What you need to know about Cloudbleed
Internet security company Cloudflare revealed a major flaw in their system. The so-called ‘Cloudbleed’ vulnerability leaked customer information from thousands of websites, according to Cloudflare researchers. Fortunately, there have been no signs of exploitation, but that doesn’t mean you should be complacent. Here’s everything you need to know about Cloudbleed.
What is Cloudbleed?
Although it’s technically similar to Heartbleed, a bug that compromised millions of websites and accounts, Cloudbleed is less severe. Google security researcher Tavis Ormandy discovered that several Cloudflare-hosted websites, including Fitbit, Uber, and OkCupid, were inadvertently leaking customer information and saving them within the source code.
For example, when a person visits a bugged Uber page, the website code could contain data and login credentials from another user who recently visited the page. The data may be hidden between several lines of code, but a skilled hacker can easily find it.
Exploiting it, however, is more difficult. The Cloudbleed bug collects random bits of data, which may or may not contain any sensitive information, making it a less attractive point of attack for cybercriminals. Over time, a cybercriminal may be able to compile enough information to exploit, but it doesn’t seem to be a viable option for targeted attacks.
The response
According to Cloudflare, Cloudbleed was triggered 1,240,00 times and found in 6,400 websites between September 22 and February 18. After the bug was discovered, the internet security company quickly alerted affected websites, fixed the code, removed cached pages from search engines, and monitored client websites for any strange website activity.
Cloudflare-hosted websites also checked what data was leaked and reassured customers that there was minimal impact to their private information.
What can you do?
While Cloudflare and other companies are telling everyone that the possibility of Cloudbleed attacks and password leaks is low, you should still ensure your account is safe for future security breaches.
Start by setting stronger passwords with a combination of letters, numbers, and symbols. Make sure to set unique passwords for every online service, especially for any of your accounts that use Cloudflare. Whenever possible, use two-factor verification to keep your account secure even if someone gets a hold of your password.
And, last but not least, contact Multi IT by calling us on 011 435 0450 or by visiting our website, for any cybersecurity, cloud, and website issues. We aim to make your internet and cloud experience as safe as possible.
VIEW MORE
Firewalls: hardware vs. software
Most people have a vague idea of what a network firewall does. But some business owners are easily fooled by promises of quick and easy solutions that can be installed and managed right from your desktop. In the software vs. hardware debate, there’s a clear winner when it comes to your security. Let’s take a look at what the differences are and why they matter.
Software firewalls
Calling a piece of software a “firewall” is a bit of an exaggeration. Installing it on a local hard drive is more like locks on a door than impenetrable walls. When data is scanned for threats by a software firewall, the information it contains has already been passed through your router, network switch, and finally your local hard drive.
Once the whole cycle has finished, software firewalls can prohibit risky activities based on blacklisted IP addresses, known malware definitions, and suspicious application requests.
Although these solutions do have value, they can’t guarantee that malware won’t spread to other systems before each packet of data can be scanned, unless they’re standing guard at your business’s gateway to the internet. And whenever the computer with the firewall is powered off, everything it protects is left unguarded.
Hardware firewalls
Because the drawbacks of a software-based firewall are centered around their inefficient network position, a hardware solution is the safer option. Hardware firewalls sit directly behind your router, so every single packet of data coming from the internet must pass through your gatekeeper before landing on any of your internal drives.
Most of these solutions include far more sophisticated controls than just web filtering and basic data scanning. Like most developments in the IT industry, newer hardware firewalls focus on “intelligent” functions that analyze huge datasets to recognize malware and cyberattacks based on irregular activities instead of relying solely on cataloged viruses and attack vectors.
Another benefit of hardware firewalls is that they’re always on. There’s no need to worry about whether the workstation hosting your solution will crash because these devices are built for 24/7 protection. The only downside to this type of solution is the level of monitoring and maintenance it requires. Hardware firewalls are extremely complex and managing them is no easy task.
“Cloud” firewalls
The most recent, and undoubtedly best, solution to network perimeter security are “cloud” firewalls. These are on-site pieces of hardware with software interfaces that can be managed remotely by certified security professionals.
This service model means that experts will monitor your network performance and security for anomalies while your team goes about its business as usual. No need for onsite tweaks and updates -- all of it can be done remotely.
You may hear a lot of experts telling you that the age of on-site hardware has passed and everything can be done in the cloud. Remote administration may be the next wave in network services, but the need for hardware will never go away. If you need someone to manage your physical devices or looking for a network firewall, contact Multi IT & Telephony Solutions today. Have a look at out Cyberoam Firewall Solution now to gain a better idea of what network firewalls are all about.
VIEW MORE
Browsers leak sensitive info to hackers
The Autofill feature fills a void in the web browsing habits of many. It eliminates the need to enter all your sensitive info when logging on your social media accounts or when checking out your basket after e-shopping. On Chrome and Safari browsers, however, danger lurks when you rely too much on autofill. Without knowing it, you may be exposing personal information and other sensitive info to hackers who have found a way to steal your credit card info and shop at your expense.
How do they do it?
By concealing other fields in a sign-up form, users are tricked into thinking they only have to fill out a few fields. The trickery at work is that upon auto-sign up, other fields, which could include your billing address, phone number, credit card number, cvv (the 3-digit code used to validate credit card transactions), and other sensitive information, are auto-filled with the user none the wiser.
This sinister trick is nothing new, but since there hasn’t been any countermeasure since it was first discovered, the threat it poses is worth emphasizing. Finnish whitehat hacker Viljami Kuosmanen recently brought to light how users of Chrome and Safari are particularly vulnerable, and he even came up with a demonstration of how this phishing technique is perpetrated. The technique is so sneaky, it’s enough to make one give up online shopping forever.
Using plugins and programs such as password managers is also fraught with the security risk, as having access to such a utility empowers cyberthieves to do more than just obtain your credit card info; it opens them up to a great amount of personal details.
Preventing an autofill-related theft
So what can you do to avoid falling prey?
Using Mozilla Firefox is one of the easiest available solutions. As of today, Mozilla hasn’t devised a mechanism that affords its users the same convenience that Chrome and Safari users enjoy with autofill. When filling web forms on Firefox, users still have to manually pre-fill each data field due to a lack of a multi-box autofill functionality – a blessing in disguise, given the potential for victimization in autofill-enabled browsers.
Another quick fix is disabling the autofill feature on your Chrome, Safari and Opera (for Apple mobile devices) browsers. This would mean that when filling out web forms, you'd have to manually type responses for every field again, but at least you'd be more secure without the browser storing your sensitive info.
It’s not exactly the most sophisticated form of online data and identity theft, but complacency can result in being victimized by cyber swindlers. Take the first step in ensuring your systems’ safety by getting in touch with our security experts at Mult IT today, on 011 435 0450 or by visiting our website.
VIEW MORE
Microsoft ending support for Office 2013
To make sure enterprises get the most out of their Office 365 package, Microsoft announced back in February that it will no longer support Office 2013. Instead, the tech giant has pushed enterprises to upgrade to Office 2016. If your business is still using the 2013 version, here are some things you need to know right away.
Already effective from the 28th of February, Office 2013 client applications and language packs will have no longer been available from the Office 365 self-service portal and Admin Center. On top of that, Microsoft no longer releases feature updates for Office 2013 and have been focusing solely on upgrading the recent 2016 version. And because Office 2016 doesn’t support Microsoft Exchange Servers 2007 or earlier, you’ll need to upgrade your mail server as well.
The end-of-support changes apply to Office 365 Pro Plus, Small Business Premium, Business, Project Pro, and Visio Pro subscriptions. Although critical security updates for 2013 products extend to April 10, 2018, businesses should really consider making the move to Office 2016 to take advantage of the latest productivity features.
With Office 2016 versions of Word, Excel, and PowerPoint, users can look up web information right from the document interface. What’s more, employees have access to advanced, collaborative features like Skype integrations, Office 365 Planner, and Delve.
If your business plans to migrate to Office 2016, don’t forget to consider the minimum system requirements:
1 GHz processor
2GB RAM
3 GB of available disk space
1280 x 800 screen resolution
Windows 7 OS, or above
To make the transition process smoother, Microsoft is offering FastTrack migration, a service providing organizations with the tools to help them make the move from one Office version to another.
However, if you need more advice on moving to Office 2016, contact Multi IT today by giving us a call on 011 435 0450 or by visiting our website. We’ll make sure your Office 365 is always up-to-date.
VIEW MORE
Instagram Stories: redefining online marketing
Since it’s inception in 2010, Instagram has come a long way from just double-tapping. The photo-sharing application announced its plan to experiment with video ads via Instagram Stories. Give your small- or medium-sized business a competitive edge by understanding and utilizing Instagram Stories.
Jim Squares, director of product marketing, said in an interview with Fortune that “a two or three-week test period” will be carried out before releasing it to all its active advertisers. Let’s face it, the similarities between Instagram Stories and Snapchat ads are undeniable. But with Snapchat ads, they work mainly with larger brands and keep ads as unobtrusive as possible. If you want to collaborate with big boys like Netflix or Coca-Cola, you’re looking at a budget bigger than what you might have. By contrast, Instagram ads are self-serving and employ auction-based pricing.
When it comes to setting up and paying for video ads inside Stories, it’s a pretty straightforward process, much like Facebook advertising. Not only do you have the ability to target your audience, but the benefits of working with demographic and Internet-based targeting capabilities definitely give Instagram a competitive advantage. On top of this, users can expect more goodies when the format officially takes off. For the time being, Stories seems to be a simple yet efficient way to test out advertising placement.
Instagram also announced that analytics from Stories will also be included in the Business Tools dashboard, sharing basic insights including reach and impressions -- with a good chance of more analytics to be seen in the future. It’s estimated that up to 71 percent of US businesses will begin to market on Instagram in 2017, and these efforts will not go unnoticed since 75 percent of users initiate some sort of action after seeing a post.
It took Instagram quite a while before it rolled out any type of advertising or introduced any kind of business feature. When it finally did, however, they didn’t beat around the bush in monetizing the platform. Yet, several months after Stories’ initial launch, Instagram is already making plans to leverage its power.
That’s because Stories represents a stellar opportunity at getting back at its biggest rival -- Snapchat -- while simultaneously providing an immersive advertising experience. Because Stories take up the entire mobile screen, so will the ads. Sponsored Stories isn’t exclusive to just images; videos are an optional format for both advertisers and consumers alike. Meaning that full-screen multimedia truly makes it both an interactive and engaging experience. There won’t be a difference in engagement between organic and Sponsored stories; both enable viewers to like, comment and share.
It might not be the traditional once-upon-a-time kind of story, but Instagram’s latest feature is poised to bring happy endings to many -- if utilized properly, of course. If you are still uncertain or would like to ask further questions, feel free to give Multi IT a call on 011 435 0450. Alternatively, come to our website. and allow us to partner with your business, so you can #succeed that much quicker.
VIEW MORE
How IoT will influence businesses
In the near future, the Internet of Things (IoT) is expected to usher in an era of connectivity and efficiency on a global scale. Many small- and medium-sized companies, however, assume IoT has no application to their business. To dispel those false assumptions, we’ve compiled a list of four ways your business can benefit from using IoT devices.
Improved logistics
With IoT sensors, supply chain management and order fulfillment processes improve markedly to meet customer demand. For example, sensors on delivery containers and trucks in transit give managers real-time status updates, allowing them to track their items and ensure they reach the right location at the right time.
Streamlined inventory
Internet of Things also presents automation opportunities for businesses that need to manage and replenish their stock. When data recorded from IoT devices are tied to your enterprise resource planning (ERP) system, you can accurately monitor your inventory, analyze purchase and consumption rates of a particular product, and automatically reorder items when IoT sensors detect that supply is running low. This minimizes out-of-stock incidents and prevents excess stock build-up.
Fast payment
Given how most payments are done electronically via point-of-sale systems or the internet, Internet of Things has the potential to revolutionize the way businesses process transactions. We’re already seeing a few examples of this today as ApplePay not only allows users to purchase goods and services using smartphone applications, but through wearable technology as well.
Soon enough, IoT devices might even allow restaurants and retailers to register or charge their customers the moment they walk through the door.
Market insight
Businesses that can somehow make sense of IoT-collected data will gain a competitive edge. Marketers, for example, can gather valuable insight into how their products are used and which demographic is utilizing them the most. This information can then inform future marketing efforts and give businesses more direction on how to improve their products and services for their customers.
Although businesses will certainly face many challenges in implementing the Internet of Things, those who manage to overcome them will reap all the benefits of this burgeoning technology.
Want to know if an IoT deployment is right for your business? Contact Multi IT on 011 435 0450 or visit our website.
VIEW MORE