A recent message sent to our customers...

URGENT!

Dear customer,

You may have heard about the Heart Bleed bug in the news lately. We wanted to give you a brief explanation and tell you what you should do.

What is the Heart Bleed bug?

When you go to a secure website (the ones that show a lock in your browser, and also have httpS:// in front of website name, you are establishing a secure encrypted connection. These use to be just sites that were taking credit card information but many major sites encrypt your connection all the time now (Google, Facebook, Twitter, etc.).

A problem has been found one some of the software that is used to do this. This problem, without getting into the technical explanation, could allow an attacked to get information from the server (the site your connecting to) such as your password to that site.  While just discovered, this problem has been around for about 2 years and affects about 18% of the encrypted websites on the internet.

This has been know for over a week, why should I react now?

Since it took some companies days to correct (some are still not corrected), changing your password while the problem still existed was pointless as an attacked would actually know what you changed your password to. Now that the problem is getting fixed all over the internet, its time to change passwords.

Do I have to change all my passwords?

No. But you should for major websites that either said they have the problem and fixed it or even if they didn't acknowledge it but are important sites such as banks.

Which sites specifically should i change passwords for?

Google (Gmail), Facebook, Twitter, Instagram, LinkedIn, Pinterest, Yahoo, GoDaddy, Mine Craft, Netflix, All Banks to be safe!) (More at http://tinyurl.com/HeartBleedList) You can also go to https://lastpass.com/heartbleed/ and enter a website to test if it is fixed and then change your password.

Most Importantly, your password needs to be a good one. No names, dictionary words, birth dates. Passwords should be at least 12 characters and contain Uppercase, lowercase, numbers and symbols. If you have to, write it down and keep it safe. Google Examples are "jh767!@#ds3D" or "BLUe55!$cAT!". If you want something easy to remember, use words but make it long (e.g. "WALKINGmydogis2tiring$$")

We all depend on the internet for our daily lives. Passwords may be a hassle but its better then dealing with a hacked bank account or stolen identity. 

So next month Microsoft will issues the last set up updates ever to be written for its 12 year old windows XP operating system. Should you worry? No. Should you run out to replace it? Probably. But not because they are ending support for it.

Recently Steve Gibon (@SGgrc) from GRC, a well know programmer and security consultants stated that you should not worry and got a lot of flack on twitter for that. That is what prompted me to explain this to my clients here.

First, I completely agree that there is no real reason to worry about this.  While updates will end, XP is a very mature operating system. All that is happening if when new vulnerabilities are found in XP, they will not write fixes for them. You may think that is bad but you first need to understand what these "vulnerabilities" that come up are all about.  Typically, they are exploits that can be taken advantage of by malicious software. So when you download a program from that illegal music or game site you went to, it might be able to take complete control of your PC. Or when you go to that shady website to look at things you should probably not be looking at, it may take advantage of one of the new problems that is discovered after updates end. But that's it!

If your not downloading illegal or questionable software, if your not sitting there surfing the shady parts of the web or going to sites that are, lets say, of a questionable nature then there really is nothing to worry about.

Doing your normal business like running Word, Excel, Quickbooks, Email, even surfing the web when using well known company websites (e.g. your bank, major department stores, amazon, etc) is of no more risk than it is today.  If you use your computer normally, nothing will change. Nothing!

Then why did I say you should probably upgrade? Because you should switch to a newer operating system that takes better advantage of more memory, 64bit software and that will continue to be supported for some time to come.  This does not mean you should plunk down $200 on Windows 8 to install on your current computer but instead  get it with a new computer when you are ready to upgrade. Since Windows XP, there has been Windows Vista, Windows 7 and now Windows 8.1. There is also nothing wrong with Windows 8.1 despite what you might have heard. It works well and is stable. There are just some major changes in using it that turns people off. But once you get use to the changes, it works just fine

In fact, in most businesses we completely turn OFF windows auto update feature. That's Right! We turn off the updates!  Quite often updates cause more problems than they fix.  If your computer is behind a firewall (yes, even that $39 Netgear router is a firewall.) and your running antivirus software and you just practice safe internet behavior (See Viruses and how we get them today at http://www.ineedbob.net/blog/2013/9/20/viruses-how-we-get-them-today.html) then its OK to not receive that latest updates. Often when an update installs on the second Tuesday of the month, something may cause a conflict and stop something else from working. Sometimes it even completely crashes your system. If most small businesses had all their PC's updating on their own monthly, their IT  costs would go up greatly as things would need to be fixed, software conflicts resolved and updates rolled back (uninstalled). So as IT consultants, we install critical needed updates on a case by case basis.

In conclusion, don't worry that XP wont receive any more updates. Practice safe online behavior.  If your computer is working fine, fast, reliable, don't worry about upgrading. If you feel its time for a new PC, upgrade. But don't worry about the end of support for Windows XP.

Once your computer is encrypted, the key which is what is needed to decrypt your files are stored on one of many of the bad guy computers somewhere in the world. When you pay the $300 it goes out to that server, get the key, and unlocks your files. The only good news is that it is actually doing this for many people once you pay the ransom.

More information about off site backups: http://www.ineedbob.com/ineedbobnet/backup.html

More information about Cryptolocker: http://en.wikipedia.org/wiki/CryptoLocker

Viruses these days are usually obvious. They rarely hide in the background of your computer spreading themselves. Today when you get a virus you usually know it because your computer is almost always totally unusable. It may have constant pop-ups preventing you from doing anything useful or it may be a fake warning from the FBI that illegal activity has been detected on your computer and you can pay the fine online. Often suggesting you go to a major retail store to buy Visa cards to use for the payment.  Sometimes they even hold your computer for ransom by encrypting your files so you cant use them asking you to pay to get your files back.

The #1 way to avoid getting these viruses is not anti-virus software but education.

Almost all viruses are obtained by clicking on a link or attachment in a fake email.  Emails are sent out by the millions in hopes of arriving in someones inbox at an opportune time to trick the receiving into clicking a link or opening an attached fie.

Some examples of this:
1)
A email arrives that appears to be from UPS which says they have had problems delivering a package and need to confirm your address and want you to click to confirm with UPS.COM but instead it instantly installs a virus.

2)
An email from Staples that says your order has been shipped and thanks you for your business. You wonder what order? since your didnt place one and click on the View Order link. You now have a virus.

3)
You get an email from your bank telling you that your monthly statement is ready. It looks exactly like the real one you get from your bank so you click to view the statement and you now have a virus instead.

4)
The video or picture or joke from your friend who sends things like that out all the time, except this time its because their computer got infected and the virus sent a fake joke email to everyone in their address book. So you click it thinking it will be another funny video but it turns out not to be funny at all.

So how do you avoid these viruses?

Simple. DONT CLICK LINKS IN EMAILS!

If your wondering what order shipped from Staples the go to www.staples.com and log in and check if its real.
Want to view your bank statement. Go to www.chase.com or your bank and log in and check it.
Dont click on the link in the emails!

Same goes for attachments. If you receive an email with an attachment, even from someone you know but were not expecting it, there is no message written with it or the message does not look real (e.g. It says something like "Check out this funny picture") then Dont Click On It. 

You have to avoid the impulse click. Thats the feeling you get when you read something like "UPS has attempted to deliver a package 3 times, if you dont verify your delivery address we are returning it to the shipper". You read this and quickly think "Oh Geez, i need that package" and click before you think. Then you have a virus instead of your package.

When Can I click on a link or attachment?

When you requested it. Lets say you lost your password and requested a password reset from your bank. Moments later an email arrives with a link to reset your password. You requested it, your expect it, you know its real.
You know a colleague is going to send you a file or link to something, you expect it, you know what it is.

Rule is, if you were not expecting it, if its asking you to do something to "verify" information, If its a joke or for entertainment purposes, Dont click or open that file.

Following this very basic rule will make it very unlikely you will ever get a virus as this is the primary way they spread today. Praying on your "impulse click" or need to view that funny cat video. So be smart and always suspicious.  

Back in January 2011, I wrote a post to explain which cellphone to choose, which at the time included iPhone, Android or Blackberry. 2½ years later and it still holds true. Um, except for the Blackberry part.

Your first decision today is Android or iPhone. The short answer is, Do you like technology? Gadgets? And enjoy following around with them? If the answer is Yes, then get Android. If No, then get an iPhone.

To explain...
iPhones are great. They and simple, clean and fun. The experience is the main focuse when they were designed and using them in a consistant pleasureable experience. But that comes with limits. Limits in the more advanced areas of what is possible today that can be done with these modern smartphones. But overall it, if you want a great camera, internet browser, texting device, games, apps, facebook, etc (oh yea, and a phone too) then iPhone is the way to go.  Today you have basically two choices. The 5c or 5s.  The 5s is the latest, most modern device and the way to go. If you want to save a hundred bucks or your kid loves the vibrant cololors of the 5c then thats fine too. Just not as fast or advanced but still a great phone .

Android. It does every the iPhone can and everything the iPhone can't.  You have more control over ever little setting and detail. You can customize it more and do cool things like tell it to not require a password when your home, or automatically turn off the riner when you arrive someplace like church (It knows this by the GPS location).  Dont like the on screen keyboard? replace it larger keys or a totally different keyboard style. You have the option with Android.  

Its certainly more geeky IF you want it to be. You have the option to do much more if you want too. So if you like playing around with technology and enjoy descovering the cool things you can do with a smartphone then Android is the better choice.
There are  many more choices though with Android phones, because unlike an iPhone which is only made by Apple, anyone can make an Android phone as the Android software is provided free to them from Google. So which one to choose? Well with the dozens of Android phones out there, there are only a handful to even consider as the rest as old, slow and disappointing. Here are the only ones to consider: The HTC One, Samsung Galaxy S4, and coming out shortly, the Google Nexus 5 (not out yet), and Samsung Note 3 (not out yet). There might be one or two more but these are the top of the line.
Phones like the Note 3 have large screens that give the name of Phablets. A cross between a phone and a tablet, but for many like myself, phones of this size are a complete computer in your pocket and just wonderful.

I hope this helps you to make up your mind. And no matter which you choose, be sure to spend time with your device learning all the power it has and taking full advntage of it. Remember that any of these devices are many times more powerful than the computers that put the men on the moon, and it can hang off your belt. :)