Hackers Steal Up To $1 Billion From Banks

ATM

NEW YORK (AP) — A hacking ring has stolen up to $1 billion from banks around the world in what would be one of the biggest banking breaches known, a cybersecurity firm says in a report scheduled to be delivered Monday.

The hackers have been active since at least the end of 2013 and infiltrated more than 100 banks in 30 countries, according to Russian security company Kaspersky Lab.

After gaining access to banks’ computers through phishing schemes and other methods, they lurk for months to learn the banks’ systems, taking screen shots and even video of employees using their computers, the company says.

Once the hackers become familiar with the banks’ operations, they use that knowledge to steal money without raising suspicions, programming ATMs to dispense money at specific times or setting up fake accounts and transferring money into them, according to Kaspersky. The report is set to be presented Monday at a security conference in Cancun, Mexico. It was first reported by The New York Times.

The hackers seem to limit their theft to about $10 million before moving on to another bank, part of the reason why the fraud was not detected earlier, Kaspersky principal security researcher Vicente Diaz said in a telephone interview with The Associated Press.

The attacks are unusual because they target the banks themselves rather than customers and their account information, Diaz said.

The goal seems to be financial gain rather than espionage, he said.

“In this case they are not interested in information. They’re only interested in the money,” he said. “They’re flexible and quite aggressive and use any tool they find useful for doing whatever they want to do.”

Most of the targets have been in Russia, the U.S., Germany, China and Ukraine, although the attackers may be expanding throughout Asia, the Middle East, Africa and Europe, Kaspersky says. In one case, a bank lost $7.3 million through ATM fraud. In another case, a financial institution lost $10 million by the attackers exploiting its online banking platform.

Kaspersky did not identify the banks and is still working with law-enforcement agencies to investigate the attacks, which the company says are ongoing.

The Financial Services Information Sharing and Analysis Center, a nonprofit that alerts banks about hacking activity, said in a statement that its members received a briefing about the report in January.

“We cannot comment on individual actions our members have taken, but on balance we believe our members are taking appropriate actions to prevent and detect these kinds of attacks and minimize any effects on their customers,” the organization said in a statement. “The report that Russian banks were the primary victims of these attacks may be a significant change in targeting strategy by Russian-speaking cybercriminals.”

The White House is putting an increasing focus on cybersecurity in the wake of numerous data breaches of companies ranging from mass retailers like Target and Home Depot to Sony Pictures Entertainment and health insurer Anthem.

The administration wants Congress to replace the existing patchwork of state laws with a national standard giving companies 30 days to notify consumers if their personal information has been compromised.

The Security Measure iPhone Owners Need To Take

Early Tuesday, a number of Australian iPhone and iPad owners awoke to find their devices locked, with an alert asking for $50 to $100 to give access back. The lesson: It’s easier than you think for someone to get into your Apple products — even if a thief doesn’t have the actual iPhone in his or her hands.

One way to make yourself that much safer? Start using two-step verification for your Apple ID.

When you enable two-step verification, Apple will make you prove you’re actually you whenever you buy anything on iTunes, the App Store or the iBooks Store. It works like this: Apple will text you a code anytime you try to sign into your Apple account to make a purchase. You will then have to input that number to verify your identity. That way, nobody else can access your account unless they have both your password and your device, making it far more difficult to steal your identity and credit card information.

Here’s how you do it:

First, go to the Apple ID site, click “Manage your Apple ID” and sign in. From there, click “Password and Security.”

iphone security

From there, you’ll see “Two-Step Verification.” Under that you should click “Get started…”

iphone security

There you’ll be able to sign up for two-step verification. For security reasons, Apple makes you wait three days after setting up two-step verification for it to take effect. Once you sign up, you’ll get an email telling you exactly when you’ll be able to use it.

Once you have two-step verification, this is how it works when you sign into Apple to make a purchase:

iphone security

You’ll also get a Recovery Key, which is a 14-digit series of numbers and letters that you can use to access your account if you ever lose access to your iPhone and are unable to receive text messages. Apple recommends you print our your Recovery Key and keep it in a safe place.

Many people don’t think about Apple security — even though the devices and accounts can contain a ton of personal information. Half of iPhone users don’t even use their phone’s regular passcode, and some people probably still haven’t updated their iPhones after a major security flaw was discovered in February. Two-step verification is just one extra way you can protect yourself.

EBay’s Massive Security Breach: What It Means for You

eBay HQ

Samantha Murphy at Mashable.

eBay is the latest victim of a cyberattack, and if you are one of the 145 million users with an account, you’re likely affected.

While eBay is urging users to update their passwords immediately (here’s how to do that), many are left wondering what this means for their data and what they can do to keep it safe.

The breach, which was confirmed by investigators this week, happened in early May (not late February and early March, as eBay first said) when hackers snatched up information such as usernames, email addresses, physical addresses, phone numbers and dates of birth. The hackers were even able to access passwords, but they were in encrypted form, so it’s unlikely they were compromised.

eBay said no financial information was taken and that the cyberattackers found their way in through employee login information.

While your credit card information may be safe, experts believe the ramifications of the security breach could be vast.

“The impact of the eBay compromise will likely spread beyond just eBay because people often reuse passwords across multiple sites,” Trey Ford, global security strategist at Rapid7, told Mashable. “It’s hard to predict just how serious that might be, and there may be other compromises that happen as a result that are never directly tied back to this breach. Users really need to change their passwords as soon as possible, and avoid reusing passwords across sites.”

The news comes just a few weeks after an encryption flaw called the Heartbleed bug affected many popular websites and services such as Gmail and Facebook. The bug quietly exposed sensitive account information, such as passwords and credit card numbers, over the past two years and went widely undetected until recently.

Following the Heartbleed bug news, a survey conducted by Software Advice revealed 67% of web users didn’t update their passwords.

With enough time and resources, Ford says, a hacker can fly under the radar for a while; until he is able to steal information, it’s challenging for an organization to defend against or detect it.

“Big companies have incredibly complex environments, with hundreds of thousands of users and systems they need to monitor, which means there are a lot of potential entry points for attackers to target,” Ford said. “And in the case of big companies, they often are targets for attackers because they have a lot of customers and a lot of valuable data. So attackers that are well-resourced will invest real time in casing a large company to find a way in, which frequently involves manipulating the company’s employees or trusted network in some way.”

Similar to other high-profile breaches, hackers move slowly in order to remain stealthy.

“We’re seeing this increasingly being the case in high profile breaches, like with Target — attackers take their time, do some reconnaissance and figure out an entry point that often leverages credentials stolen from a user related to the organization,” Ford said. “This kind of infiltration is really hard to spot, and it looks like a normal user accessing the system.”

While eBay’s breach might even be larger than Target’s large-scale attack, which affected its 40 million card devices at checkout stations across stores nationwide and about 110 million shoppers earlier this year, it depends on how you look at the two cases.

“Payment details were not taken at eBay so the question comes down to the value of the data,” said Raj Samani, VP at McAfee.

Staying safe

While security breaches are becoming increasingly common, it’s a reminder to always keep on top of password management, too. Passwords should also be updated because eBay stores private customer information that can be used against the user in subsequent phishing scams, said Darren Guccione, CEO of password management firm Keeper Security.

“There is always risk of future loss so the key is to practice good password management,” Guccione added. “We encourage consumers to change passwords on their most important and frequently used sites every six months. When creating a password, it’s important to use letters, numbers and symbols which can be accomplished with a password manager.”

Microsoft Fixes Internet Explorer Security Bug

The security glitch that allowed data thieves using a network computer to get around security protections and access personal information has been taken care of

Internet-Explorer-650x412

 

Microsoft has fixed the security glitch in Internet Explorer that caused the Department of Homeland Security to advise users not to use the browser until the problem was resolved, the tech giant announced on Thursday.

Most users will not have to take any action as the fix will be downloaded automatically, but customers who haven’t enabled automatic updates are encouraged to apply the update manually as quickly as possible.

The security glitch, which was announced by Microsoft last weekend, potentially gave data thieves using a networked computer the same level of access to personal information as the legitimate user.

Web users who are still using Windows XP were especially vulnerable.

Microsoft: Windows XP Update An ‘Exception’

InformationWeek, Michael Endler

XP users shouldn’t expect additional support from Microsoft, despite its heroic last-minute security update for Internet Explorer.

Many Windows XP users are no doubt relieved that Microsoft decided to include Windows XP in a security update for a recently-disclosed bug — but they shouldn’t assume support will continue. Microsoft said XP remains an unsupported product, and that it made an exception to include it in this update only because the issue arose so near the operating system’s end-of-life deadline.

Microsoft began deploying the update around 1 p.m. EST on Thursday. Users who have enabled automatic updates shouldn’t need to take any action. Otherwise, users can access the update via the Control Panel’s Windows Update section. Microsoft rarely releases out-of-cycle updates like this one. Most arrive during the company’s monthly Patch Tuesday releases.

After disclosing the bug last weekend, Microsoft suggested a number of workarounds, many of which were inapplicable to XP machines. In a blog post, Microsoft Trustworthy Computing GM Adrienne Hall encouraged XP users to upgrade.

 

Image: Nick Perla (Flickr)

Image: Nick Perla (Flickr)

She wrote that today’s cyberthreats are too sophisticated for an operating system first released over a decade ago. Microsoft officials have repeated this message countless times in recent months, but many users remain unpersuaded; over a quarter of PC users still relied on XP in April, according to web-tracking firm Net Applications.

Attacks against XP are already ongoing, according to FireEye, the security firm that took credit for discovering the vulnerability and gave it its nickname, “Operation Clandestine Fox.”

In a Thursday blog post, the firm said it has detected a “version of the attack that specifically targets out-of-life Windows XP machines running IE 8.” FireEye said earlier attacks involved only IE 9, 10, and 11 on Windows 7 and 8. The bug affects all versions of IE from 6 to 11. The firm warned that the new method that involves XP “means the risk factors of this vulnerability are now even higher.”

FireEye said it initially observed attacks against the defense and financial sectors but has since detected campaigns against government and energy institutions as well.

Internet Explorer Security Bug: How to Protect Yourself

Microsoft over the weekend admitted to a huge vulnerability in Internet Explorer that allow hackers to set up malicious websites in order to gain complete access to visitors’ PC, provided they visited the page with a IE (version 6 and up). From there, hackers could install apps, break into other accounts and generally use the computer as their own.

In order to protect yourself from the flaw — dubbed “Operation Clandestine Fox” by security firm FireEye — the best thing you can do is stop using Internet Explorer until Microsoft patches it. Other browsers, such as Google Chrome and Mozilla Firefox, don’t have the problem, and you can export your bookmarks and other settings to those browsers very easily.

If you don’t want to stop using IE, there are ways to ensure you’re not
exposed while browsing the web. Ever since IE10, the browser has offered
an Enhanced Protected Mode (EPM). You won’t be vulnerable to the bug
with EPM enabled, according to FireEye, and it’s listed as one of the workarounds Microsoft recommends on its explainer page. The following video explains how to do it:

You can also disable Adobe Flash. Disabling IE’s Flash plug-in will stop the bug cold, FireEye says — although that will also render your browser powerless to play Flash videos and games.

There are other, more technical ways around the exploit as well. You can install a piece of software called the Enhanced Mitigation Experience Toolkit (EMET) and configure it for Internet Explorer, Microsoft recommends. That will let you browse without altering your web experience much. Be sure to use EMET 4.1 since it’s automatically configured to protect IE.

Separate from Protected Mode, IE has other layers of security, including sliding settings for security zones, which will block malicious software from hijacking your PC if they’re set to high. It will, however, make using some websites (such as order forms) more difficult.

Microsoft is expected to release a patch for the flaw soon — either in the company’s next “Patch Tuesday” update, due May 13, or in an off-schedule patch specifically for this issue. It’s unclear if Windows XP will get the patch; support for the OS officially ended in April, but some large enterprise customers are continuing to get software updates.

 

 

The most I like about Google’s Project Ara is it’s name?

Project Ara video reminds us why we want a modular phone

By Rich McCormick, The Verge

Google sold most of Motorola Mobility to Lenovo for $2.9 billion earlier this year, but it kept one small part of the phone manufacturer. Motorola’s Advanced Technology and Projects group had been working on Project Ara when it was incorporated by Google — an ambitious plan for a modular smartphone that could retail for around $50, comprised of parts that users could purchase and swap in and out at their leisure. Now Phonebloks — a company that previously worked with Motorola to create a concept for a modular smartphone — has shown off how Project Ara is progressing in a video tour of Google’s offices.

We see an early version of what Motorola called Project Ara’s “endo” — its endoskeleton — into which modules are slotted into a silver frame and locked into place using magnets. Those magnets are electro-permanent, meaning phone components can be secured or unlocked with an app: a design decision that means Project Ara phones won’t need a covering or outer case.

Also shown off is an app that will enable people to plan a possible Project Ara phone ahead of purchase, and manufacturing partner 3D Systems’ early designs for the casing of Ara’s modules. The designs on show suggest users will eventually be able to customize their phones with textured effects, bright colors, or pictures of cats wearing goggles. The video is likely aiming to stoke interest in Project Ara a week before the first Ara Developers Conference, to be held online and in Mountain View, California, on April 15th and 16th.

The Heartbleed Hit List: The Passwords You Need to Change Right Now

Heartbleed-RefreshAn encryption flaw called the Heartbleed bug is already being called one of the biggest security threats the Internet has ever seen. The bug has affected many popular websites and services — ones you might use every day, like Gmail and Facebook — and could have quietly exposed your sensitive account information (such as passwords and credit card numbers) over the past two years.

But it hasn’t always been clear which sites have been affected. Mashable reached out some of the most popular social, email, banking and commerce sites on the web. We’ve rounded up their responses below.

Some Internet companies that were vulnerable to the bug have already updated their servers with a security patch to fix the issue. This means you’ll need to go in and change your passwords immediately for these sites. Even that is no guarantee that your information wasn’t already compromised, but there’s also no indication that hackers knew about the exploit before this week. The companies that are advising customers to change their passwords are doing so as a precautionary measure.

Although changing your password regularly is always good practice, if a site or service hasn’t yet patched the problem, your information will still be vulnerable.

Also, if you reused the same password on multiple sites, and one of those sites was vulnerable, you’ll need to change the password everywhere. It’s not a good idea to use the same password across multiple sites, anyway.

We’ll keep updating the list as new information comes in. Last update: April 11, 6:14 p.m. ET

Social Networks

Was it affected? Is there a patch? Do you need to change your password? What did they say?
Facebook Unclear Yes Yes Yes “We added protections for Facebook’s implementation of OpenSSL before this issue was publicly disclosed. We haven’t detected any signs of suspicious account activity, but we encourage people to … set up a unique password.”
Instagram Yes Yes Yes Yes “Our security teams worked quickly on a fix and we have no evidence of any accounts being harmed. But because this event impacted many services across the web, we recommend you update your password on Instagram and other sites, particularly if you use the same password on multiple sites.”
LinkedIn No No No “We didn’t use the offending implementation of OpenSSL in www.linkedin.com or www.slideshare.net. As a result, HeartBleed does not present a risk to these web properties.”
Pinterest Yes Yes Yes Yes “We fixed the issue on Pinterest.com, and didn’t find any evidence of mischief. To be extra careful, we e-mailed Pinners who may have been impacted, and encouraged them to change their passwords.”
Tumblr Yes Yes Yes Yes “We have no evidence of any breach and, like most networks, our team took immediate action to fix the issue.”
Twitter No Yes Unclear Twitter wrote that OpenSSL “is widely used across the internet and at Twitter. We were able to determine that [our] servers were not affected by this vulnerability. We are continuing to monitor the situation.” While reiterating that they were unaffected, Twitter told Mashable that they did apply a patch.

Other Companies

Was it affected? Is there a patch? Do you need to change your password? What did they say?
Apple No No No “iOS and OS X never incorporated the vulnerable software and key web-based services were not affected.”
Amazon No No No “Amazon.com is not affected.”
Google Yes Yes Yes Yes* “We have assessed the SSL vulnerability and applied patches to key Google services.” Search, Gmail, YouTube, Wallet, Play, Apps and App Engine were affected; Google Chrome and Chrome OS were not.*Google said users do not need to change their passwords, but because of the previous vulnerability, better safe than sorry.
Microsoft No No No Microsoft services were not running OpenSSL, according to LastPass.
Yahoo Yes Yes Yes Yes “As soon as we became aware of the issue, we began working to fix it… and we are working to implement the fix across the rest of our sites right now.” Yahoo Homepage, Yahoo Search, Yahoo Mail, Yahoo Finance, Yahoo Sports, Yahoo Food, Yahoo Tech, Flickr and Tumblr were patched. More patches to come, Yahoo says.

Email

Was it affected? Is there a patch? Do you need to change your password? What did they say?
AOL No No No AOL told Mashable it was not running the vulnerable version of the software.
Gmail Yes Yes Yes Yes* “We have assessed the SSL vulnerability and applied patches to key Google services.”*Google said users do not need to change their passwords, but because of the previous vulnerability, better safe than sorry.
Hotmail / Outlook No No No Microsoft services were not running OpenSSL, according to LastPass.
Yahoo Mail Yes Yes Yes Yes “As soon as we became aware of the issue, we began working to fix it… and we are working to implement the fix across the rest of our sites right now.”

Stores and Commerce

Was it affected? Is there a patch? Do you need to change your password? What did they say?
Amazon No No No “Amazon.com is not affected.”
Amazon Web Services (for website operators) Yes Yes Yes Yes Most services were unaffected or Amazon was already able to apply mitigations (see advisory note here). Elastic Load Balancing, Amazon EC2, Amazon Linux AMI, Red Hat Enterprise Linux, Ubuntu, AWS OpsWorks, AWS Elastic Beanstalk and Amazon CloudFront were patched.
eBay No No No “eBay.com was never vulnerable to this bug because we were never running a vulnerable version of OpenSSL.”
Etsy Yes* Yes Yes Yes Etsy said that only a small part of its infrastructure was vulnerable, and they have patched it.
GoDaddy Yes Yes Yes Yes “We’ve been updating GoDaddy services that use the affected OpenSSL version.” Full Statement
Groupon No No No “Groupon.com does not utilize a version of the OpenSSL library that is susceptible to the Heartbleed bug.”
Nordstrom No No No “Nordstrom websites do not use OpenSSL encryption.”
PayPal No No No “Your PayPal account details were not exposed in the past and remain secure.” Full Statement
Target No No No “[We] launched a comprehensive review of all external facing aspects of Target.com… and do not currently believe that any external-facing aspects of our sites are impacted by the OpenSSL vulnerability.”
Walmart No No No “We do not use that technology so we have not been impacted by this particular breach.”

Videos, Photos, Games & Entertainment

Was it affected? Is there a patch? Do you need to change your password? What did they say?
Flickr Yes Yes Yes Yes “As soon as we became aware of the issue, we began working to fix it… and we are working to implement the fix across the rest of our sites right now.”
Hulu No No No No comment provided.
Minecraft Yes Yes Yes Yes “We were forced to temporary suspend all of our services. … The exploit has been fixed. We can not guarantee that your information wasn’t compromised.” More Information
Netflix Yes Yes Yes Yes “Like many companies, we took immediate action to assess the vulnerability and address it. We are not aware of any customer impact. It’s a good practice to change passwords from time to time, now would be a good time to think about doing so. “
SoundCloud Yes Yes Yes Yes SoundCloud emphasized that there were no indications of any foul play and that the company’s actions were simply precautionary.
YouTube Yes Yes Yes Yes* “We have assessed the SSL vulnerability and applied patches to key Google services.”*Google said users do not need to change their passwords, but because of the previous vulnerability, better safe than sorry.

Banks and Brokerages

All the banks we contacted (see below) said they were unaffected by Heartbleed, but U.S. regulators have warned banks to patch their systems.

Was it affected? Is there a patch? Do you need to change your password? What did they say?
Bank of America No No No “A majority of our platforms do NOT use OpenSSL, and the ones that do, we have confirmed no vulnerabilities.”
Barclays No No No No comment provided.
Capital One No No No “Capital One uses a version of encryption that is not vulnerable to Heartbleed.”
Chase No No No “These sites don’t use the encryption software that is vulnerable to the Heartbleed bug.”
Citigroup No No No Citigroup does not use Open SSL in “customer-facing retail banking and credit card sites and mobile apps”
E*Trade No No No E*Trade is still investigating.
Fidelity No No No “We have multiple layers of security in place to protect our customer sites and services.”
PNC No No No “We have tested our online and mobile banking systems and confirmed that they are not vulnerable to the Heartbleed bug.”
Schwab No No No “Efforts to date have not detected this vulnerability on Schwab.com or any of our online channels.”
Scottrade No No No “Scottrade does not use the affected version of OpenSSL on any of our client-facing platforms.”
TD Ameritrade No No No TD Ameritrade “doesn’t use the versions of openSSL that were vulnerable.”
TD Bank No No No “We’re currently taking precautions and steps to protect customer data from this threat and have no reason to believe any customer data has been compromised in the past.”
T. Rowe Price No No No “The T. Rowe Price websites are not vulnerable to the “Heartbleed” SSL bug nor were they vulnerable in the past.”
U.S. Bank No No No “We do not use OpenSSL for customer-facing, Internet banking channels, so U.S. Bank customer data is NOT at risk.”
Vanguard No No No “We are not using, and have not used, the vulnerable version of OpenSSL.”
Wells Fargo No No No No reason provided.

Government and Taxes

Was it affected? Is there a patch? Do you need to change your password? What did they say?
1040.com No No No “We’re not vulnerable to the Heartbleed bug, as we do not use OpenSSL.”
FileYour Taxes.com No No No “We continuously patch our servers to keep them updated. However, the version we use was not affected by the issue, so no action was taken.”
H&R Block No No No “We are reviewing our systems and currently have found no risk to client data from this issue.”
Healthcare .gov No No No “Healthcare.gov consumer accounts are not affected by this vulnerability.”
Intuit (TurboTax) No No No Turbotax wrote that “engineers have verified TurboTax is not affected by Heartbleed.” The company has issued new certificates anyway, and said it’s not “proactively advising” users to change their passwords.
IRS No No No “The IRS continues to accept tax returns as normal … and systems continue operating and are not affected by this bug. We are not aware of any security vulnerabilities related to this situation.”
TaxACT No No No “Customers can update their passwords at any time, although we are not proactively advising them to do so at this time.”
USAA Yes Yes Yes Yes USAA said that it has “already taken measures to help prevent a data breach and implemented a patch earlier this week.”

Other

Was it affected? Is there a patch? Do you need to change your password? What did they say?
Box Yes Yes Yes Yes “We’re currently working with our customers to proactively reset passwords and are also reissuing new SSL certificates for added protection.”
Dropbox Yes Yes Yes Yes On Twitter: “We’ve patched all of our user-facing services & will continue to work to make sure your stuff is always safe.”
Evernote No No No “Evernote’s service, Evernote apps, and Evernote websites … all use non-OpenSSL implementations of SSL/TLS to encrypt network communications.” Full Statement
GitHub Yes Yes Yes Yes GitHub said it has patched all its systems, deployed new SSL certificates and revoked old ones. GitHub is asking all users to change password, enable two-factor authentication and “revoke and recreate personal access and application tokens.”
IFTTT Yes Yes Yes Yes IFTTT emailed all its users and logged them out, prompting them to change their password on the site.
OKCupid Yes Yes Yes Yes “We, like most of the Internet, were stunned that such a serious bug has existed for so long and was so widespread.”
Spark Networks (JDate, Christian Mingle) No No No Sites do not use OpenSSL.
SpiderOak Yes Yes No Spideroak said it patched its servers, but the desktop client doesn’t use a vulnerable version of OpenSSL, so “customers do not need to take any special action.”
WordPress Unclear Unclear Unclear WordPress tweeted that it has taken “immediate steps” and “addressed the Heartbleed OpenSSL exploit,” but it’s unclear if the issue is completely solder. When someone asked Matt Mullenweg, WordPress’ founding developer, when the site’s SSL certificates will be replaced and when users will be able to reset passwords, he simply answered: “soon.”
Wunderlist Yes Yes Yes Yes “You’ll have to simply log back into Wunderlist. We also strongly recommend that you reset your password for Wunderlist.” Full Statement

Password Managers

Was it affected? Is there a patch? Do you need to change your password? What did they say?
1Password No No No 1Password said in a blog post that its technology “is not built upon SSL/TLS in general, and not upon OpenSSL in particular.” So users don’t need to change their master password.
Dashlane Yes Yes No Dashlane said in a blog post users’ accounts were not impacted and the master password is safe as it is never transmitted. The site does use OpenSSL when syncing data with its servers but Dashlane said it has patched the bug, issued new SSL certificates and revoked previous ones.
LastPass Yes Yes No “Though LastPass employs OpenSSL, we have multiple layers of encryption to protect our users and never have access to those encryption keys.” Users don’t need to change their master passwords because they’re never sent to the server. But passwords for other sites stored in LastPass might need to be changed.

Reporters who contributed to this story include Samantha Murphy Kelly, Lorenzo Francheschi-Bicchierai, Seth Fiegerman, Adario Strange and Kurt Wagner.

Steps to Archive Emails and Keep Outlook Running Efficiently

Outlook_imagesEver notice that your Microsoft Outlook account has slowed to a crawl? Basic email functions like Send/Receive acting a little funny? Consider checking the size of your mailbox. You might be shocked to discover just how bloated it is.

For most versions of Outlook, clicking on File > Folder > Properties > Storage — or right-clicking on any folder and selecting Properties — will display the total size not only of a chosen folder but also of any associated subfolders.

Outlook’s Auto Archive function is set to automatically back up Deleted Items, Sent Items, and expired tasks and calendar items. But if you get hundreds of messages per day and don’t delete them or move them from your Inbox, you run the risk of sabotaging your account. Exceed 2GB of storage in an overstuffed Inbox and Outlook really starts to run slow.

Yet solving the problem is doable. Compute Plus recommends that you or your IT support team follow the five (5) steps outlined below to change Auto Archive’s settings.

            1. Create a new local folder or .pst (Personal Folders) file to hold Archived Mail. Right click on the On My Computer heading at the bottom of your folder list and choose New Folder.  Name the folder Archived Mail or something else that’s easily recognizable. In older versions of Outlook, you can select File>Archive and change the date under Archive items older than.

2. Create a new Archiving Rule. Click on Tools > Rules, select Exchange from the On My Computer section, and click the + near the bottom of the window. Name the rule something meaningful and recognizable, like “120 Days, Auto Archive.”

3. Define the time limit and destination for emails eligible for archivingUnder the When a new message arrives menu, change Date Received (we suggest 120-180 days) and then change Do the Following to a defined action like “Move Message + Archived Mail.” Click the check box for Enabled and click OK. In older versions of Outlook, clicking Tools>Options>Other>Auto Archive brings up a similar set of options.

            4. Run the new rule on existing email folders. If you set a new rule that all emails over six months old will be archived, don’t let aging messages received before that rule was implemented continue to clog up your Inbox. Select the preferred mail folder, click Messages>Rules>180 Day, Auto Archive, and wait patiently while your email account reorganizes itself. Remember, you’ll have to perform this function on each desired folder; also, Outlook uses “Last Modified Date” to archive, not “Received Date.”

            5. Want to access your archived emails? Simple — they’re waiting for you right on the left-hand column of folders — or under the list of .pst files on your computer — with all of your other mail folders. The key? They’re no longer taking up space in your mailbox.

Of course, archiving can’t cure all email diseases. If you access your mail via an Outlook Web App, any emails archived on your local computer won’t show up online — archiving them means they’re no longer hosted on the Exchange server. And a .pst file or archived folder stored on your local hard drive is still susceptible to disastrous data loss if it’s not backed up as part of your backup and disaster recovery (BDR) plan.

Also, remember that Outlook is not a real email archiving solution — this QuickTip will simply help you free up storage space within the program, NOT keep your email secure via offsite backup or searchable across years of accumulated messages.

CryptoDefense Ransomware Worse Than CryptoLocker, Cyber Firm Says By: Homeland Security Today Staff

A new ransomware called CryptoDefense — a copycat  competitor to CryptoLocker – which was released into cyberspace in late February “is much worse than the original,” KnowBe4 CEO Stu Sjouwerman said Thursday in issuing an alert warning  computer users of the new ransomware.

 

CryptoDefense  targets text, picture, video, PDF and MS Office files and encrypts these with a strong RSA-2048 key which is hard to undo, KnowBe4 said, adding, “It also wipes out Shadow Copies which are used by many backup programs.

 

“The potential for damage is vast, generating tens of thousands per month, according to reports from Symantec,” KnowBe4 said in its announcement Thursday. “If an end-user opens the infected attachment, the ransomware encrypts its target files, and the criminals charge $500 in Bitcoin to decrypt the files. If their four-day deadline passes by, the amount goes up to $1,000. After a month, the keys are destroyed.

 

“There is furious competition between cybergangs,” Sjouwerman said. “They did their test-marketing in countries like the UK, Canada and Australia, and are now targeting the US. CryptoDefense doesn’t seem to be a derivative of CryptoLocker, as the code is completely different, confirming this is a competing criminal gang.”

 

KnowBe4 said “It appears that this infection initially was installed through programs that pretend to be flash updates or video players required to view an online video. Then it moved on to a variety of different phishing attacks that show an email with a zip file directing to ‘open the attached document’ that was supposed to have been ‘scanned and sent to you.’”

 

“It is obvious that this is a social engineering ploy and that effective security awareness training will prevent someone from opening these infected attachments when they make it through the filters (which they regularly do),” Sjouwerman said. “Training your end-users to prevent fires like this is a must these days. Once infected, the only way to fix this relatively fast is to make sure you have a recent backup of the files which actually can be restored. Even then, it can take several hours to restore the data.”

 

According to KnowBe4, recent ransomware infections involved users opening an attachment with a “voice mail message” from AT&T, but that there also are variants from other Telco companies. Users then admit to opening the attachment but saying it did nothing, however they could not open their files afterward.

 

This new CryptoDefense ransomware Malware has bugs too. Symantec researchers said that “Due to the attackers poor implementation of the cryptographic functionality they have, quite literally, left their hostages a key to escape.”