In most cases, corporate Antivirus had picked up and blocked the encoded malware. 3CX enlisted the help of “Mandiant Consulting” to help diagnose how the vulnerability was injected. on the 20th of April 2023, 3cx and Mandiant released the results of their findings the results are a wake-up call to businesses on the perils of allowing staff to use their own devices.

What happened

A user working on their own device with admin access downloaded some software they thought would be useful. This software had malware embedded in it. The user then signed in to check is email the malware gathered his credentials and shared them with a hacker. They then used these details to connect in to the company’s VPN and gain access behind the firewall as that employee. From there they were then able to use tools to infect both Windows and MacOS build areas.

What can your business do to prevent this type of attack

Prohibit the use of personal devices from logging in to company assets both as an employee handbook/policy and with conditional access policies (Office 365).

Educate. Let your staff know the perils of using their own device and the risk

Admin right. Remove all users’ admin access and review access. General advice the user that is logged in and browsing the internet should not have admin access they should always be prompted to enter a password. This prevents silent/accidental installation of software

Zero Trust application. While painful to set up using a Zero Trust application policy is a great way to help reduce your risk. EDR/XDR provide further enhancements to your security

Role out In Tunes MAM/MDM. MAM – Mobile Application Management and Mobile Device Management, can assist with protecting company assets. MAM allows companies to allow staff to access company resources on personal/BYOD devices in a secure manner via InTune Intune APP provides a secure, containerised solution that enforces encryption, and device pin and checks device health before allowing access to Office 365.

MAM Allows businesses to rollout company resources to personal devices providing the following functions

• Assigning employees mobile apps
• Configuring apps with standard settings
• Controlling and sandboxing the use of corporate data
• Removing corporate data from apps
• Keeping apps updated
• Tracking app usage and reporting on inventory

Conditional Access Policy Licensing Requirements

To enable Conditional Access-based policies, your business needs to have one of the following licenses:

• Azure Active Directory Premium P1 or P2
• Microsoft 365 Business Premium
• Microsoft 365 E3 or E5
• Enterprise Mobility and Security E3 or E5

If you are an educational or government organization, you must use the equivalent “A” or “G” license.

Intune MAM/MDM Licensing Requirements

The following licenses Include Intune Plan 1 which provides access to MAM and MDM

• Microsoft 365 E5
• Microsoft 365 E3
• Enterprise Mobility + Security E5
• Enterprise Mobility + Security E3
• Microsoft 365 Business Premium
• Microsoft 365 F1
• Microsoft 365 F3
• Microsoft 365 Government G5
• Microsoft 365 Government G3
• Microsoft Intune for Education

For Educational licenses

Intune Plan 1 for Education is included in the following licenses:

• Microsoft 365 Education A5
• Microsoft 365 Education A3

What to do next

Speak to one of our Cyber Essentials team. We will start with a basic review of how you are working and then look at how we can help with your particular requirements.

Other information that you may find interesting

The post Why allowing staff to use their own devices is a risk appeared first on Mear Technology.

This issue prevents users from getting the same experience as their colleagues. While there are a few reasons why users can not synchronise their company Sharpoint via OneDrive, we will discuss one particular reason here assuming you have completed general troubleshooting such as ensuring the user has permission to access the Sharepoint Document Library.

This issue is typically caused by a user’s action. When they open SharePoint in the web interface they sometimes click “Add shortcut to My Files” this creates a shortcut link in the user’s OneDrive but also breaks the synchronisation.

Symptoms

One Drive is synced and the user has access to their own Documents in OneDrive but does not see the One Drive Sharepoint Icon or does not see some Folders within this.

Fix

This is identifiable with this icon to resolve the syncing feature simply delete this shortcut by clicking “Remove” either by selecting the link and using the icon at the top of the page (A) or selecting the in-line with the shortcuts you want to remove. Removing the shortcut does not delete the data

For Administrators
How to Disable “Add shortcut to My Files” for your company

If you have SharePoint admin access you can disable this feature for all your users. If you are a Mear Technology Support customer you can simply contact our helpdesk and we will action this for you.

The post Company Sharepoints not Syncing via OneDrive appeared first on Mear Technology.

One major issue with using free public Wi-Fi is that it is often unsecured. This means that anyone on the same network can access and potentially intercept your data. This can include sensitive information such as company financials, personal employee information, and confidential business plans. Hackers can use tools to easily access unsecured networks and steal sensitive information.

Another issue with using free public Wi-Fi is that it is often unreliable. Public Wi-Fi networks can be slow, and the connection may drop frequently. This can make it difficult for employees to complete important tasks and can also lead to frustration and decreased productivity.

Additionally, public Wi-Fi networks are often used by many people, which can lead to crowded networks and increased competition for bandwidth. This can slow down the connection even further and make it difficult for employees to access the information they need.

In order to protect your company’s sensitive information, it is important for employees to avoid using free public Wi-Fi whenever possible. Instead, employees should use a virtual private network (VPN) or a secure, company-provided internet connection to access the internet. This will help to ensure that your company’s sensitive information is protected and that employees are able to work efficiently.

In conclusion, while free public Wi-Fi may seem like a convenient option, it can put your company’s sensitive information at risk. To protect your company’s information, employees should avoid using free public Wi-Fi and use a VPN or a secure, company-provided internet connection instead.

What sort of attacks are used?

There are several types of attacks that can be used to compromise the security of a device or network connected to a public Wi-Fi network. Some of the most common include:

1. Man-in-the-Middle (MitM) Attack: This type of attack occurs when a hacker intercepts the communication between a device and a network. The hacker can then access and steal sensitive information, such as login credentials or financial data.
2. Phishing: This type of attack uses social engineering tactics to trick users into providing sensitive information, such as login credentials or financial data. The attacker can create a fake login page that looks like a legitimate website, and trick users into entering their information.
3. Rogue Access Point: This type of attack involves the creation of a fake wireless access point, designed to look like a legitimate network. Once connected, the attacker can access and steal sensitive information.
4. Sniffing: This type of attack involves the use of software to capture and analyze network traffic. The attacker can use this information to steal sensitive information, such as login credentials or financial data.
5. Malware: This type of attack involves the use of malware, such as viruses or Trojan horses, to gain access to a device or network. Once the malware is installed, the attacker can access and steal sensitive information.

It’s important to note that these are only some examples of the kind of attack that can be used, and new methods are constantly emerging. To prevent these types of attacks, it is important to use a VPN or a secure, company-provided internet connection whenever accessing the internet on public Wi-Fi networks. Additionally, using a reputable security software and keeping it updated, as well as being cautious when giving personal information and following safe browsing habits can also help to mitigate the risk.

How to stay safe on public Wi-Fi

All employees should seek authorisation from their employer on using public wifi. Our advice is to avoid using public wifi.

If you need to use it then there are several steps that can be taken to stay safe when using public Wi-Fi:

1. Use a Virtual Private Network (VPN): A VPN encrypts all of the data that is sent and received over the internet, making it much more difficult for hackers to intercept and steal sensitive information.
2. Avoid accessing sensitive information: If possible, avoid accessing sensitive information, such as financial accounts or company data, while connected to a public Wi-Fi network.
3. Use a firewall: A firewall can help to protect your device by blocking incoming connections from potentially harmful networks.
4. Use a reputable security software: Make sure your device has up-to-date anti-virus and anti-malware software.
5. Be cautious when giving personal information: Be wary of giving personal information, such as login credentials or financial data, over a public Wi-Fi network.
6. Keep your software updated: Keep your device’s operating system and all of your software updated to ensure that you have the latest security patches and fixes.
7. Look for HTTPS: When possible, look for sites that have the HTTPS protocol, that indicate a secure connection.
8. Be suspicious of free Wi-Fi: Be wary of free Wi-Fi networks, as they may be set up by hackers to steal sensitive information.
9. Use a personal hotspot: If possible, use a personal hotspot, such as a mobile hotspot, to access the internet instead of a public Wi-Fi network.

By following these steps, you can help to ensure that your personal information and company data remain secure while using public Wi-Fi networks. However, it’s important to remember that even with these measures in place, there is still a risk of your device getting hacked or your information getting stolen, so it’s always good to be cautious and aware of the risks of using public Wi-Fi networks.

Do’s and Don’ts on public wifi

Do’s:

1. Use a Virtual Private Network (VPN) to encrypt your internet connection and protect your data from hackers.
2. Avoid accessing sensitive information, such as financial accounts or company data, while connected to a public Wi-Fi network.
3. Keep your device’s security software up to date to protect against malware and other cyber threats.
4. Look for sites that have the HTTPS protocol to ensure a secure connection.
5. Use a personal hotspot, such as a mobile hotspot, instead of a public Wi-Fi network, if possible.

Don’ts:

1. Don’t connect to free Wi-Fi networks that you are not familiar with, as they may be set up by hackers to steal sensitive information.
2. Don’t give personal information, such as login credentials or financial data, over a public Wi-Fi network.
3. Don’t use public Wi-Fi networks to make online transactions, such as online banking or shopping.
4. Don’t disable your device’s security settings or firewall while connected to a public Wi-Fi network.
5. Don’t ignore security warnings or prompts from your device or security software while connected to a public Wi-Fi network.

The post Public Wifi risks for employees appeared first on Mear Technology.

Note:

By default, an iPhone will always send new messages in Plain Text unless any formatting has been applied to the text.

If formatting has been applied to the text, such as making the text bold or italic, then it will send the message in HTML.  

Follow these steps to set the default signature on the iPhone to bold or italic (so that all messages sent will be in HTML):

1. On the iPhone tap Settings > Mail, Contacts, Calendars then scroll down to the Signature section.
   
2. Tap Signature and then tap and hold on your current signature and tap Select All.
   
3. Tap the > arrow and then select the B/ U button.
   
4. As required, make the text bold or italic, then tap Mail.. at the top left of the screen to save the settings.

With these changes, any emails sent from your iPhone that include this signature will be sent in HTML. This implies that Mail Disclaimers can apply the HTML version of your signature to the message.

How does this work?

IPhone by default sends all emails as Plain Text. Plain text emails do not support inline images so images appear as attachments.

by creating a blank signature with a Bold or underline character we trick the Mail app to create the signature in the more common HTML format that supports more dynamic emails

Too much hassle there is another option.

The above issue is unique to the mac built-in Mail app switching to Outlook will also resolve this issue!

https://apps.apple.com/gb/app/microsoft-outlook/id951937596

The post Exclaimer iPhone signatures are not right appeared first on Mear Technology.

1. Click File, select Info 
   
   
   
2. Navigate to Tools > click Mailbox cleanup…
   
   
   
3. Check the Find items larger than 250 kilobytes radio button, then click Find.
   
   
   
4. Click on Size to sort the search list by the size column, this will assist in locating the emails with the largest attachments.
   
   
   
5. Double click the email with the large attachment to open it > right click on the attachment > click Remove Attachment.
   
   
   

The post How to: Find and remove large email attachments using Outlook (Windows) appeared first on Mear Technology.

When Chrome blocks a pop-up from a website, it displays an icon with a red X in the corner of the Omnibox.

If you suspect this is an error and want to see pop-ups from this website, click on the icon to see site-specific options, select “Always Allow Pop-ups and Redirects” and then click “Done.”

After you click “Done,” refresh the page to save your choice and see any intended pop-ups on this website.

Alternatively, if you just want to see a pop-up one time, click the blue link in this window and you’ll be redirected to the pop-up that was initially blocked.

The post Allow pop-ups and redirects for a specific site in chrome appeared first on Mear Technology.

On Windows

1. Go to File > Info > Protect Document > Encrypt with Password.
   
2. Type a password, then type it again to confirm it.
3. Save the file to make sure the password takes effect.

Mac OS- Newer

1. Go to Review > Protect Document.
   
2. Under Security, you can select whether to enter a password to open the document, modify the document, or both. Enter each password again to confirm.
3. Click OK.

Word for Mac 2011

1. On the Word menu, click Preferences.
2. Under Personal Settings, click Security  .
3. In the Password to open box, type a password, and then click OK.
4. In the Confirm Password dialog box, type the password again, and then click OK.
5. Click Save  .

Web

Word Online can’t encrypt a document with a password, and it can’t edit documents encrypted with a password. If you want to protect the file with a password, click or tap Open in Word to open your document in the desktop version of Word. After you’ve added password protection, you’ll need to use the Word desktop program to open the document.

The post Protect a document with a password appeared first on Mear Technology.

What Is An API?

An Application Programming Interface (API) is intermediary software that allows different applications to talk to each other. In essence, it delivers your request to a provider and then delivers the provider’s response back to you. APIs provide operations and queries that developers can use to design and build apps and web applications, for example, using APIs to connect the user-facing front ends with the back-end functionality and data.

Examples of API Use

APIs are widely used, and some popular examples of their use include:

Real-time Travel Bookings in Websites

These websites use third-party APIs to collect and display real-time aggregated flight and hotel availability from providers and use APIs to confirm the bookings with the providers. In other words, the APIs are the intermediaries that enable the website to communicate with the hotel and flight booking systems.  An example of a real-time flight data display API is the ‘Aviationstack’ API which provides flight stats for 200+ countries and more than 13,000 airlines.

Paying with PayPal

The option to pay with and to deposit and withdraw funds from PayPal in e-commerce (e.g shopping, better, booking) websites uses an API. This allows the end application to work without getting access to sensitive data or other unintended permissions.

Logins With Different Options

Websites that enable you login using different platforms (e.g. displaying login with Facebook, Twitter, or LinkedIn) use an API to authenticate the logins rather than having the security risk of actually logging in the social media account.

Types of APIs

There is a number of different types of APIs which include:

– Open APIs/Public APIs. Anyone can use these as they are publicly available/there are no restrictions.

– Partner APIs. These are not publicly available and are only exposed to strategic business partners through the granting/purchasing of rights or licenses.

– Internal APIs/Private APIs. These are used on a company’s internal systems, e.g. to improve products and services.

– Composite APIs. These enable batch requests, i.e. a client can make one API request with a batch/chain of calls and receive one response.

– Web APIs. As the name suggests, these are specifically for the web, e.g. using a web API to extend the functionality of a web browser or a server API to extend web server functionality.

Endpoints and Request Methods

One of the key ways in which an app interacts with an API is the ‘endpoint’.  This could be the specific web address that links to the functions required.

The ‘request methods’ refers to what action will be taken by referring to the API.  For example, these could be ‘GET’ to request data from a server, ‘POST’ to add new data to a server, ‘PUT’ to change existing information, or ‘DELETE’ to delete existing information.

To use an API generally requires getting an API Key, testing the API endpoints, and creating an App.

The Benefits of APIs

The many benefits of using APIs include:

– Time and money savings in development due to being able to take advantage of the functionality of different applications without having to type code yourself or pay for complicated development work to enable different programs to communicate with each other.

– Security while tapping into data and external functionality.

– Efficiency as content generated through an API can be published automatically and made available for every channel.

– Improved services and user experience, e.g. on a website, due the ability to automatically display real-time, accurate information (such as flights and bookings).

– Convenience for users of websites with APIs links.

– Better integration leading to better results (whilst reducing development costs).

– Faster innovation by recharging applications with the latest technology, and easier monetisation.

What Does This Mean For Your Business?

APIs tie disparate applications together, allowing them to complement and talk to each other, become greater than the sum of their parts, and in doing so they represent ways for businesses to gain efficiencies, improve and enrich services and gain competitive advantages, automate, and innovate.  Companies can develop APIs and apps or use existing APIs to integrate and add value and as such APIs offer many new advantages and opportunities.

The post Tech Insight – What Is An API? appeared first on Mear Technology.

I am sure that if you are reading this post you have had a scenario when you have had to send several emails to multiple emails on when you can all get together. Luckily Microsoft have released a free tool to Office 365 business and Office 365 educational license customers that solves this dilemma.

Watch the video above to get a quick introduction.

The post How to organise a meeting in Corvid Times. Microsoft FindTime appeared first on Mear Technology.

Did you you know that Mear Technology can supply your Office 365 licences on a 30 day rolling contract for the same price of Microsoft Annual commitment. Get in touch to see how we can help

How to use Microsoft Teams

[embedyt] https://www.youtube.com/watch?v=OxfukizkyCA[/embedyt]

How to Invite Anyone to Microsoft Teams Meeting

[embedyt] https://www.youtube.com/watch?v=8bF-CSd4HgM[/embedyt]

How to use Microsoft Teams Live Event

[embedyt] https://www.youtube.com/watch?v=pGmdfUL5mGU[/embedyt]

How to Open Multiple Instances of Microsoft Teams

[embedyt] https://www.youtube.com/watch?v=XiKPKrWGgf4[/embedyt]

How to include System Audio when Screen Sharing in Microsoft Teams

Particularly useful for those running  clubs and classes online or doing a online quiz night with family and friends.

[embedyt] https://www.youtube.com/watch?v=ARQkc-HzKhI[/embedyt]

How to Track Attendance in Microsoft Teams

[embedyt] https://www.youtube.com/watch?v=JHHN3d5vw60[/embedyt]

How to record a meeting in Microsoft Teams

[embedyt] https://www.youtube.com/watch?v=_hjfQ41LF0w[/embedyt]

To view the entire series visit Kevin YouTube Channel  and view his Teams Playlist or view all his videos for other series.

The post Video Tips on getting better with Teams appeared first on Mear Technology.