the money for the decryption code, then do you think they are going to give you the code?  They are criminals after all.

You can read more technical details here:
http://en.wikipedia.org/wiki/CryptoLocker

The only protection is to have daily backups of your files.  We offer that as a service and we will give you your files back if your computer seizes and dies.

Thanks,

Adam Bell
Senior Systems / Network Engineer
Sublime Computer Services
We make your technology work

615-942-0850
adam@sublimecomp.com
www.sublimecomp.com

Sublime Computer Services - Managed PC Services Explained

$25 per month per computer - No Contract

• The price is clear.  This service is for PC’s.  This is not a service for servers.  We have a separate manage service process for servers.
• Your computer needs to be connected to broadband internet service.  It needs to be left on at night on a fairly regular basis to receive the updates after hours.  

Full computer health monitoring and updates

• Critical Event Checking
• We are looking at the important services of the operating system that are malfunctioning.  We are looking for services that are not started that should be started or absent.

• Hard Drives are failing or running out of disk space
• We are looking for hard drives that have less than 10% storage space left.  We are also look for hard drives that are getting SMART errors.  These errors indicate that the hard drive is going bad.  If we find out the hard drives are failing ahead of time we can clone the hard drive to a new good drive.

• Hacker Check
• We are checking the security log for failure audits.  These failures can be indicators of someone trying to hack your computer.  We are looking for programs that are trying to run using an invalid username or password.

• Automatic updates of Microsoft, Java and Adobe products
• We are updating the most common problem programs automatically.  These updates happen at night.  Most users don’t update these programs on a regular basis because it is a hassle.  Malware takes advantages of these old vulnerabilities.

Managed Antivirus

• Automatic virus cleanup and notification
• We are running an active scan on all new files that are accessed.  We automatically quarantine any file that exhibits virus characteristics.  We then receive a notification that a virus has been quarantined.

• Alerts when there are problems with Antivirus software
• Some viruses are smart enough to disable antivirus or uninstall antivirus.  We receive a notification if Antivirus has been removed, disable or is out of date.

Offsite file backups - 200 GB

• Encrypted and stored on Sublimes’ server in Nashville.
• We allow for 200 GB of data to be backed up.  We can allow for more at a higher rate.
• The data is encrypted and stored on Sublimes’ server in Nashville.  We can recover quickly from the local file rather than having to wait for the files to be download out of the cloud.
• Files are scheduled to be backed up after hours between 4:00 PM and 6:00 AM.

Adam Bell

Senior Systems / Network Engineer

Sublime Computer Services

We make your technology work

615-942-0850

adam@sublimecomp.com

www.sublimecomp.com

When Should I Move My Server to the Cloud

The term “The Cloud” makes sales people giggle and technicians cringe.  We have all been using the technology that makes up the cloud for a long time.  However, having your server in another location has not always been a viable option.  There are scenarios where having your server hosted at a data center (AKA in the cloud) is not a good idea.  I am going to discuss a scenario when it is a good idea to move your server to the cloud.

The Really Old File Server

If you have a file server that is on its’ last leg and your IT staff has been begging you to replace it here are some possible reasons:

• Hard drives are failing or failed.
• The manufacturer will no longer provide support for the server.
• Spare parts have to be purchased from Ebay.
• It does not always startup when you turn it on.
• The cooling method is taking the side off of it and blowing a box fan into it.
• The power goes out in your office and your server is offline.
• It is still running 32 bit Windows Server 2000.
• There is not enough RAM to run all of the applications that are needed.
• There is no disaster recovery if the building burns down.
• You have to replace the server anyway.

Scenario:

• Less than 30 Users
• There is a mix of mobile and office workers.
• The files that are stored on the server are emails, documents, spreadsheets and presentations.
• The company has a fast internet connection.

This is a scenario where a cloud server makes sense.  A VPN tunnel is setup between the office and the cloud server.  If due diligence is done, then the users will not notice a difference.  All of their files settings and login will process as normal.  The problems that were listed above are no longer a problem.

• Hard drives are faster, larger and a very expensive drive array maintained by someone else.
• The server is virtual.  The warranty is a SLA’s provided by the cloud server provider.
• The server is in a data center and all of the gear is cooled and powered.
• The server is running 64 bit Windows Server 2008 or 2012.
• Disaster Recovery - The office building can burn down and your server and your data is secure.
• RAM can be increased easily.

Other benefits of cloud servers:

• $200 per month (Based on resources required) for a virtual server.
• Upfront cost of purchasing a server sized for this scenario is typically $5000 plus labor.  
• No longer have hardware depreciation.
• The server can be setup to be accessed from anywhere.
• Users don’t “have” to work from the office.
• IT costs associated with hardware will decrease.

Cons and Considerations

• If you don’t have faster internet at the data center or at the office, then access will be too slow.
• A T1 is not fast internet any more. 1.5 MB upload and download
• A bonded T1 is not fast internet. 3 MB upload and download
• DSL at 50 MB download speed and 10 MB upload speed is fast internet.
• Our recommendation is dual internet.  Fast DSL and an internet T1 for backup at the office.
• If you are processing large files like movies, animations or CAD files, then the cloud will be too slow for you.
• Software like Quickbooks or other programs that have a database file stored on the server will also be too slow.
• There are some good migration paths for converting your existing physical server into a virtual server.  I would not recommend this path unless time is of the essence or software dictates.  I feel that it is better to have a clean server with which to start.

Careful consideration needs to be made when moving servers to the cloud.  Do it when it makes sense for your organization.  This whole process will have to be handled by a competent technician and it can be expensive if the technician doesn't spend the time planning the move.

Adam Bell

Senior Systems / Network Engineer

Sublime Computer Services

We make your technology work

615-942-0850

adam@sublimecomp.com

www.sublimecomp.com