IT Managed Services Cleveland, Akron and Ohio

Hackers and cybercriminals, like most people, tend to gravitate towards high-reward activities. In this case, that means that focus is turning to creating malware that attacks the router, potentially infecting the users that leverage it to connect wirelessly to the Internet. Researchers at Kaspersky Lab recently discovered an example of such a malware, so today, we will review this threat and how to best protect your network.

Slingshot This threat, codenamed Slingshot, targets MikroTik routers and utilizes a multi-layer attack to spy on the PCs connected to the router. By replacing a library file with a malicious alternative that subsequently downloads other pieces of the malware, Slingshot is able to bypass security solutions unscathed. It then launches a two-pronged attack, one leveraging low-level kernel code to give an intruder carte blanche access to a system, the second managing the file system and preserving the malware – allowing it to continue.

If this sounds impressive, it is – not only does this attack access additional code from an encrypted virtual file system, it does so without crashing its host. This quality and complexity led the security experts at Kaspersky Lab to conclude that this attack was state-sponsored. Based on reports, this malware can collect just about any data that it wants to from its target, from keystrokes to passwords to screenshots to network traffic.

According to MicroTik, their routing firmware has received a patch for this vulnerability, but it is still unknown if routers from other manufacturers are affected. If they have, Slingshot could suddenly become a much larger issue than it already is.

Other Router Malware Of course, Slingshot isn’t the only issue that affects router security. The fail-safes and security measures baked into routers have been historically unreliable. This can largely be attributed to manufacturers building numerous products with no comprehensive strategy concerning their security and keeping it up-to-date. However, this doesn’t mean that the user is off the hook, either. It is up to them to actually update the router’s firmware, not something that is necessarily their first, second, or even twenty-third thought. Furthermore, the updating process can often be challenging, as well as time-consuming.

Hackers will often change the DNS server setting on a router in order to attack a network. Rather than directing you to the secure website you are trying to navigate to, the altered DNS will instead send you to a phishing site. Since these sites are often convincingly created and designed to fool their targets, you may not realize you are being victimized until it has already happened.

In addition to attacks like these, hackers will also often use methods like barraging their targets with ads or infiltrating them via drive-by download. Some attacks leverage cross-site request forgery, where a hacker will develop a rogue piece of JavaScript that will attempt to load a router’s web-admin page to alter the router’s settings.

How to Mitigate Damage to You If you suspect that you are the target of a router-based attack, your first step should be to confirm that something is wrong. While there are assorted ways to accomplish this, the most effective is to check if your DNS server has been changed. To check, you’ll need to access your router’s web-based setup page, and from there, the Internet connection screen. If your DNS setting is ‘automatic,’ you should be okay. However, if it says “manual,” with custom DNS servers entered, you may have a problem.

In order to mitigate damage in the case of compromise, you’ll need to make sure that your router matches the specifications set by the manufacturer. To do this, make sure you:

Promptly install firmware updates: Keeping your router’s firmware up-to-date will assist you in keeping your router secure.

Disable remote access: By disabling the capacity for your router to be accessed remotely, you prevent the chance of someone changing the settings without your knowledge.

Disable UPnP: While there is definitely some convenience to be had with the assistance of plug and play capabilities, UPnP could lead to your router becoming infected, as it is predisposed to trust any requests it receives.

Change your access credentials: A simple means of upping your security is to change your access credentials away from the router defaults.

If you want to know more about your cybersecurity, the professionals at Net Activity are there here to help you keep your network and infrastructure safe. Call us at 216-503-5150.

A lot has been written about the features and benefits of VoIP services. So, in this blog, we would concentrate on understanding the architecture and components of Voice over Internet Protocol (VoIP) services. We would consider the major components along with their individual functional characteristics.

The 4 major VoIP components include:

Signaling Gateway Controller

Media Gateway

Media Server

Application Server

SIGNALING GATEWAY CONTROLLER

The signaling gateway controller (SGC) is a known as ‘called agent’ due to its call control function and is popularly referred to as a ‘Media Gateway Controller’ because of media gateway control function included in the system. The SGC entity is the heart of VoIP platform and performs multiple roles out of which connecting the PSTN world with the IP world is its main function. Some of the main characteristics of SGC component are:

Supporting signaling system 7 (SS7) protocol stack

Supporting voice call control protocols such as H.323 or SIP

Supporting media control protocols such as Megaco (H.248) or MGCP

Generating detail call records

Providing bandwidth management control using admission control mechanisms

Supporting bandwidth policing mechanisms

Allocating media connections

MEDIA GATEWAY

The transmission of voice packets is performed by the media gateway by using RTP transmission protocol. The media gateway performs extra functions such as packetization when it’s used in a converged IP/PSTN network. It requires using IP trunks on one side and TDM trunks from the other. Some functions of the media gateway can be listed as below:

Supporting MEGACO or MGCP

Transmitting voice data using RTP

Supporting E1/T1 Trunks

Supporting various compression algorithms

Managing digital signal processing (DSP) resources

MEDIA SERVER

The role of media server comes into the picture when additional features such as video conferencing or voicemail is needed. It also assists when announcements or special tones need to be transmitted. Media server performs the following functions:

Voice activated dialing

Voicemail function

Transmitting customized call progress tones or special service announcements

Transmitting voicemail to email

Supporting Interactive Voice Response (IVR)

APPLICATION SERVER

Application Server takes the responsibility to provide value-added services to the IP network. The server provisions both – customer specific and global services. Moreover, session specifications and call characteristics are also influenced by the application server. Below are its main functions:

Offering basic services like call forwarding, call waiting, call transfer, etc.

Supporting private dialing plans

Generating call detail records (CDR)

Free Phone service

Once you opt for VoIP phone services, it is important to decide on a reliable VoIP service provider who can assist you with business-specific requirements and provide cost-effective services to your business. The Net Activity team is well-versed and well-equipped to serve your organization with a functional VoIP system. Please visit http://www.netactivity.us/services/voip-business-phone-services to know the details or contact Harry Bhatia at 888-545-5346.

IT managers usually face the fiscal pressure of reducing costs while improving operational efficiency. One of the major costs involves repairing and replacing system hardware components. Strategies that help in extending legacy hardware life cycles are gaining popularity. They allow organizations to continue using the hardware for a longer duration and thereby minimize the cost of IT.  While it’s difficult to maintain a balance between legacy and contemporary hardware, this complex environment invites major challenges, this complex environment is important to maximize the value of data center systems.

All of these strategies that aim at extending hardware life cycles focus on having alternative hardware maintenance plans. A major problem here is relying too much on the OEMs (original equipment manufacturers). They undoubtedly offer best-of-the-class experience; however depending solely on the OEMs would leave the hardware uncovered once the end-of-service-life date arrives. Moreover, the extended warranties are way too expensive. A better solution would be to hire the services of third party providers. Let’s see how…

Reduced Costs

Cash is often a huge concern and bottom line for IT managers while aligning operations and business priorities. Getting Dell, HP, EMC support from third party IT Managed Service providers seems to be more budget-friendly.

Simplified Approach

While concerning with OEMs for managing extended warranties of the hardware of your data centers is difficult. It leaves the IT managers confused with many points of contact and complexity that eventually increases the gap. A third-party provider possess the capability to handle multiple device types at a time ensuring that the IT managers focus on their core tasks rather than communicating with many points of contact at the OEMs.

Flexibility

OEMs have their support models. However, they concentrate more on their business’ core competency – selling hardware. Maintenance is the secondary goal and they often have rigid maintenance plans while they strive to excel in their primary goals i.e. the operational sales. IT managed service providers promote support activities as their core competency and therefore can adapt easily to different client demands. IT managers can be more comfortable working with these third-party providers.

Value Addition

A third-party IT maintenance provider offers reliable plans at the best market value. A partnership with them also gives IT managers the access to refurbished parts, making component purchasing decisions, migrating data, and help them move hardware between facilities.

AVAR SECURITY SEMINAR Learn about security from the #FBI, #Cuyahoga County Security Officer, #Datto & #Sophos 

We often hear in the news costly business disasters due to infected IT and mostly the losses are too big to overcome. Most of the time the IT disaster is harmful to an extent that data cannot be recovered and so, it is very important to have a disaster recovery plan.

Although planning for the unexpected can be difficult, it shields you when a natural or man-made disaster happens. It’s unpredictable as to how likely your organization is prone to cyber-attacks, it is vital for every organization must take IT disaster recovery and prevention as its primary objective. Here’s why:

HARDWARE IS BOUND TO FAIL

While IT hardware is built with the most secure practices and using tough components, there are doorways to peep in. Internet connections are a profound source of these kinds of interventions and disaster recovery plan is the only way to save the priceless data from being corrupted. A more sensible option is to have your data regularly backed-up by outsourcing your IT infrastructure to a Disaster Recovery service provider rather than building your own data center.

TO ERR IS HUMAN

Much like machines, humans also are not perfect. So, a disaster recovery system is essential that will keep log files by creating online backups and letting you restore files easily.

CUSTOMERS EXPECT PERFECT, ON-TIME DELIVERY

Customers have an advantage today as there are many options available in the market. If you can’t deliver on time, your competitor will. So, being prepared with a disaster recovery plan is always a good idea. You cannot complain about your anomalies to customers.

LOSING CUSTOMERS IS DEVASTATINGLY EXPENSIVE

It is widely known that retaining a customer is comparatively cheaper than re-acquisition of an old customer after an IT disaster. Customers maybe disgruntled when they learn that the organization they rely upon does not have enough security to secure their data. So, it is recommended to have a plan to detect defects long before they cause lasting damage to your business.

Net Activity, Inc. understands IT loopholes better and serves their best to shield you with proven disaster recovery plans and online backup systems. We are a company that has been providing IT Managed Services across the country since 2002 and ensure that your IT infrastructure remains safe and healthy.  Contact Net Activity today at 216-503-5150 to set up a Disaster Recovery Plan.

Recently, the FBI and The Department of Homeland Security (DHS) issued alerts to warn people of two types of malicious software or malware that the North Korean hackers are using to attack telecom, media, aviation, and finance industries.

One of the malwares is known as FALLCHILL and has been in use since 2016. It facilitates hackers to get access of and monitor infected computers remotely. The malware spreads when users accidentally download it by visiting infected websites. The DHS and FBI also mentioned that FALLCHILL uses multiple layers of ‘proxy malware’ to conceal its origin and makes it even more difficult to trace the hackers.

Another type of malware introduced by the North Korean hackers, named VOLGMER uses a spear phishing technique to infect computers. It sends a legitimate-looking email with a link that spreads the virus when clicked on. The US authorities say that North Korean computer hackers have been using this malware since 2013.

According to the DHS and FBI identified both the above mentioned malwares to be in association with HIDDEN COBRA, a term used by the US government to refer to the “suspicious & malicious cyber activity by the North Korean government.” In the recent years, North Korea has been linked to a few of the most high-profile, destructive cyber attacks that includes a $101 million theft from Bangladesh’s Central Bank in the year 2016, an attack on movie studio – Sony Pictures in 2014 and several disruptions to its neighbor South Korea’s systems. These hackers also have been accused of being the mind behind Wannacry Ransomware attack in May 2017 that caused a terrible loss to hundreds and thousands of computers across the world.

The North Korean cyber attacks have been making headlines for quite some time. However, the countries that are capable of doing so are constantly tracking, watching and spying on the capabilities of other countries. They usually attack the countries that fall beyond its immediate borders with cyber intrusions or missiles.

Net Activity, Inc. is protecting businesses of such kind of malware attacks since 2002 and has proven the competence of its IT Managed Services at the time of cyber attacks. Secure your network and hardware system before a malware takes its control. Contact Net Activity today at 216-503-5150 to learn how to protect your business from these malicious attacks.