Topic: blog posts

“My package wasn’t delivered”

Posted on July 4, 2017 by Canny Creative - IT Services

Is this actually FedEx?

It happens more and more often these days, an email comes into your mailbox that looks genuine advising you that a certain courier had attempted to deliver your parcel, but that you weren’t in. They either attach a PDF form or ask you to click a link to reschedule. What do you do? Well, it might surprise you to know that 30% of these emails were opened in 2017. That is a lower number than we would have guessed, but it shows that overall we as IT users need to be more vigilant with our emails.

The nefarious characters out there who create these infected emails are constantly finding new ways to try and trick us into opening them. Their hope is that one of us might be waiting on a package or even be the right person to ask to have a large sum of money transferred.

What can we do to stop this?

There are many products available to limit the amount of these emails getting through to end user mailboxes and here at Leaf we offer a tailored security solution designed to detect and reject the majority of phishing emails and infected attachments. If you are a Leaf customer you will already have some form of protection in place, we are currently carrying out security reviews to show the benefits of our security suite offering.

As a user though the best thing is to be alert when checking your emails. You have a good sense of the type of emails you normally get and you will know if a package is on it’s way to your home or office. If you suspect any of your emails of not being genuine, don’t open them. Alert your relevant IT contact and give us a call so it can be investigated before it creates any problems on your local machine or servers.

Example of this type of email:

Check the return address (@Lexington.us?? That isn’t FedEx.)
There is no Trademark symbol included on the FedEx logo. (You can see the real FedEx logo in the red box.
If you copy and paste the Tracking ID into the FedEx tracking sytem it won’t be recognised because it is fake.
If you hover over the “Print Receipt” button don’t click it. It will take you to a completely unknown url that will cause big problems.

It’s important to ensure your employees and colleagues have a high level of awareness when it comes to these kinds of attacks. We can provide bespoke security awareness training. If you are interested in booking a training session please get in touch.

Using a Mac? Do you Think you’re safe from Malware

Posted on June 14, 2017 by Canny Creative - Uncategorized

It may appear silly by name, but it’s surely not silly by nature… say hello, or hopefully not, to MacSpy.

What is is MacSpy?

This is a new piece of Malware that has been specifically designed for Apple computers, and is very smart in what it can do. If infected, the malware hides itself and uses minimal system resources to go virtually undetected. Current scans on VirusTotal have been unable to detect any malicious content within the malware, so you can’t currently rely on any Anti-Virus or Anti-Malware programs to block it from running.

So what can this program do?

Basically, everything you wouldn’t want it to… from record your microphone, log your keystrokes, take screen shots every 30 seconds and worst of all… encrypt your data. According to Peter Ewane from AlienVault, the encryption is quite poorly written, in that the decryption keys may not necessarily work… so if you get encrypted, whether you pay a ransom or not, it is not guaranteed that you will get your data back, even if you are provided with the decryption keys.

What’s worse, is that the Malware is FREE to anyone on the dark net, and only communicates across the Tor network, keeping it invisible from you. There is a Paid version which allows further functionality, but the cost is currently unknown.

Have a read at the full malware analysis here -(https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service) that has been carried out and stay alert for anything mysterious on your system.

Please feel free to contact us here at Leaf to discuss any concerns you may have on security within your network and computer systems.

Orchestrating your disaster recovery plan with Azure Site Recovery

Posted on May 8, 2017 by Canny Creative - Uncategorized

Simple, automated protection and disaster recovery in the cloud.

Your environment can be protected by automating the replication of the virtual machines based on policies that you set and control. Site Recovery can protect Hyper-V, VMware and physical servers, and you can use Azure or your secondary data centre as your recovery site. Site Recovery coordinates and manages the ongoing replication of data by integrating with existing technologies, including System Centre and SQL Server AlwaysOn.

Orchestrated disaster recovery as a Service (DRaaS).

Automate the orderly recovery of services in the event of a site outage at the primary data centre with Site Recovery. Applications can be brought up in an orchestrated fashion to help restore services quickly, even for complex multi-tier workloads. Easily create disaster recovery plans in the Microsoft Azure classic portal, where they are stored. The disaster recovery plans can be as simple or as advanced as your business requirements demand, including the execution of custom Windows PowerShell scripts and Azure Automation Runbooks and pauses for manual interventions. Customise networks by mapping virtual networks between the primary and recovery sites, and test disaster recovery plans whenever you want without disrupting the services at your primary location.

Replication and disaster recovery to Azure.

Replicating your workloads to Azure enables new capabilties. Applications can be migrated to Azure with just a few clicks, or burst to Azure temporarily when you encounter a surge in demand. Run reports and analytics on copies of production workloads in Azure without having an impact on users. DevTest new versions of applications with copies of live data then seamlessly put the new version into production in your data centre.

Continuous health monitoring with Site Recovery.

Site Recovery monitors the state of your protected instances continuously and remotely from Azure. When replicating between two sites that you control, your virtual machines’ data and replication remains on your networks. All communication with Azure in encrypted. When replicating to Azure as the secondary site, your data is encrypted and you can also select encryption for data at rest.