As it’s Halloween, we thought we’d look at a something a little scary in the IT world:  The Dark Web.

Lets begin by breaking down what is the dark web and the Internet which we all access everyday.   The Internet we all tend to access everyday through our favourite search engines is called the surface web, which lends nicely to imagining the Internet like an iceberg.  So everything above the water is the surface web.

Everything below the water of the iceberg is called the deep web and with some basic diving kit you could access some of the iceberg below the water’s surface. The deep web is unable to be searched using our favourite search engines.  Now, not everything within the deep web is malicious and much is legal and safe.  Within the deep web there are things such as databases which are publicly and privately accessible, but only within their database and intranets which you may have one within your organisations, but you can only access when logged into your company devices.  The deep web also includes any blog articles that have yet to be published, web pages that are in the process of redesign and even pages within your online banking account.  All these pages will have instructions written into them to tell search engines not to search them or they are hidden behind passwords and therefore not searchable.

via GIPHY

The dark web is specifically web pages and sites that are not indexed and you must have a specialised web browser to access.  It routes your path to these sites through multiple servers and uses encryption to make users as anonymous as possible.  It was originally created to allow US spies to communicate with the Department of Defence to protect their identities and their safety in the 90s.

The dark web is significantly smaller than the surface web, so could be considered the very bottom submerged tip of the iceberg in our analogy and would require specialist diving equipment and knowledge to reach, but would still be risky to do so even with the equipment and knowledge.  As such, the dark web is not something you can stumble upon in your day to day Internet usage.  So while it is something to be aware of and understand it exists, you would need to go out of your way to access it.  This is the part of the Internet where stolen user credentials, passwords and financial details are traded and sold.  It is an extremely dangerous area of the Internet to access and use.

As the dark web is not something we can stumble upon, what is more important is considering the dangers and safe usage of the deep web that is most appropriate for the majority of people.  The deep web can hold piracy sites and unsavoury content and as such this is possible to access and come across while using one of the common browsers and search engines.  Therefore, the best way to protect yourself in the deep web is to always be aware of the links you are clicking through to and what buttons or how you are interacting with a website.  Evaluate if you trust the website you are on and if the link or action you pursue on this website is safe and considered.  This will help to keep you safe on the Internet. If you have any further queries or need more advice on staying safe on the Internet, please just get in touch with the team here at MJD.

With the increase of social engineering and successful phishing attacks which we are seeing every month, combined with the extremely high risk of a sensitive data breach or financial loss without Multi-Factor Authentication (MFA), we want to make sure you are aware and understand what this is and how it can help.

There has been a dramatic and unforeseen shift to remote working through out this year in response to COVID-19, the importance of turning MFA on has increased further.  MFA is the process of using two or more ways to verify the authenticity of a login attempt to a service.  Verifications are usually made up of a combination of your password, an authenticator app on your mobile or biometrics like your finger print or facial recognition.  We’ve included a great video demonstration to help explain the process within Microsoft 365:

With 365 the MFA feature is included with your 365 subscriptions, so there is no additional cost to your monthly subscription with Microsoft 365.  It is a simple way to add an additional layer of security to your security setup, to deter and minimise the threat of a cyber attack.  Trying to gain access to a 365 account with MFA is a great deal of work for a cyber criminal and can help to encourage them to move on to their next target.

While this does add an extra step to your login to access your 365 and can pose a potential problem should you forget your phone or even worse lose it!  However, when coupled with the fact that 60% of SMEs go out of business within 6 months of a cyberattack, it is a small inconvenience that very rarely occurs, can you really put security over convenience?  If this ever does happen, this is what MJD are here for to help you resolve the issue and get your IT working for you again.

What is important to keep in mind is that one of 365’s main advantages is that you can access it from any device, therefore it is important to remember that employees may use personal devices to check emails or work on documents for your business.  These devices may not have our RMAV package on them and potentially no anti-virus software, opening your business to threats.  With MFA, it means that to gain access to a 365 account they would also require the mobile phone with the authenticator app or your biometric data, alongside the password.

For such a small inexpensive step to add to your security system within your business, this is a function that you cannot afford to leave switched off.  As always, if you have any questions or would like any help setting up MFA please don’t hesitate to get in touch with the team here at MJD.

Today we want to talk about phishing emails.  A phishing email is an email which has been sent to the recipient with the purpose of convincing you to provide them with your personal information or account details.  Once they have this information they may use it to create accounts in your name or to gain access to steal more of your sensitive data. Reports conducted for this year by Webroot show us that there has been a 640% increase in phishing URLs being sent.  This highlights the importance of being aware of how to protect yourself from phishing campaigns.  The key to protecting yourself against phishing attacks is a continuous training programme.  Statistics in this report also show that after 1 year of training, end users are 70% less likely to click through to a phishing attempt. The team at MJD can help to setup email training campaigns to help combat phishing attacks, so if after readying this article and encouraging your colleagues and peers to read this blog article you would like more training please just get in touch.

The key to remember is that most legitimate companies you conduct business or personal dealings with will not request sensitive information from you via email.  However, the cyber criminals behind the phishing emails are getting ever cleverer and more careful about the look and feel of their emails, making our daily job of determining genuine emails from dangerous more difficult in our already hectic work lives.  For this reason, we are going to dissect and exam a phishing email we recently received ourselves, to help you to understand the various warning signs and parts of an email to check before interacting with the information contain in the message in anyway.

The first point of call is to consider the supposed reason for receiving the email.  In this example, we are being told our email is limited.  So take a moment, and think am I experiencing an issue like this.

We currently don’t have any issues with this email account being limited, so already alarm bells are ringing.

Next, we consider who the email is coming from.  In this instance its coming from “Webmail Security”.

We don’t use webmail, so already this would not be someone we would expect to get messages about email issues from.  On top of that, the actual email address of @m5-domains.com is not a company we have our domain with, therefore again we would not expect them to know anything about any email problems.  So question do you interact with this company and use this company’s services?  Therefore, should they be getting in touch with you?

Within the body of the message you can see they use a term User Agent, which is like a fingerprint when you may have logged into a website or service through an Internet Browser.  It takes details of the browser you used to access the service or webpage.  Now, for a MSP we know what this is and straight away know we haven’t tried to log into our emails using these browsers.  However, this specialist terminology is used to try and confuse the recipient in the hopes they don’t know what it is.  This is another tactic all working towards encouraging you to act on the email and click their link.

At this point, we have already decided that this is a phishing email, but for the purpose of our blog post we will continue to question the remaining aspects of the email.  For the cyber criminal who has sent this email, the next part is the most important part of their email, the link to their web page.

When we hover over the link you can see the URL which this button would take you too.  In this case it lists a web page that has a different domain name, m4 domains rather than m5 domains, to the email address sending the email.  Another red flag.  Most likely this would lead you to a web page where it would ask for your username and password to “verify your identity”.  These would then be stored in a database and used to try and gain access to your account.  It is key that you should remember to NEVER enter your credentials anywhere other than when genuinely gaining access to your emails and you should NEVER share your credentials with anyone.

What you will also notice with this URL is the “link.edgepilot.com” at the start.  This is because of the SPAM filter we use and have setup with many of our clients.  This is an additional feature of the SPAM filter which, in addition to filtering out potential SPAM emails will check all links in emails if they are clicked on prior to taking the user to the site.  While this doesn’t mean you can get click happy, it does offer another layer of protection against phishing emails.

A time limit with a threat of losing access to your account, is another pressuring tactic to get you to take the wrong action.

If you are worried that there is potential the issue may be genuine, raise it with your IT department or your MSP/IT provider first.  They will always be happy you checked with them, even if it turns out to be a phishing or spam email.  The key is not to interact with the link or the sender of the email, any concerns ALWAYS contact your IT department or MSP first.

The final point to make is the small print.

First off, it’s in a lovely pale grey and small font to make it more difficult and off putting to read.  But once you do read it, the references to laws and legislation do not make sense or aren’t relevant to any of our actual UK legislation.  It also references a company, which hasn’t been mentioned previously, again providing us with further information that everything in this email doesn’t add up to a genuine warning from an email provider.

Hopefully, this will give you an initial check list of things to be mindful of when accessing emails and help you to identify emails that you need to be wary of and potentially ask your MSP for help to deal with.  The team here at MJD have a variety of tools and packages which we can implement on your network to carry out on the job training for your organisation.  If you’d be interested in developing a phishing email training programme for your organisation please don’t hesitate to get in touch with us.