Old Windows PCs can stop WannaCry ransomware with new Microsoft patch

In a rare step, Microsoft published a patch for Windows XP, Windows Server 2003 and Windows 8

 

Users of old Windows systems can now download a patch to protect them from this week’s massive ransomware attack.

In a rare step, Microsoft published a patch for Windows XP, Windows Server 2003 and Windows 8 — all of them operating systems for which it no longer provides mainstream support.

Users can download and find more information about the patches in Microsoft’s blog post about Friday’s attack from the WannaCry ransomware.

The ransomware, which has spread globally, has been infecting computers by exploiting a Windows vulnerability involving the Server Message Block protocol, a file-sharing feature.

Computers infected with WannaCry will have their data encrypted, and display a ransom note demanding $300 or $600 in bitcoin to free the files.

Fortunately, Windows 10 customers were not targeted in Friday’s attack. In March, Microsoft patched the vulnerability that the ransomware exploits — but only for newer Windows systems. That’s left older Windows machines, or those users who failed to patch newer machines, vulnerable to Friday’s attack.

Researchers originally believed the ransomware was spread through attachments in email phishing campaigns. That no longer appears to be the case.

 

Infection attempts from the WannaCry ransomware.

Once a vulnerable PC becomes infected, the computer will attempt to spread to other machines over the local network as well as over the internet. The ransomware will specifically scan for unpatched machines that have the Server Message Block vulnerability exposed.

Businesses can prevent this by disabling the Server Message Block protocol in vulnerable PCs. They can also use a firewall to block unrecognized internet traffic from accessing the networking ports the Server Message Block uses.

Fortunately, Friday’s ransomware attack may have been contained. A security researcher who goes by the name MalwareTech has activated a sort of kill-switch in WannaCry that stops it from spreading.

As a result, over 100,000 new infections were prevented, according to U.K.’s National Cyber Security Centre. But experts also warn that WannaCry’s developers may be working on other versions that won’t be easy to disable.

“It’s very important everyone understands that all they (the hackers) need to do is change some code and start again. Patch your systems now!” MalwareTech tweeted.

Unfortunately, the kill-switch’s activation will provide no relief to existing victims. The ransomware will persist on systems already infected.

Friday’s ransomware attack appears to have spread mainly in Europe and Asia, with Russia among those nations hardest hit, according to security researchers.

Security experts are advising victims to wait before paying the ransom. It’s possible that researchers will develop a free solution that can remove the infection.

Have questions?

Get answers from Microsofts Cloud Solutions Partner!
Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LL C is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

What you need to know about the WannaCry Ransomware

What has happened?

On May 12, 2017 a new variant of the Ransom.CryptXXX ransomware family (detected as Ransom.Wannacry) began spreading widely, impacting a large number of organizations, particularly in Europe.

What is the WannaCry ransomware?

WannaCry encrypts data files and asks users to pay a US$300 ransom in bitcoins. The ransom note indicates that the payment amount will be doubled after three days. If payment is not made after seven days, the encrypted files will be deleted.

Figure 1. Ransom demand screen displayed by the WannaCry Trojan

It also drops a file named !Please Read Me!.txt which contains the ransom note.

Figure 2. Ransom demand note from WannaCry Trojan

It propagates to other computers by exploiting a known SMB remote code execution vulnerability (MS17-010) in Microsoft Windows computers.

Are you protected against this threat?

South Jersey Techies, LLC recommends and offers Symantec Endpoint Protection to its clients. Symantec Endpoint Protection customers are protected against WannaCry using a combination of technologies: Antivirus, SONAR protection, Network-based protection.

All South Jersey Techies Managed IT Services client computers have the latest Windows security updates installed, in particular MS17-010, to prevent spreading. If your business / organization is not on our Managed IT Services plan please check or contact us to ensure that you have the latest updates installed.

Who is impacted?

A number of organizations globally have been affected, the majority of which are in Europe.

Is this a targeted attack?

No, this is not believed to be a targeted attack at this time. Ransomware campaigns are typically indiscriminate.

Can I recover the encrypted files?

Decryption is not available at this time but companies are investigating. South Jersey Techies, LLC does not recommend paying the ransom. Encrypted files should be restored from back-ups where possible. South Jersey Techies offers a number of backup solutions including Carbonite Online Backup and cloud storage solutions. If you are unsure about your computer / server backups, please check or contact us to discuss the best solution for your business.

What are best practices for protecting against ransomware?

  • New ransomware variants appear on a regular basis. Always keep your security software up to date to protect yourself against them.
  • Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by ransomware attackers.
  • Email is one of the main infection methods. Be wary of unexpected emails especially if they contain links and/or attachments.
  • Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email.
  • Backing up important data is the single most effective way of combating ransomware infection. Attackers have leverage over their victims by encrypting valuable files and leaving them inaccessible. If the victim has backup copies, they can restore their files once the infection has been cleaned up. However organizations should ensure that back-ups are appropriately protected or stored off-line so that attackers can’t delete them.
  • Using cloud services could help mitigate ransomware infection, since many retain previous versions of files, allowing you to “roll back” to the unencrypted form.

Have additional questions?

Feel free to call us at contact us or (856) 745-9990 with any questions you may have.

Quick Tips: Flush the ARP cache in Windows 7

Here’s how to clear the Address Resolution Protocol cache and how to manage that cache with a few command switches.

The Address Resolution Protocol (ARP) cache is a crucial component of IP networking on any operating system. What ARP does is link Ethernet addressing (IP addressing) to hardware addressing (MAC addressing). Without this system, a machine could not communicate to the outside world as one addressing scheme could not communicate with the other.

The ARP Cache is a collection of ARP entries (mostly dynamic) that are created when a hostname is resolved to an IP address and then an IP address is resolved to a MAC address (so the computer can effectively communicate with the IP address).

When this happens, the PC will store that newly mapped address in the ARP cache, and it will stay there until the ARP cache entry timeout expires. This isn’t usually a problem, but sometimes a bad ARP entry can cause issues with Internet connections and Web page loading. When this occurs, one step that can be taken toward resolution is to clear the ARP cache. Yes, this means the ARP cache has to be rebuilt, which means a little more work for the PC, but that cache will rebuild fairly quickly.

Clearing the ARP cache is done completely through the command line, so stretch out those fingers and get ready to type. After we show you how to clear the ARP cache, we will show you how to manage that cache with a few command switches.

Flush the cache

Step 1: Open the command prompt

Click Start and then type “cmd” (no quotes) in the search dialog box, but don’t hit Enter yet. Right-click the cmd.exe icon and select Run as Administrator (Figure A). After answering the UAC, the terminal window will open offering up the command prompt.

Figure A

If the icon is already pinned in the Start menu, entering cmd is not necessary.

Step 2: Run the commands

The first command to run is

arp -a

This command will display all your ARP entries (Figure B). Naturally the -a option is not the only option available. The arp command also allows for the following switches:

-d Delete an IP address (arp -d 192.168.100.10)
-d -a Delete all entries in the ARP table
-s Add an entry to the ARP table (arp -s ADDRESS MAC_ADDRESS – Where ADDRESS is the address to be added and MAC_ADDRESS is the MAC address of the machine)

Figure B

Here you see the arp cache for two different interfaces on a single machine.

To flush the entire cache, issue the following command:

netsh interface ip delete arpcache

The above command will flush the entire ARP cache on your system. Now as soon as network connections are made, the ARP cache will begin to repopulate.

Verify the flush

Once you have flushed the ARP cache, make sure to issue the command arp -a to see if the cache has, in fact, been flushed. If it does not flush, it could be the system is a victim of a Windows bug caused when Routing and Remote Services is enabled. This is a simple bug to fix:

1.           Click Start | Control Panel.

2.           Click Administrative Tools.

3.           Click Computer Management.

4.           Double-click Services and Applications.

5.           Double-click Services.

6.           Scroll down to Routing and Remote Services.

7.           Double-click Routing and Remote Services.

8.           Set the Startup Type to Disable.

9.           Make sure the service is stopped.

Now try flushing the ARP cache again. It should work this time.

Troubleshooting

It is also possible to troubleshoot network connections using the ARP cache. For example, it is important to look out for invalid ARP entries that go to a MAC address of 00-00-00-00-00-00. If one such entry shows up, make sure to delete it from the cache using the -d switch. Say you have an ARP entry that looks like:

224.0.0.24           00-00-00-00-00-00 static

In order to delete this entry, use the arp command like so:

arp -d 224.0.0.24

And that invalid entry will be gone.

Final thoughts

There are so many ways to troubleshoot networking connections. Flushing the ARP cache is just one of those methods that is rarely thought of, but when all else fails this might be the last-gasp effort that makes you the hero of the day.

Have questions?

Get answers from Microsofts Cloud Solutions Partner!
Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LL C is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

If you’ve ever owned a PC with a DVD drive, you may get a $10 settlement

Don’t expect your money anytime soon, however.

DVD drives may be a thing of the past, but the past could pay you $10 via a proposed settlement from a class-action suit.

If you purchased a DVD-ROM, DVD-RW or combination drive between April, 2003 and December 31, 2008, a collection of DVD drive manufacturers have tentatively agreed to pay you $10 per drive, whether you purchased the drive as part of a PC or by itself. You’ll simply need to visit the claim site and testify (under penalty of perjury) that you indeed purchased those drives within the given time period, and live in one of the 23 states (plus the District of Columbia) covered by the suit. The deadline to file is July 1.

Why this matters: Though the optical drive market continues to decrease—“the physical disk format is somewhat obsolete in the era of content streaming,” IDC wrote last year—that wasn’t the case fourteen years ago, when virtually all software was distributed via DVD-ROM. Fortunately, the settlement site isn’t asking for proof of purchase yet, but it reserves the right to do so. Filing a claim can take literally seconds, but don’t hold your breath—you’ll probably receive compensation, but there’s no guarantee.

The wheels of justice turn slowly

Simply put, a group of 23 plaintiffs sued virtually every DVD drive manufacturer, alleging that they collectively conspired to keep drive prices higher than they normally would be, in violation of antitrust laws. Though the defendants denied they did anything wrong, several—Hitachi-LG, Panasonic, NEC, and Sony—settled and agreed to pay a collective total of $124.5 million into four separate settlement funds.

(Note that only DVD drives for PCs are covered; a DVD player, such as the one gathering dust in your living room, isn’t.)

If you do submit a claim, however, the chances of receiving your settlement soon are slim. That’s because seventeen more defendants, including various subsidiaries of BenQ, Philips, Samsung, TEAC, and Pioneer, have yet to settle, and the suit will continue until all of the claims are resolved.

“Because other defendants remain in this litigation, the plaintiffs are proposing that distribution of the settlement funds not occur at this time,” the settlement site reads. “This is to save the expenses associated with distribution.”

In fact, the settlement hearing to finally approve the Hitachi-LG-Panasonic-NEC-Sony agreement will be held on December 8. After that, payments may begin—which means that you’ll probably receive your $10 or less a year from now. Yes, less: Payments will be “up to” $10 per drive, according to the claims site.

You should probably treat the settlement like one of those “print out your own rebate” slips from the turn of the century. Even under the best of circumstances, chances are you’ll have totally forgotten about your $10 windfall by the time the check arrives.

Have questions?

Get answers from Microsofts Cloud Solutions Partner!
Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LL C is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

Apple’s Red iPhone 7 Supports Charity

iPhone SE gets a storage boost, too.

Apple just made upgrading to an iPhone 7 a philanthropic decision by adding a red special edition to the lineup. The new red aluminum finish, which is available to order for both iPhone 7 and 7 Plus in-store and online on March 24, is a fundraising effort for the Global Fund. Apple will contribute a portion of red iPhone sales to the fight against AIDS and HIV.

The two new red iPhones will come in 128GB and 256GB storage variations and start at $749 in the U.S. Apple will sell the special editions in more than 40 countries by the end of March, with Brazil, Chile, Colombia, India, and Turkey to come in April. If you live in the U.S., U.K., or China and are part of the iPhone Upgrade Program, you’ll be able to snag an unlocked red iPhone with AppleCare+. In the U.S., the 128GB iPhone 7 will start at $37 a month with the ability to upgrade every year.

Apple has a long-standing relationship with the Global Fund and has a variety of products in its red lineup, including iPod’s, cases, headphones, and speakers. Last December, Apple celebrated its decade-long partnership with the Global Fund by donating proceeds from in-app purchases, exclusive downloads, and newly launched accessories to the nonprofit. The company has so far donated more than $130 million to the Global Fund, making it the organizations’s largest corporate donor.

You can snag a flashy new red iPhone 7 on March 24, starting at $749.

iPhone SE gets a bump, too

Apple hasn’t forgotten about the littlest phone in its lineup, the iPhone SE. The company just doubled the 4-inch phone’s storage to 32GB and 128GB, up from 16GB and 64GB. Those models will be phased out and the roomier new options will start at $399 beginning March 24.

While the flashy new color and iPhone SE upgrade aren’t the biggest iPhone news of the year—that will come in September with the 10th anniversary iPhone 8—it’s nice to see Apple add a little something extra to both its existing flagship and its entry-level phones.

Have questions?

Get answers from Microsofts Cloud Solutions Partner!
Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LL C is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

Here’s what’s coming next from Sling TV

Sling TV CEO Roger Lynch talks pricing, DVR, and certified hardware.

A lot’s changed in the two years since Sling TV made its grand debut at CES 2015. Instead of being the only streaming option for cable channels like ESPN and CNN, Sling is now one of three options alongside PlayStation Vue and DirecTV Now, and it will soon have a fourth competitor in Hulu.

Accordingly, Sling has changed with the times. The company, a subsidiary of Dish Network, has added new channels, created a second base package with a different mix of channels, and is working on a cloud DVR feature.

What else is in store for Sling this year? Here’s what we learned from Roger Lynch, Sling’s CEO, during CES 2017:

On DVR, which is “months” away

Sling began testing DVR service in an invite-only beta on Roku devices last month, and while it’s clearly a work in progress, Lynch says feedback has been positive. “The only feedback that isn’t positive is, ‘I wish I had this feature or that feature,’ all of which are being built already anyway,” Lynch says.

For now, Sling is prioritizing simple improvements like grouping recordings from a series into a folder, rather than listing them all separately. The eventual goal is to list all episodes from a series—whether it’s on-demand, recorded, or live—in a single window.

Still, Lynch gave only a rough time frame for when DVR might launch publicly, “It’s not in weeks. It’s not in years. It’s in months,” he says. “We want to get it out as quickly as possible.”

On AirTV and “Optimized for Sling TV”

Just before CES began, Dish announced a new brand called AirTV. Its first product, the AirTV player, puts Sling TV front-and-center, while integrating over-the-air channels and Netflix recommendations into the Sling guide.

Lynch sees AirTV as an example for other device makers to follow. “I’m hopeful that other device partners will make devices similar to this, and do similar types of integrations for Sling, and that it’ll spur innovation in the ecosystem,” he says.

To that end, Sling’s sole CES announcement was an “Optimized for Sling TV” certification program, which will help consumers know whether a device works well with the service. With streaming devices, for instance, criteria could include a Sling button on the remote control, integration with over-the-air broadcasts in the Sling guide, and a way to auto-launch Sling when users turn on the device.

Lynch says Sling is still finalizing how it’ll enforce those criteria. Roku, for instance, pre-loads the Sling app and includes a quick-launch remote button on some models, and that might be enough to earn Sling’s approval. Other types of devices may have different criteria.

“There’s router companies that are looking to be optimized for Sling. So what does that mean for router companies? It doesn’t meant they’re going to integrate OTA and put a button on the remote. It means they’re going to do something to optimize for the experience,” Lynch says.

On separating Sling Orange and Blue

Last year, Sling introduced a second base package, separate from its original $20-per-month plan. The newer plan is called Sling Blue, and it starts at $25 per month, while the original is now called Sling Orange. (Subscribers can bundle the two plans, which have different channel lineups with some overlap, for $40 per month.)

Might Sling eventually try to merge these two plans?

“We work really, really hard not to combine them,” Lynch says. “The problem with combining them is, you end up with a $35 to $40 package because there’s so much content, and you price yourself out of the market from where I think the big opportunities [are].”

That sounds like a shot at rivals like PlayStation Vue, DirecTV Now, and Hulu, none of whom are attempting to match Sling’s base prices. “For us, the Sling Orange product is the perfect cord-cutter product. It’s great for people who use antennas because you’re not forced to buy locals, and locals are really expensive,” Lynch says.

Sling Blue, meanwhile, will likely compete more directly with those larger bundles over time. “That’ll become a broader content package at a higher price point,” Lynch says.

On getting what it wants from TV networks

Since its launch in 2015, Sling has offered a “Replay” feature that lets users rewind live TV and watch several days’ worth of past programming. It’s a nice alternative to setting up a DVR, but not every channel supports the feature.

As you might expect, that’s partly because of issues with streaming rights. But Sling is working on accommodating those issues so it can support Replay on more channels.

“Every program has different requirements, like, can you fast forward, can you not fast forward, yes you can fast forward, but not through commercials,” Lynch says. “There are channels that have granted us rights to Replay, but we haven’t made Replay available on the channel yet, because we still have to put in some technology to enable that, because of the business rules that channel has.”

 

On the whole, though, negotiating those sorts of features with TV networks is getting easier. Lynch notes that two years ago, Sling was scrambling just to get a basic package together—the service launched with a mere 11 channels—but now TV networks are much more interested.

“When we first launched,” Lynch says, “we didn’t have as much leverage to demand things like that as we do now.”

Have questions?

Get answers from Microsofts Cloud Solutions Partner!
Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LL C is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

CALL US NOW!