Google Chrome, Microsoft Edge, Mozilla Firefox and Apple’s Safari browser have all been impacted by a single zero-day vulnerability. The flaw, tracked as CVE-2023-4863, is caused by a heap buffer overflow in the WebP code library. Once exploited it can lead to system crashes and arbitrary code execution, where hackers can gain control over an infected device.

Where Does it Originate?

CVE-2023-4863 was first identified by researchers at The Citizen Lab, a research arm of the University of Toronto. The institution subsequently informed Google and Apple of the vulnerability’s existence. Both companies have now released patches. They were joined by Mozilla, which released its own advisory on CVE-2023-4863 yesterday and updates for several versions of its Firefox browser and Thunderbird email client, and Microsoft.

Vulnerability Originates In Webp Reader. Users of the affected browsers should update to the most up-to-date version in order to ensure the zero-day vulnerability is patched on their machines. The problem isn’t with the browsers — the vulnerability originates in the WebP Codec. Many applications use the WebP codec and libwebp library to render WebP images.

In more detail, a heap buffer overflow in WebP allowed attackers to perform an out-of-bounds memory write. A heap buffer overflow allows attackers to insert malicious code by “overflowing” the amount of data in a program. Since this particular heap buffer overflow targets the codec (essentially a translator that lets a computer render WebP images), the attacker could create an image in which malicious code is embedded. From there, they could steal data or infect the computer with malware. The vulnerability was first detected by the Apple Security Engineering and Architecture team and The Citizen Lab at The University of Toronto on September 6.

How Dangerous Is This Flaw?

Since many browsers, including Microsoft Edge, Brave, Opera, and Vivaldi are built on the Chromium platform, the same platform that Chrome is based on, this could affect their users as well. The same risk is also applicable for Firefox browser clones.

Such a widespread exploit in ubiquitously used software is dangerous, widening the attack surface for most organizations.

Patching will mitigate the risk, but users must act quickly as hackers will already be at work. Attackers will be working over the coming days and weeks to make the exploit more reliable meaning remote code execution will be more likely. Modern web browsers are exceptionally good at pushing out security updates rapidly and applying them as quickly as practicable, so users will shortly be protected.

The biggest risk is to organizations which don’t allow automatic updates and push out updates at their own release schedule.

What Steps Should You Take?

Google, Mozilla, Brave, Microsoft and Tor have released security patches for this vulnerability. Individuals running those apps should update to the latest version. In the case of other applications, this is an ongoing vulnerability for which patches may not exist; NIST noted that the vulnerability has not yet received full analysis.

If you are already a Managed Services client, please follow the steps below to check for updates

Google Chrome – Click the 3 dots in the top right corner for the menu and choose Help->About Google Chrome.  Chrome will check and install updates automatically from this screen.

Microsoft Edge – Click the 3 dots in the top right corner for the menu and choose Help and feedback->About Microsoft Edge.  Edge will check and install updates automatically from this screen.

Mozilla Firefox – Click the 3 lines in the top right corner for the menu and choose Help->About Firefox.  Firefox will check and install updates automatically from this screen.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990

Microsoft Office 2013 was a popular productivity suite that included several essential tools such as Word, Excel, PowerPoint, and Outlook. It was released in 2013 and was widely used by individuals, businesses, and organizations of all sizes. However, like all software products, Microsoft Office 2013 has reached its end of life, and users are now advised to upgrade to Microsoft 365, the cloud-based version of Microsoft Office.

What Does End of Support Mean?

End of life, or EOL, refers to the point in time when a software product is no longer supported by the manufacturer. In the case of Microsoft Office 2013, this means that Microsoft will no longer provide technical support, bug fixes, security updates, or new features for this product. This makes the software more vulnerable to cyberattacks, viruses, and malware. Continuing to use Microsoft Office 2013 after the end of life date could result in data loss, security breaches, and other serious problems.

• This means that Microsoft will no longer provide any updates or support for this software product beyond this date. Users who continue to use Microsoft Office 2013 after this date do so at their own risk.

If you’re using Office 2013, it’s probably a good time to upgrade your version of Microsoft Office.

Upgrade Options

The best way to protect yourself and your organization is to upgrade to a newer version of Office:

• Cloud upgrade: Subscriptions to Microsoft 365
• Box Version: Microsoft Home And Business 2021

Microsoft 365

Microsoft 365 is an all-in-one cloud solution with a number of different licensing options to fit your organization’s needs. The best part about cloud-based applications is that you no longer have to worry about retirements, patches, and end of support. Cloud licenses are automatically updated with new features, new applications, and security updates. Many cloud subscriptions also include installed (or desktop) versions of the application, so you can have the same look and feel of the Office applications you are accustomed to using, but built with more robust features and benefits.

Microsoft Home And Business 2021

Office Home and Business 2021 is for families and small businesses who want classic Office apps and email. It includes Word, Excel, PowerPoint, and Outlook for Windows 11 and Windows 10. A one-time purchase installed on 1 PC or Mac for use at home or work.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.

Microsoft has released emergency out-of-band (OOB) updates to address multiple issues caused by Windows Updates issued during the January 2022 Patch Tuesday.

This update addresses issues related to VPN connectivity, Windows Server Domain Controllers restarting, Virtual Machines start failures, and ReFS-formatted removable media failing to mount.

All OOB updates released are available for download on the Microsoft Update Catalog, and some of them can also be installed directly through Windows Update as optional updates. You will have to manually check for updates if you want to install the emergency fixes through Windows Update because they are optional updates and will not install automatically.

Windows 10 – KB5010793
Details Here

Option 1: Run Windows Update, KB5010793 will appear under optional download.

Option 2: Download the patch from there: Microsoft Update Catalog
Please download the matching Windows 10 Version.

Windows 11 – KB5010795 or KB5008353 (may vary based on Windows Edition)
Details Here

Option 1: Run Windows Update, KB5010795 will appear under optional download. Select and install.

Option 2: Download the patch from there: Microsoft Update Catalog

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.

6 Microsoft Teams features Zoom doesn’t have

One of the major news in March 2016 was that Microsoft was considering bidding $8 billion to purchase Slack. However, Bill Gates and the team decided that instead of buying Slack, they would develop their own chat app tool. Teams is mostly a Slack alternative, but it’s also meant to replace Skype for Business, which up until recently was Microsoft’s corporate video conferencing service. The app’s main functionality is the group chat that comes with plenty of features. Some of these features include editing, deleting, pinning messages, as well as starting a new thread and sharing files. You can even send .gif images, as well as emojis. Possibly due to Skype’s legacy, Teams includes a bunch of video features that Zoom doesn’t. There are real-time captions, built-in meeting notes, and a bizarre feature where you can pretend you’re in the same room as your coworkers!

To be clear: Zoom is a perfectly capable and liked solution. That doesn’t mean other apps are not offering anything interesting, and Microsoft in particular is trying a bunch of new things in the space. Here are a few highlights.

1. Built-in meeting notes
2. Persistent chat with rich formatting
3. Blurred background
4. Virtual classroom with your coworkers
5. Live captions
6. Included with Microsoft subscription

1. Built-in meeting notes

Zoom is a video conferencing app—and that’s about it. What happens if you’re in the middle of an important meeting, but need a way to take some notes? You think you’d have to use Microsoft Word or another program, but did you know that Teams has its own meeting notes feature, too? Microsoft Teams is built around the idea that it will be the all in one tool you use for all collaboration: team chat, video calls, and even internal documentation.

Click Meeting notes, and a new tab for meeting minutes will be created in the current channel.

Notes get saved as part of the meeting itself, and can go anywhere with you, and will be saved for later or for sharing with your coworkers.

This is a quick way to ensure there’s a written record of the meeting in a place where everyone can access it, which is very slick.

Meeting Notes in Teams is a great way to capture every detail about your meetings on the platform. You can take and access notes before, during, and after a meeting in Teams. So, keep all your notes in one place while sharing them with your colleagues.

2. Persistent chat with rich formatting 

Zoom chat is very simple. Microsoft Teams’ chat for meetings, on the other hand, has more formatting features than AIM.

We’re not sure if you have the multitasking skills to format text during a meeting, but it’s there if you want it. And this is just the beginning—there’s a large sticker collection and, for some reason, a meme creator. Imagine how much fun this can make your meetings!

Microsoft Teams also keeps a record of the chat from every meeting and posts all comments in the channel.

Have you ever lost track of helpful links and information during a Zoom meeting? With Teams, you can review the comments after the meeting, and any points made there can be found using search alongside the rest of your chats. It’s easy to see why this is useful.

3. Blur your background

Zoom backgrounds are, at this point, an important part of our collective human culture—the ultimate form of self-expression. With this best practice, you can have your meeting almost anywhere, and disguise whatever happens in the background around you. Naturally, Microsoft Teams offers custom backgrounds for meetings.

4. Pretend you’re in the same room as your coworkers

Zoom  has two views that you can switch between. Speaker View and Gallery View: essentially, you can see the person talking right now or see everyone at once. Microsoft Teams adds another: Together Mode. Everyone on the call is shown as though they’re sitting next to each other in some kind of classroom, or sporting event like we’ve seen on TV with the NBA,MLB, NHS and NFL.

This is optional, and turning it on only changes things on your screen. 

Is this useful? No. Will it make you feel slightly less alone during a year in which in-person interaction is rare? No. Is it somewhat amusing? Yes.

5. Live captions

Teams can detect what’s said in a meeting and present real-time captions. And, if you’ve turned on the new meeting experience, your captions will include speaker attribution—so you’ll see not only what’s being said, but who’s saying it. 

Zoom offers a closed captioning feature, but someone has to manually type them out. Microsoft’s system recognizes speech automatically. Live captions can make your meeting more inclusive to participants who are deaf or hard-of-hearing, people with different levels of language proficiency, and participants in loud places by giving them another way to follow along.

6. There’s a good chance you’re already paying for it

Zoom is free, but the free version limits meetings to 40 minutes. Microsoft Teams’ free version has no such restrictions for video meetings.

There’s also a good chance you’re already paying for the full version. Microsoft Teams is included with every version of Microsoft 365 for business. This means that, if your company pays for a Microsoft Office subscription, you already have access to Teams. You should probably give it a chance and consider not paying for Zoom and/or Slack on top of it.

Features

• Group and private chat.
• Video calling, audio calling, and screen sharing.
• Schedule video calling.
• Thread messaging.
• Works seamlessly with any other Office app.
• Up to 250 people per video call.
• Over 270 integrations.
• Available in 53 languages.

Best for

• Microsoft-centric teams.
• Organizations that want to keep ideas organized and compartmentalized.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.

As school, socializing, and many aspects of life have moved online this year, it’s more important than ever that you protect your digital devices and steer clear of cybercriminals. Computer security threats are relentlessly inventive. Masters of disguise and manipulation, these threats constantly evolve to find new ways to annoy, steal and harm. Arm yourself with information and resources to safeguard against complex and growing computer security threats and stay safe online.

Examples of Online Cybersecurity Threats

Computer Viruses

Probably the most eminent computer security threat, a computer virus is a program written to alter the way a computer operates, without the permission or knowledge of the user. A virus replicates and executes itself, usually doing damage to your computer in the process.

What can you do to avoid computer viruses? Carefully evaluate free software, downloads from peer-to-peer file sharing sites, and emails from unknown senders. These things are critical to avoiding viruses. Most web browsers have security settings which can be configured for top defense against online threats. But, as we’ll say again and again, the single most-effective way of fending off viruses is up-to-date antivirus software and monitoring agent, like we include in our Managed Service Plans.

Spyware Threats

A serious computer security threat, spyware is any program that monitors your online activities or installs programs without your consent for profit or to capture personal information.

While many users won’t want to hear it, reading terms and conditions is a good way to build an understanding of how your activity is tracked online. As always, if a company you do not recognize is advertising for a deal that seems too good to be true, be sure you have an internet security solution in place and click with caution.

Hackers and Predators

People, not computers, create computer security threats and malware. Hackers and predators are programmers who victimize others for their own gain by breaking into computer systems to steal, change, or destroy information as a form of cyber-terrorism. These online predators can compromise credit card information, lock you out of your data, and steal your identity. As you may have guessed, online security tools with identity theft protection are one of the most effective ways to protect yourself from this brand of cybercriminal.

Phishing

Masquerading as a trustworthy person or business, phishers attempt to steal sensitive financial or personal information through fraudulent email or instant messages. Phishing attacks are some of the most successful methods for cybercriminals looking to pull off a data breach. Antivirus solutions with identity theft protection can be taught to recognize phishing threats in fractions of a second.

Cyber Safety Tips

• Keep software systems up to date and use a good anti-virus program.
• Examine the email address and URLs in all correspondence. Scammers often mimic a legitimate site or email address by using a slight variation in spelling.
• If an unsolicited text message, email, or phone call asks you to update, check, or verify your account information, do not follow the link provided in the message itself or call the phone numbers provided in the message. Go to the company’s website to log into your account or call the phone number listed on the official website to see if something does in fact need your attention.
• Do not open any attachments unless you are expecting the file, document, or invoice and have verified the sender’s email address.
• Scrutinize all electronic requests for a payment or transfer of funds.
• Be extra suspicious of any message that urges immediate action.
• Confirm requests for wire transfers or payment in person or over the phone as part of a two-factor authentication process. Do not verify these requests using the phone number listed in the request for payment.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.

The popular Microsoft Office 2010 is reaching end of support in a few months. To avoid security risks, it’s time to upgrade to a newer version of Office. The good news is that you have options.

What Does End of Support Mean?

Microsoft Office 2010 has been a popular version of the application over the last decade. The unfortunate news is that support for it ends this fall — on October 13, 2020, to be exact. All of your Office 2010 apps will continue to function. However, using an unsupported version of any software exposes your computer to serious and potentially harmful security risks. Microsoft will no longer provide technical support, bug fixes, or security fixes for Office 2010 vulnerabilities that may be subsequently reported or discovered. This includes security updates that help protect your PC from harmful viruses, spyware, and other malicious software.

• You’ll no longer receive Office 2010 software updates from Microsoft Update.
• You’ll no longer receive phone or chat technical support.
• No further updates to support content will be provided, and most online help content will be retired.
• Another difficulty you may face is incompatibility with some of the newer programs and file formats.

If you’re using Office 2010, it’s probably a good time to upgrade your version of Microsoft Office.

Upgrade Options

The best way to protect yourself and your organization is to upgrade to a newer version of Office:

• Cloud upgrade: Subscriptions to Microsoft 365
• On-premises upgrade: Office Standard 2019

Microsoft 365

Microsoft 365 is an all-in-one cloud solution with a number of different licensing options to fit your organization’s needs. The best part about cloud-based applications is that you no longer have to worry about retirements, patches, and end of support. Cloud licenses are automatically updated with new features, new applications, and security updates. Many cloud subscriptions also include installed (or desktop) versions of the application, so you can have the same look and feel of the Office applications you are accustomed to using, but built with more robust features and benefits.

Microsoft Office Standard 2019

Microsoft Office Standard 2019 is the latest version of the on-premises version of the office suite and is a good option for you if you are not ready for the cloud version at this time. This version of Office includes Word, Excel, PowerPoint, Outlook, OneNote, and Publisher.

If you have any questions, please email us at support@sjtechies.com or call us at (856) 745-9990.

Barbara Corcoran of ABC’s “Shark Tank” has lost nearly $400,000 in a phishing scam this week. Corcoran told “People” that she was tricked as a result of an email scheme sent to her team.

The high-powered businesswoman told People that she received a scam invoice approving a real estate renovation, but she didn’t think twice about verifying it because she invests in real estate. It was only until her bookkeeper caught Corcoran’s assistant’s email was misspelled by 1 letter and it was later found to be the address used by the scammer.

“I was upset at first, but then remembered it was only money,” Corcoran told the magazine.

Corcoran’s assistant Emily Burke told CNN Business that the “Shark Tank” star wouldn’t provide any additional comment “at the advisement of her attorneys until the authorities are done investigating.”

However, Corcoran tweeted: “Lesson learned: Be careful when you wire money!” with a link to a TMZ story.

In addition to being an investor and a judge on the hit ABC show, Corcoran formerly owned the global real estate agency that shares her name. She sold it for $66 million in 2001.

Corcoran fell for a phishing scam. It’s common, too: Nearly 30,000 people reported being a victim of that type of scam last year. Together they reported nearly $50 million in losses, according to the FBI’s 2018 Internet Crime Report.

Phishing attacks are common methods of stealing usernames, passwords and money. Hackers pretend to be a trustworthy source to convince you to share personal data. To be safe, it’s important to make sure the sender is authentic before clicking on a link. Google has rolled out security protections that warns people of potential unsafe emails.

If you or your team have any questions or concerns please contact support at (856) 745-9990.

Not sure your are protected? Contact us, we can help!

Hackers held two school districts on Long Island hostage
over the summer, forcing one of them to pay $88,000 in cryptocurrency in order
retrieve student and staff information before the school year started.

Despite using an anti-virus software and other firewalls for cyber security, the School District’s encrypted files were accessed this summer by Ryuk ransomware, which can infiltrate an entire server with one click of a malicious email attachment. The virus encrypts data, essentially locking users out of access to their files, and hackers are blackmailing schools until payment is made, usually in bitcoin, through school insurance to unlock the system’s server.

The Mineola School District was also attacked by the same virus. But they didn’t have to pay because they had a backup that wasn’t compromised.

What are some tips to avoid having to pay the ransomware

The nefarious ransomware business model has turned out to be a lucrative industry for criminals. Over the years its ill repute has made law enforcement team up with international agencies to identify and bring down scam operators.

Most of the ransomware attacks that have taken place in the past have been linked to poor protection practices by employees and businesses. There are ways to prepare and steps you can take to avoid the nuances these hackers are causing.

Here are a few dos and don’ts when it comes to ransomware.

1. Do not pay the ransom. It only encourages and funds these attackers. Even if the ransom is paid, there is no guarantee that you will be able to regain access to your files.
2. Restore any impacted files from a known good backup. Restoration of your files from a backup is the fastest way to regain access to your data.
3. Do not provide personal information when answering an email, unsolicited phone call, text message or instant message. Phishers will try to trick employees into installing malware, or gain intelligence for attacks by claiming to be from IT. Be sure to contact your IT department if you or your coworkers receive suspicious calls or emails.
4. Use reputable antivirus software and a firewall. Maintaining a strong firewall and keeping your security software up to date are critical. It’s important to use antivirus software from a reputable company because of all the fake software out there.
5. Do employ content scanning and filtering on your mail servers. Inbound e-mails should be scanned for known threats and should block any attachment types that could pose a threat.
6. Do make sure that all systems and software are up-to-date with relevant patches. Exploit kits hosted on compromised websites are commonly used to spread malware. Regular patching of vulnerable software is necessary to help prevent infection.
7. If traveling, alert your IT department beforehand, especially if you’re going to be using public wireless Internet. Make sure you use a trustworthy Virtual Private Network (VPN) when accessing public Wi-Fi like Norton Secure VPN.

Ransomware criminals often attack small and medium sized businesses. Among other cyber attacks, ransomware is one criminal activity that can be easily worked around with the above-mentioned solutions. South Jersey Techies coupled with education about these threats is an excellent protection plan for today’s cyber landscape.

Microsoft has announced that its support for Windows 7, Windows Server 2008 R2, and Small Business Server (SBS) 2011 will be coming to an end on January 14, 2020.

What does that mean for you? First, security patches and updates will no longer be implemented, leaving Windows 7 workstations and servers susceptible to security breaches. On January 13, 2015, Microsoft ended mainstream support for Windows 7, but now extended support is ending as well. Extended support is still safe to use until 2020 currently. Normally Microsoft would add new features during the mainstream support phase, but they will not be being doing this anymore. They will however, continue to patch any security treats. South Jersey Techie’s strongly recommends upgrading your business’s servers and workstations before the January 2020 deadline- and to start planning now to avoid the urgency of the deadline. Businesses in the healthcare industry will be impacted by the changes in relation to HIPPA violations if their server isn’t updated before the deadline. The deadline will be here before you know it and updating an IT infrastructure is a large task and shouldn’t be put off until the last minute.

What are the next steps for your business? Many of our clients are starting to upgrade now or are planning to include the upgrades in their 2019 budget. Send us an email or give us a call and we will evaluate your line of business software for Windows 10 and upgraded server compatibility. If your company decides to upgrade its old server and workstations to meet the January 2020 deadline, South Jersey Techie’s has the reliable solutions and experienced technicians you need for managing the data migration and even the retired hardware. You can have peace of mind knowing your old data will be securely erased and destroyed.

Unsure if this deadline will affect your business? South Jersey Techie’s can review your server for you and determine its end of life date or if it will be affected by the 2020 end of support date. If you have any questions or concerns about your office and the 2020 end of support date, please give us a call today: (856)745-9990.

GET STARTED WITH A NEW WINDOWS 10 PC

Can’t Find What You’re Looking For?

Imagine you are a customer of Microsoft’s Office 365 service, including a subscription to the Office desktop applications like Word, Excel and Outlook.

One day you click on the shortcut for Word, but instead of opening, it just shows a “Starting” splash screen which never progresses.

Being smart, you try to start Word in safe mode by holding down the Ctrl key, but the exact same thing happens.

Annoying, when you want to do your work. What is going on?

We took a look at a case like this. Two things you should do (after the usual reboot):

1. Look in the event viewer. Here, we found a clue that the issue is related to software activation, specifically Event 2011 “Office Subscription Licensing exception”:

2. For all things related to Office licensing, open a command prompt, go to (for example) C:\Program Files (x86)\Microsoft Office\Office16, and type:

cscript ospp.vbs /dstatus

In this case we got the following:

This told us that Windows thinks TWO product keys for Office are installed. One has expired, the other is fine.

The guilty party may (or may not) be the trial version of Office typically pre-installed with a new PC. Or it could be a consequence of changing your Office 365 subscription. Neither would be the fault of the user, who is fully licensed and has done nothing other than follow Microsoft’s normal procedures for installing Office 365.

Solution: we reinstalled Office from the Office 365 portal, and attempted to remove the dud product key with:

cscript ospp.vbs /unpkey:<Last five characters of product key>

as explained here. All is well for the moment.

Activation and subscription license checking is for the benefit of the vendor, not the user, and should never get in the way like this.

Further, cannot Microsoft find some way of informing the user when this happens, and not have Word simply hang on starting? How difficult is it to check for licensing and activation issues, and throw up a message?