Breaking News

Friday, May 12, 2017

11 things you can do to protect against ransomware, including Cryptolocker


1. Back up your data
The single biggest thing that will defeat ransomware is having a regularly updated backup. If you are attacked with ransomware you may lose that document you started earlier this morning, but if you can restore your system to an earlier snapshot or clean up your machine and restore your other lost documents from backup, you can rest easy. Remember that Cryptolocker will also encrypt files on drives that are mapped. This includes any external drives such as a USB thumb drive, as well as any network or cloud file stores that you have assigned a drive letter. So, what you need is a regular backup regimen, to an external drive or backup service, one that is not assigned a drive letter or is disconnected when it is not doing backup.
The next three tips are meant to deal with how Cryptolocker has been behaving – this may not be the case forever, but these tips can help increase your overall security in small ways that help prevent against a number of different common malware techniques.
2. Show hidden file-extensions
One way that Cryptolocker frequently arrives is in a file that is named with the extension “.PDF.EXE”, counting on Window’s default behavior of hiding known file-extensions. If you re-enable the ability to see the full file-extension, it can be easier to spot suspicious files.
3. Filter EXEs in email
If your gateway mail scanner has the ability to filter files by extension, you may wish to deny mails sent with “.EXE” files, or to deny mails sent with files that have two file extensions, the last one being executable (“*.*.EXE” files, in filter-speak). If you do legitimately need to exchange executable files within your environment and are denying emails with “.EXE” files, you can do so with ZIP files (password-protected, of course) or via cloud services.
4. Disable files running from AppData/LocalAppData folders
You can create rules within Windows or with Intrusion Prevention Software, to disallow a particular, notable behavior used by Cryptolocker, which is to run its executable from the App Data or Local App Data folders. If (for some reason) you have legitimate software that you know is set to run not from the usual Program Files area but the App Data area, you will need to exclude it from this rule.
5. Use the Cryptolocker Prevention Kit
The Cryptolocker Prevention Kit is a tool created by Third Tier that automates the process of making a Group Policy to disable files running from the App Data and Local App Data folders, as well as disabling executable files from running from the Temp directory of various unzipping utilities. This tool is updated as new techniques are discovered for Cryptolocker, so you will want to check in periodically to make sure you have the latest version. If you need to create exemptions to these rules, they provide this document that explains that process.
6. Disable RDP
The Cryptolocker/Filecoder malware often accesses target machines using Remote Desktop Protocol (RDP), a Windows utility that allows others to access your desktop remotely. If you do not require the use of RDP, you can disable RDP to protect your machine from Filecoder and other RDP exploits. For instructions to do so, visit the appropriate Microsoft Knowledge Base article below:
7. Patch or Update your software
These next two tips are more general malware-related advice, which applies equally to Cryptolocker as to any malware threat. Malware authors frequently rely on people running outdated software with known vulnerabilities, which they can exploit to silently get onto your system. It can significantly decrease the potential for ransomware-pain if you make a practice of updating your software often. Some vendors release security updates on a regular basis (Microsoft and Adobe both use the second Tuesday of the month), but there are often “out-of-band” or unscheduled updates in case of emergency. Enable automatic updates if you can, or go directly to the software vendor’s website, as malware authors like to disguise their creations as software update notifications too.
8. Use a reputable security suite
It is always a good idea to have both anti-malware software and a software firewall to help you identify threats or suspicious behavior. Malware authors frequently send out new variants, to try to avoid detection, so this is why it is important to have both layers of protection. And at this point, most malware relies on remote instructions to carry out their misdeeds. If you run across a ransomware variant that is so new that it gets past anti-malware software, it may still be caught by a firewall when it attempts to connect with its Command and Control (C&C) server to receive instructions for encrypting your files.
If you find yourself in a position where you have already run a ransomware file without having performed any of the previous precautions, your options are quite a bit more limited. But all may not be lost. There are a few things you can do that might help mitigate the damage, particularly if the ransomware in question is Cryptolocker:
9. Disconnect from WiFi or unplug from the network immediately
If you run a file that you suspect may be ransomware, but you have not yet seen the characteristic ransomware screen, if you act very quickly you might be able to stop communication with the C&C server before it finish encrypting your files. If you disconnect yourself from the network immediately (have I stressed enough that this must be done right away?), you might mitigate the damage. It takes some time to encrypt all your files, so you may be able to stop it before it succeeds in garbling them all. This technique is definitely not foolproof, and you might not be sufficiently lucky or be able to move more quickly than the malware, but disconnecting from the network may be better than doing nothing.
10. Use System Restore to get back to a known-clean state
If you have System Restore enabled on your Windows machine, you might be able to take your system back to a known-clean state. But, again, you have to out-smart the malware. Newer versions of Cryptolocker can have the ability to delete “Shadow” files from System Restore, which means those files will not be there when you try to to replace your malware-damaged versions. Cryptolocker will start the deletion process whenever an executable file is run, so you will need to move very quickly as executables may be started as part of an automated process. That is to say, executable files may be run without you knowing, as a normal part of your Windows system’s operation.
11. Set the BIOS clock back
Cryptolocker has a payment timer that is generally set to 72 hours, after which time the price for your decryption key goes up significantly. (The price may vary as Bitcoin has a fairly volatile value. At the time of writing the initial price was .5 Bitcoin or $300, which then goes up to 4 Bitcoin) You can “beat the clock” somewhat, by setting the BIOS clock back to a time before the 72 hour window is up. I give this advice reluctantly, as all it can do is keep you from having to pay the higher price, and we strongly advise that you do not pay the ransom. Paying the criminals may get your data back, but there have been plenty of cases where the decryption key never arrived or where it failed to properly decrypt the files. Plus, it encourages criminal behavior! Ransoming anything is not a legitimate business practice, and the malware authors are under no obligation to do as promised – they can take your money and provide nothing in return, because there is no backlash if the criminals fail to deliver.
Read more ...

Friday, November 25, 2016

Reliance Jio 4G VoLTE technology: Here’s how voice-calls will work


Reliance Jio 4G is now open for all: From VoLTE to LTE to 4G we explain what you’re getting into with Jio service.

With Reliance Jio shaking up the market with the announcement of their 4G service, there seems to be a growing confusion among buyers regarding the technology the network will deploy. We have a small guide to help you work through the various terms such as VoLTE, LTE, 4G and the likes so that you know exactly what you’re getting into with the Reliance Jio service.

What is VoLTE?

VoLTE stands for Voice over LTE and is a new protocol for transmitting voice data over the LTE network. While 2G and 3G networks are circuit-switch based, 4G or LTE networks utilise Packet Switching. When a call is made over a 2G or a 3G network, a certain amount of network bandwidth is assigned to that call as a pipeline, which does not terminate till the call ends. On a VoLTE network, voice calls are broken up into packets of information, sent over the full data pipeline and then reconstructed at the receiver’s end. The result is that voice information can be carried over a higher bandwidth pipe, resulting in better call quality.

LTE and VoLTE is NOT the same

It is essential to understand that LTE (also referred to as 4G-LTE) is a wholly IP-based communications protocol. Existing carriers have all 2G,3G and 4G setups on their network, allowing data to go through the 4G band while pushing calls through the 2G/3G band. While LTE is the next generation data transmission protocol with higher two-way bandwidth, it is capable of only transmitting data. VoLTE is the way in which a voice call can be converted to digital packets and transmitted over the LTE network. In effect, VoLTE is a subset of the LTE technology.

Phone Compatibility

Reliance Jio’s network is purely LTE, and does not have any 2G and 3G bands and as such, calls made on this network will only be VoLTE based. Therefore, in order to use the feature, you must have a handset which is VoLTE enabled. While VoLTE is baked into most of the modern Qualcomm and several Mediatek SoCs, the feature may not be enabled on the handset and can be done so by means of a software update to be pushed out by the handset manufacturer.

A phone may be able to use the LTE network, but the VoLTE feature is separate and as such, must be enabled. If you have an LTE enabled phone, you can use the data services of the Jio SIM. In order to make calls over the Reliance Jio network, you must either use the sim in a VoLTE enabled phone, or an LTE enabled phone running the JioJoin app (available only on Android phone running Version 4.0 and up).

Turning Off Data

Its probably not the best to turn off data on your cellphone if you’re on the Reliance Jio network. Since all traffic on the network is running over a data line, disabling data would effectively put the phone in the equivalent of airplane mode. It should be mentioned that Reliance has clarified that data usage towards voice calls will not be counted towards the data allotment of the monthly plans.

HD Calling
HD Calling is being touted as a major feature of the VoLTE saga, but there is a caveat. Calls are in HD only if the parties engaged in a phone call are both on Reliance’s Jio network The call has to originate and terminate on a VoLTE enabled handset. You can still make and receive calls from other networks, but they won’t be in the higher quality standard that you can expect from a VoLTE call.



Source by indianexpress..
Read more ...
Designed By