Nomerel Blog -

Anatomy of a Phishing Email

Protips • Comments Off on Anatomy of a Phishing Email
One of our employees received a phishing email today that was so obviously bad, we decided to make an example of it. We had recently written about the importance of email savvy for employees of any company, and how to be skeptical of emails you receive. This example gave us the opportunity to annotate and explain the many ways to spot malicious emails and avoid stepping into those traps.

We’ll begin with the email as we received it. Do you see any indications that the email might be illegitimate?

It may be interesting to forward this article to your coworkers and friends, and compare notes. For example, how long did it take you to spot the first sign that the email may not be for real? How many signs did you see? Which one stood out first?

Here’s the same email with annotations – you can grade your own observations and degree of skepticism against this list:
1. Dropbox was spelled with parenthesees (i.e. Dropb()x). This is done to try to avoid any email content filters expecting to see these words spelled correctly.
2. The sender’s name was created to look like it contained the email address information – that’s actually done by Outlook in this case – see #4. It’s also nonsensical. “noreply-banacealert”?
3. They didn’t misspell the fake email domain the same way twice. Once used parenthesees for the second “O”, the other for the first.
4. The actual sender’s email address is shown by Outlook in the box. It obviously has nothing to do with Dropbox. Given that it does show a valid-looking email address, it’s safe to assume that the owner of that email address has been compromised. Either they have malware on their computer, or their password is known. On a company email account, this can result in your entire company being blacklisted. This would mean no emails you send would be accepted by other companies using email SPAM filters.
5. The subject doesn’t make a great deal of sense – a very generic statement. Note #6 though…
6. The name of the document in the body of the email doesn’t match what’s in the subject.
7. The name “dropbox” isn’t even capitalized. That shift key must have been pretty heavy.
8. Hovering over the “CLICK HERE” link reveals the site they want you to visit. It’s obviously not Dropbox. It is however a website that’s been compromised by an attacker, who is using it for criminal purposes – probably without the website’s owner even knowing. ALWAYS check the link before clicking!
So, how did you do? Hopefully you’ll be better at spotting more carefully crafted phishing emails in the future.

What about your company – how confident are you that your web servers aren’t hosting fake sites like the ones linked in the email above? How confident are you that your mail system, and your employee PCs, aren’t silently sending out these sorts of phishing emails? Is your company’s email domain at risk of ending up on a blacklist?

At Nomerel, we provide peace of mind for business owners that their systems are secure and protected against these sorts of risks. Contact us today to learn more!
On August 4, 2017
By Mark Rush
Read More »
Protect Employees From Ransomware Through Email Savvy

News, Protips • Comments Off on Protect Employees From Ransomware Through Email Savvy
Security experts will tell you that the last line of defense against cyber attack, especially through email, is the human being. No matter how good your systems are, if someone clicks on the wrong link at the wrong time, it’s game over.

A company called KnowBe4 which does “safe” testing of a company’s employees to see who may need some cyber awareness training, released a list of the top-10 most clicked email subject lines for the second quarter of 2017. The results are a great insight into the tactics used by attackers, who only need to find one person in an organization willing to click their link.

The list is summarized below, with the percentage of people who clicked on links contained in emails with these subjects:
- Security Alert – 21%
- Revised Vacation & Sick Time Policy – 14%
- UPS Label Delivery 1ZBE312TNY00015011 – 10%
- BREAKING: United Airlines Passenger Dies from Brain Hemorrhage – VIDEO – 10%
- A Delivery Attempt was made – 10%
- All Employees: Update your Healthcare Info – 9%
- Change of Password Required Immediately – 8%
- Password Check Required Immediately – 7%
- Unusual sign-in activity – 6%
- Urgent Action Required – 6%
What complicates matters even further is that many people believe emails which come from people they trust are therefore trustworthy. Unfortunately, nobody checks your ID’s when sending email on the internet. An attacker (or indeed anyone) can pretend they’re sending an email as anyone else, with ease.

The lesson of course is that it’s better to be safe than sorry! We always reinforce the points below regarding safe email practices for employees:
- Be skeptical about emails in general
- Pay more attention to shady subjects than who the sender is
- Train yourself on how to spot “bait” in email subjects or website links
- Train yourself to look at the full email address, not just the name, to spot fakers
- When in doubt, don’t click!
On July 21, 2017
By Mark Rush
Read More »
Deja Vu – Petya Cyber Attack Same as WannaCry

News • Comments Off on Deja Vu – Petya Cyber Attack Same as WannaCry

Today’s news of the Petya cyber attack in the Ukraine and Europe was a predictable follow-up to the WannaCry cryptoware outbreak from earlier this year. As security vendor Palo Alto notes, the method used by Petya is exactly the same as WannaCry, and can be dealt with using the same measures.

While the perpetrators of WannaCry tripped on their own shoelaces, another wave of similar attacks – relying on un-patched computers – seemed inevitable. Preying on vulnerable computers faster than companies can protect them is a part of the new cyber crime economy. This naturally creates a tremendous risk to small business owners, who seldom have the time or skills necessary to stay ahead of the game. After all, even the largest organizations seem to struggle with patching their computers.

You may be interested in the guidance from our article outlining considerations for cryptoware in business terms. That article was written in May, regarding the WannaCry outbreak.

Writing about the massive outbreak last month, we said that companies deserve a simple answer to the question “are my systems free from this risk?” So we’ve decided to renew our offer to help you answer that question.

For any company who needs it, we’ll provide a free, zero-obligation analysis of your systems’ vulnerability to the WannaCry ransomware outbreak.

You can schedule a visit with us at our online booking page at this link. We’ll come out and run a tool we’ve made available to ascertain the health of any given Windows computer.

Our customers are protected from the exploits used by both WannaCry and Petya, unlike hundreds of thousands of other entities around the world. We’d love the opportunity to help you, even if it’s in a small way, be confident that this issue won’t affect you either.

On June 27, 2017
By Mark Rush
Read More »
Free WannaCry Analysis For Your Business

News • Comments Off on Free WannaCry Analysis For Your Business

The outbreak of WannaCry (a.k.a. WannaCrypt or WCry) over the past few days is still making global headlines. In the media rush to cover the story, there has been a lot of mis-information being repeated. For example, some people believe that if they’re on a newer version of Windows, they’re safe. However, even Microsoft advises applying a series of patches (released in March) to ensure this vulnerability is closed. It’s not easy to know who or what to believe. We think that companies deserve a simple answer to the question “are my systems free from this risk?”

That’s why we’re offering to any company who needs it, a free, zero-obligation analysis of your systems’ vulnerability to the WannaCry ransomware outbreak. All you have to do is email or call us to set up a quick appointment. We’ll schedule a time to briefly discuss your systems, and run a tool we’ve made available to ascertain the health of any given Windows computer.

During a panel discussion on the talk radio show “1A” this morning, guest Michael Greenberger (Founder and director, University of Maryland Center for Health and Homeland Security) clearly noted the problem facing virtually every small company when faced with these sorts of I.T. challenges:

“The other thing that’s gotta be remembered, and we’re seeing in real-world practices, not everybody protecting their network is a Fortune 500 company. You’ve got a lot of small businesses out there, who just do not have the resources – even if they’re told this is what you must do – they are so far outside the capability of doing it, that they’re just not going to do it.”

(You can hear this part of the segment at around the 19-minute mark at the link)

Our customers’ weren’t interrupted on Mother’s Day to deal with the WannaCry ransomware problem, unlike hundreds of thousands of other entities around the world. We’d love the opportunity to help you, even if it’s in a small way, be confident that this issue won’t affect you either.

On May 16, 2017
By Mark Rush
Read More »
WannaCry Cryptoware, In Business Terms

News, Protips, Thoughts • Comments Off on WannaCry Cryptoware, In Business Terms
The news media has made “WannaCry” a household name over the weekend, to the joy and fear of I.T. pros everywhere. On one hand, techies have a great opportunity to talk about managing risks and presenting their lovely solutions! On the other hand, they’re dealing with things that distract from your core mission – running a business.

Over the coming weeks, we’ll be discussing the WannaCry outbreak with our MSP customers as part of our Virtual CIO offering. We’re going to be re-checking that each customer has a specific plan, appropriate to their needs, for dealing with these types of risks. Of course, this is just the latest example of how malware and ransomware have organizations losing sleep, so our discussions will involve the broader subject of protecting against cyber risks. Through those discussions, we’ll be helping customers to answer some of the following questions – maybe they can help you think about your own I.T. situation:
1. Should you just pay the ransom?
2. Could your backups be locked out too? If so, how do you restore?
3. Are your systems being patched and updated, reliably?
4. Do employees know how to be skeptical of email and attachments?
5. If you do need to revert to backups, how long will you be down? What are you actually restoring?
6. Once a computer has been infected, can you ever really trust it again?
We’re confident that the systems we put in place for customers will provide a solid foundation upon which they can make business decisions for dealing with these situations. How about yours?

Sometimes pundits will offer flippant responses to the question of “what do we do when we get hit?” such as restore from your last good backup, make sure you have good email filtering and anti-malware installed, be on current versions of software and always patch. These are merely platitudes.

In short, business leaders need to realize that any malware event like WannaCry is bad news. It means lost revenue, lost productivity, and lost profit. It means your business isn’t able to run. It means employees moods will worsen. Even if you have great backups, even if you have great tools, even if you don’t have to pay the ransom, the impacts are real.

Companies who plan accordingly, who implement smart protective measures, and who are able to stay on top of their systems will have a competitive advantage in their market. The less of your time and money you have to spend to gain this advantage, the better off you will be.

Nomerel can help companies of any size obtain the peace-of-mind that comes from having good systems, well implemented, and a solid plan in-place to minimize disruptions – from WannaCry, or any other form of malware. See how we can help you out as well.
On May 15, 2017
By Mark Rush
Read More »
You’re not Patching? You Must Be Rich!

Thoughts • Comments Off on You’re not Patching? You Must Be Rich!

Last month we posted an article about how patching your computers is difficult and cumbersome, but also extremely important. It didn’t take long for the news to catch up with us. Today’s example of just how quickly things go bad when you aren’t keeping up with security patches comes to us from England, where at least 16 hospitals had to divert emergency patients due to a ransomware problem.

In this case, attackers exploited a Windows vulnerability for which Microsoft had issued a patch…two months ago.

We often talk to customers about these risks, and how “patch Tuesday” release notices are a sort of treasure map. Attackers know that they only need to target new vulnerabilities faster than you can close them. Today’s attack is a chilling reminder of these truths. It has happened to a large institution with a dedicated I.T. team, and very shortly after the vulnerability was disclosed.

Worse yet, for those still using Windows XP and Server 2003, there is no defense against these sorts of attacks. Microsoft has given up on issuing security updates for them long ago. If an attacker can compromise a Windows XP or Server 2003 system, they have a clear path to wreak havoc on every other computer on the network – even the new ones.

The cost in terms of time, money, lost productivity, and things like morale & reputation for dealing with a ransomware or malware outbreak is many times higher than the cost of designing and maintaining I.T. systems to be protected from them. Using a trusted adviser like Nomerel brings those costs down even further. Which raises a question – if you know all this and you still aren’t patching, it’s probably not because you’re rich. It’s probably because you need help making it happen. In which case, we should be talking about how we can help simplify this part of your business life.

On May 12, 2017
By Mark Rush
Read More »
Uptick in Phishing Emails

News • Comments Off on Uptick in Phishing Emails

A couple of our Office 365 customers are seeing a sudden increase of phishing emails lately. These emails appear to come from Microsoft and look very legitimate, but contain links to malicious websites. The trend began in the past couple of weeks, and has been very persistent. A common theme seems to involve telling a person that their email quota has been filled, and they need to “click here” to upgrade.

We often advise customers to be skeptical of email messages, particularly ones that contain links and are unexpected or seem out of place. In both cases, our customers forwarded the messages to us with the question “should we be concerned about this?” That’s exactly the right thing to do when in doubt, and more often than not, one should probably be in doubt!

We work hard to instill our customers with a sense of calm and stability regarding technology, and we work hard to ensure our customers aren’t required to participate in maintenance activities. It’s because of these reasons that, for our customers, phishing emails like these look so suspicious. A skeptical customer is a happy customer!

On May 11, 2017
By Mark Rush
Read More »
Old Windows Versions and Existential Threats

Thoughts • Comments Off on Old Windows Versions and Existential Threats

We’re seeing more notices from the last of our providers who ‘supported’ Windows XP and Server 2003 that the clock has struck midnight for those aging systems. This is of course not a surprise – we’ve heard and even echoed these warnings for years – but it’s another reminder that XP & 2003 are still problems for SMBs.

What concerns us most is the tremendous risk these systems represent at small & medium businesses – risks that some owners may not be aware of, or know of and want to avoid, but don’t know where to turn or are afraid they cannot afford to deal with them.

An ‘existential threat’ is something that if it occurred, would likely mean the end for your business – a situation so dire, there would be no recovering from it. While we try to avoid hyperbole wherever possible, sometimes we need to use dire terms to adequately convey the sentiment. We refer to the continued use of Windows XP and Windows Server 2003 using that exact phrase. Put simply, every day a company remains on Windows XP or Server 2003 is another day they are at a heightened risk of a failure occurring which could mean the unplanned demise of their business.

Assuming the worst happens and those systems are rendered permanently inoperable, it’s important to know that you’re going to be forced to start over from scratch. You can’t get another computer running an OS that old, so you’re going to be forced into upgrade no matter what. The problem with upgrades is that you may have applications that must be upgraded too, because old versions of applications won’t run on new systems, or vice-versa. Starting to get complicated, isn’t it.

But what about your backups? Sadly, even if you do have good backups, if your hardware has failed, where do you restore them? It can sometimes take weeks for new server hardware to arrive, and if your servers are too old to have a hardware warranty, you really have no other option. If your PCs running Windows XP fail, it’s obviously easier to replace the hardware, but do you know whether there are any files or programs on it that weren’t backed up? When was the last time you tried doing a restore of your backups, anyway?

You may have to spend days, weeks, or even months rebuilding your Windows Server infrastructure, upgrading applications, and doing all of the other time-consuming upgrades you’ve been putting off, just to get your company back up and running. Keep in mind, you’ll be paying premium prices for the equipment and services needed to get you up and running again, because nothing is cheap in an emergency.

At a company with 10 employees, it could cost over $400 per hour while you’re down. That’s $16,000 a week in lost productivity – more than enough to buy new everything today. During that time while your employees are far less productive, will you be able to conduct any business as usual? Will you be able to send out invoices or place orders, even send or receive email? You may very well lose data – is that OK? Is any of it worth the risk?

These concerns extend well beyond technology though. While you’re sorting through what to do next, you still have a business to run and employees to retain. Can you afford to pay them while your technology isn’t working, for days, weeks, or months? If the outage runs longer than a few days and you need to lay them off, what will they do? What will you do? If you can’t retain them, what other new risks or problems will you have to deal with?

As unlikely as it sounds, sometimes a single old server that finally kicks the bucket could well mean the end of your company, if you let it.

If this sounds like it could be a problem for you, don’t fret. It’s solvable, and it can be done with a lot less pain and suffering than you might think. As long as these problems are dealt with before they come to pass, we can fix them in such a way that your business will barely notice a hiccup at all. It’s what we do for customers every day.

Reach out to us today so we can talk about it with you, via sales@nomerel.com or by phone at 918-770-4099.

On April 18, 2017
By Mark Rush
Read More »
Outlook 2016 Protip – Easy Attachments

Protips • Comments Off on Outlook 2016 Protip – Easy Attachments

Adding an attachment to an email in earlier versions of Outlook used to be so terrible, that I would always either open the folder containing the file I want to send and do drag & drop into a new message, or just right-click on the file and choose Send To -> Mail Recipient.

Well, they’ve made a big improvement in Outlook 2016 – if you haven’t upgraded or aren’t on Office 365, you’re missing out!

The “Attach File” button on the menu ribbon now opens up a (long) list of the most recent files you’ve been working on. You can include any of them with just one click each. Of course, if you still need to browse for it, you can do that too.

If you’re like me, you develop muscle memory for doing repetitive tasks like this, kind of like not using your index finger because it has a splinter in it. I was happy that my Outlook splinter was removed, and hope this helps to make life simpler for some of you as well!

On April 14, 2017
By Mark Rush
Read More »
The Worst Part of IT – Patching

News, Thoughts • Comments Off on The Worst Part of IT – Patching

Noted security expert Brian Krebs does a good job of keeping people abreast of actionable security issues, such as the release of fixes for vulnerabilities that can be easily exploited with tremendous effect. Today’s post of his is no exception. When Adobe and Microsoft release these patches, it affects virtually everyone who uses a computer.

Unfortunately, for many companies, patching is tough to do well. Sometimes because the toolsets aren’t good, and sometimes because they don’t have the time or expertise to establish good systems for keeping current.

The downside of not staying current with critical security updates, is that attackers have a precise map of exactly how to attack computers – these maps are drawn by software companies who detail exactly which vulnerabilities are being patched next, at which point the arms race begins. If you don’t patch holes before they exploit them, you lose. Cryptolocker, anyone?

Ensuring that our customers’ systems are always protected against these types of attacks, through patching and best-practice setup of their environments – is one of those unappreciated behind-the-scenes jobs we do. It’s just another way we deliver simplicity as a service. If your patching situation leaves something to be desired, we can help!

On April 12, 2017
By Mark Rush
Read More »

1 2 Next

Nomerel Blog -

Subscribe to Blog via Email