Microsoft Releases Sway to Office 365 and Windows 10 Users

Sway lets you compose text and graphics on the fly that can be used free if you have a Microsoft account. This product is viewed  as a presentation tool to be used primarily by businesses and education users. Subscribers to Microsoft's Office 365 plans that that include "Office Online, Office 365 Business or Office 365 ProPlus" have access to this new Sway commercial release.

Sway users create presentations, called "Sways," from various text and graphics sources. The Sway application sets up the layout based on integrated design principles. Typically, a viewer would scroll vertically or horizontally through a Sway presentation, but a new added feature with this release is the ability to show Sways in an individual slide-by-slide manner.

Also with this release, Microsoft now permits a single device to handle multiple Sway accounts for home and work purposes. Microsoft has also enhanced the Share button in Sway so that presentations can be shared via Docs.com, which is a free Office documents sharing portal.

I would love to hear from anyone that is actually using this product and how you are using it.

Windows 10

As more resources become available to us I will be posting them up to this site for you to access.

Below is a link for accessing the Windows 10 free location for you to get your very own free update.

windows.com/windows10upgrade

Or download a brochure from Microsoft with all of this information here.

Latest Flash hole already exploited to deliver ransomware - update now!

By Paul Ducklin, nakedsecurity.sophos.com

Thanks to Andrew O'Donnell and Fraser Howard of SophosLabs for their behind-the-scenes work on this article.

Are you still using Flash in your browser?

If so, make certain you've got the latest update from Adobe, even though it only came out last week.

Ideally, you'll have 18.0.0.194, announced in Adobe Security Bulletin APSB15-14, issued on 2015-06-23.

→ Windows and Mac users can optionally choose the Extended Support Release, which is an old version retrofitted with the latest necessary security fixes. That one is numbered 13.0.0.296. Linux users are stuck back on Flash 11, for which the current update is 11.2.202.468.

Adobe still delivers its routine patches on Update Tuesday, the second Tuesday of every month, so last week's patch was of the unexpected, emergency sort.

Targted attacks to start with

The bug that was fixed is designated CVE-2015-3133, and it is a remote code execution (RCE) bug that Adobe admitted was "being actively exploited in the wild via limited, targeted attacks."

However, Adobe went on to temper that statement by adding, "Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets."

Whether that's because the threat mitigations in Windows 8 and above make this vulnerability too hard to exploit, or simply because the victims being targeted were known in advance to be running older versions of Windows, is not clear.

One thing is for sure, though: there's still a lot of XP about.

The announcement that the US Navy just paid for a year of extended support for XP - more than a year after official support ended anyway - was a blunt reminder of that.

As colleague Chester Wisniewski pointed out [0'43"] in this week's Chet Chat podcast:

After all the news of the breaches in all these different government agencies..., it was a little concerning to think that we're not down to the shortlist of the last 500 machines over here in the corner, but 100,000 [Navy computers] still running XP.

(Audio player above not working? Download MP3 or listen on Soundcloud.)

In fact, by some accounts, Windows XP is still more widely used worldwide than all versions of OS X out there, and only a shade behind Windows 8 and 8.1 combined.

Cybercrooks join the attacks

As documented by well-known independent malware researcher Kafeine,attack code using of the CVE-2015-3113 Flash bug has already been packaged by crooks into an exploit kit called Magnitude.

Exploit kits, don't forget, are part of the "pay-per-install" ecosystem of modern crimeware.

Instead of battling to build a specific exploit into your own malware so you can attack unsuspecting users with a drive-by download, you just buy or rent access to an exploit kit (EK).

Typically, that's a server, perhaps "borrowed" from an unsuspecting system administrator whose Linux security isn't up to scratch, that is already rigged up with malicious JavaScript pages designed to unleash any of a number of pre-packaged exploits.

The JavaScript in the EK usually tries to work out which exploits are most likely to work in a victim's browser, for example by checking version numbers and available plug-ins, and then runs the most promising exploits in turn until one of them works.

At that point, if you're the crook, it's up to you what you want the EK to deliver.

Weapon of choice

So far, it looks as though the malware of choice that's pushed out by the crooks behind these attacks is ransomware of the Crypto Defense family.

Cryptoransomware, of course, is a particularly odious sort of malware that leaves your computer running fine, but scrambles your data files and thendemands a fee for the decryption key to unlock them.

If you don't have a backup, and the crooks have done their cryptographic programming correctly, then paying up is about the only way to see your files again.

What to do?

Prevention, obviously, is what you want, especially where the data-scrambling payload of ransomware is concerned.

Here are some tips:

• If you don't need Flash, don't install it at all. To find out if you actually need it, rather than assuming you need it, try living without it for a week or two. You may get a pleasant surprise.
• If you need Flash only occasionally, use click-to-play. That's where your browser asks you every time whether you want to let a page use Flash. Or turn the Flash plugin off altogether except for the times you know you need it.
• If you have Flash, don't lag behind on updates. Even automatic updates can take a while to turn up, becaue Adobe spreads the load randomly amongst its users. You can jump the queue by checking for updates manually.
• If you're still running Windows XP, please don't. Vulnerabilities that are really difficult for crooks to exploit on Windows 7 and later - as good as impossible, in fact - can often be still turned into working attacksagainst Windows XP.
• Keep your anti-virus turned on and up-to-date. A good anti-virus can block this sort of attack at multiple points, e.g. by blocking the web page where the EK is hosted; blocking the EK's JavaScript component; blocking the Flash exploit itself; and blocking the ransomware it would grab next.
• Don't skip making backups. If you don't have a good enough backupto recover from ransomware, you are at risk of any number of other potential data disasters, too. These include accidental deletion, a failed hard drive, and a lost or stolen laptop.

NB. Sophos products block the threat components mentioned above under numerous names. Detections you may see include: Mal/ExpJS-BU (exploit kit JavaScript), Exp/20153113-A (Flash files exploiting CVE-2015-3113) and Troj/Ransom-AXO (ransomware seen in attacks).

Free Virus Removal Tool

The Sophos Free Virus Removal Tool works alongside your existing anti-virus to find and get rid of any threats lurking on your computer.

Download and run it, wait for it to grab the very latest updates from Sophos, and then let it scan through memory and your hard disk. If it finds any threats, you can click a button to clean them up.

SSCC 210 - So many cool new Windows 10 features to opt out of [PODCAST]

This weeks Sophos Security Chet Chat Episode 210 - August 5, 2015

I love that Sophos provides this information to us to learn from. It gives you deep understanding about features, issues and things that you need to think about in using and protecting your systems.

LISTEN NOW

(Audio player above not working? Download MP3 or listen on Soundcloud.)

Encrypt like everyone's watching! 60 Sec Security [VIDEO]

• By Paul Ducklin, nakedsecurity.sophos.com
• View Original
• June 27th, 2015

Watch this week's 60 Second Security...

 

→ Can't view the video on this page? Watch directly from YouTube. Can't hear the audio? Click on the Captions icon for closed captions.

The "Stagefright" hole in Android - what you need to know

The conference circuit can be a competitive arena, especially when there are multiple parallel streams.

For example, back in 2010, I was at Black Hat in Las Vegas, and I attended the talk next door to the late Barnaby Jack's now legendary "ATM Jackpotting" talk.

Jack famously made unmodified ATMs that he bought off eBay cough up banknotes live on stage.

Those of us next door had to wait until the ovation and commotion died down before our presenter could continue lecturing to his meagre audience. (At least there was a good choice of seats.)

Exploit Disclosure Silly Season

So it's not surprising that July tends to be Exploit Disclosure Silly Season.

Presenters at Black Hat and Def Con try to convince the media to tell the world that theirs is the talk to choose, stressing the severity of the hole they've found without giving too much away.

There's nothing wrong with that: good talks based on solid reverse engineering aren't easy to put together, and if you're prepared to do a live demo to go with it, you're entitled to your "jackpot" moment.

So, imagine that you've got exploit talks accepted at Black Hat and Def Con, that your hack is a remote code execution hole in the world's most widespread mobile operating system, and, best of all...

...that the operating system component in which you found the bug is called "Stagefright".

That's a better name for an exploit than POODLE or LOGJAM – heck, it's a better name than Heartbleed' (although the bugs don't really compare at all, whatever you may have read).

You can use a name like "Stagefright" in your press releases without being accused of hyperbole.

Unsurprisingly, then, that's what researchers at Zimperium have done.

They found a bunch of security holes, now designated with seven different CVE numbers (CVE-2015-1538, -1539, -3824, -3826, -3827, -3828 and -3829).

It's become the "Stagefright" hole.

Multimedia Messaging System

The bugs are in an unfortunate part of Android: a part that is used by the Multimedia Messaging System, or MMS.

Remember MMS?

Like SMS but with videos, sounds, pictures, and no annoying 160-character limit?

It's an aging system that doesn't get a lot of attention these days, because internet-based programs like WhatsApp, Snapchat and Instagram have swept it aside.

But most Android phones are still set up to receive MMS messages, and will process them automatically by default.

Technically speaking, an MMS arrives as a link, so that the actual content of the message (which might cost you money) is fetched only later on, when you decide that you want to look at it

That's a bit like email clients that fetch only subject lines at first, so you can ignore or delete unimportant messages without racking up download charges.

But the default SMS/MMS apps in Android 4.4 (KitKat) and 5.x (Lollipop) are Messaging and Hangouts respectively, and their default configuration is to download MMS content in the background as soon as the messages arrive.

Remote Code Execution

Unfortunately, the bugs found by Zimperium allow shellcode – executable instructions disguised as harmless multimedia data – to take control of your device as soon as the content of a booby-trapped message is downloaded.

So, you may be able to trigger malicious activity as soon as a victim's device receives your poisoned message, even if they later decide to delete it.

That's what's known as a Remote Code Execution (RCE) vulnerability, almost always the worst sort.

The bug has been around for some time, and Zimperium is claiming that 950,000,000 devices may be at risk.

(That precise sounding number seems to be simply a 95% vulnerability rate multiplied by a round one billion Androids.)

Patches coming

Google knows about the bugs, and has prepared patches.

Indeed, if you have a Google Nexus, and you have updated recently, it sounds as though you are already safe.

Sadly, we can't be sure which other device vendors have already patched, unless they choose to say so, because Zimperium is keeping the exploits under wraps until Black Hat, when the whole world will find out about them (and presumably, how to exploit them) at the same time.

It also sounds as though rebuilding Android from the open source project (AOSP) won't help yet.

Google told The Guardian:

This vulnerability was identified in a laboratory setting on older Android devices, and as far as we know, no one has been affected. As soon as we were made aware of the vulnerability we took immediate action and sent a fix to our partners to protect users.

As part of a regularly scheduled security update, we plan to push further safeguards to Nexus devices starting next week. And, we'll be releasing it in open source when the details are made public by the researcher at BlackHat.

In short, this sounds like a serious bug, and you should be looking for a patch as soon as you can get one.

What to do?

• Try asking your device vendor whether a patch is available already. You may be able to get ahead of the game.
• If you can't get a patch right now, find out when to expect it so that you can apply it as soon as you can.
• If your messaging app supports it (Messaging and Hangouts both do), turn off Automatically retrieve MMS messages.
• If your device supports it, consider blocking messages from unknown senders if you haven't already.
• If your SMS/MMS app doesn't allow you to turn off Automatically retrieve messages, consider simply switching back to Android Messaging, which does.

Unless your digital lifestyle hinges on MMS, we think that you will be able to live without it, and that blocking the auto-download of potentially booby-trapped MMS content is a great start.

Of course, even if you've turned MMS auto-downloading off, you still need to avoid clicking on suspicious MMSes – doing so would initiate the potentially dangerous download anyway.

So, if you see an MMS from a sender who's never communicated with you before, consider deleting it.

And don't forget that "Stagefright" isn't specific to MMS messaging, but rather to the way Android renders the sort of content typically delivered by MMS.

Firefox for Android, for example, has recently been updated; it too was apparently vulnerable via web pages containing booby-trapped videos.

So, keep your eyes peeled for those patches!

Yet Another Encryption Scam

ZDNet reports that another encryption scheme has arisen to rear its ugly head using Windows 10 upgrade as the teaser. Hackers are targeting users attempting to upgrade to Windows 10 with ransomeware malware that encrypts files until a ransom is paid. The "bad guys" appear to be impersonating Microsoft in and an attempt to grab your money. 

Emails are being sent out tempting the email recipient with an attachment that is an installer that will allow them to get the new Windows 10 operating system sooner. What is making this scheme work is the fact that Microsoft is making users wait in queue for their turn to upgrade their systems. Impatience on the part of waiting users is causing plenty of heartache for those that succomb to the tempation of running the installer.

Once you download and open the attached executable file, the malware payload opens, and begins encypting data on the affected computer and locking you out of those files.

Typically you are required to pay the ransom using bitcoin which is much harder to track. And to make it even harder to track the bad guys, they are usually using the TOR network which makes it nearly impossible to trace.

Cisco research Nick Biasini said the malware payload, called CTB-Locker, is being delivered at a "high rate." "The functionality is standard however, using asymmetric encryption that allows the adversaries to encrypt the user's files without having the decryption key reside on the infected system." 

Ransomeware attacks have been on an increase since 2014 and is a quick and easy near-untraceable way to generate a lot of money in a very short time. So hackers are going to keep coming up with new ways to attack your systems. So beware of what you are clicking on and accepting, you may their very next victim!