Category: Tech Tips & Security

Two-step login is still one of the best protections you can turn on. But a recent attack on Microsoft 365 accounts is a good reminder that it isn’t a force field. The attackers didn’t need to guess a password or crack a code. They waited for people to log in, then took what came after.

How someone gets in without your password

When you finish logging in, Microsoft gives your browser a token. Think of it as a wristband at an event: once you have it, nobody asks for your ticket again. Whoever holds that token can look like you, without passing two-step login a second time.

Huntress says the attackers got these tokens in two main ways:

• A fake login page that passes everything through. It sits between you and Microsoft. You see the real sign-in and approve the real prompt, but the middleman keeps the token.
• A code on the real Microsoft site. You are talked into entering a code on Microsoft’s genuine sign-in page, which approves the attacker’s sign-in instead of yours. The address bar looks completely normal.

It can move fast. In one case on September 22, the stolen session appeared four minutes after the victim reached the two-step prompt.

What they did once inside

• Locked themselves in. They registered at least 48 fake computers on victims’ accounts. At 19 organizations, they wiped the victim’s two-step methods and added their own within three hours.
• Hid their tracks. They created inbox rules that moved or deleted mail, often with names as short as a single period.
• Used the mailbox. One account sent spam to hundreds of outside recipients. Another sent a payroll-related email to an outside contact.

Here is the part that catches people out: changing the password does not undo all of this. Huntress notes that attacker-added devices and login methods stay in place after a reset.

What a small business should do

• Keep two-step login on, and use passkeys or security keys where you can. They are tied to the real website, so a fake login page has much less to work with. Start with admin and finance accounts.
• Set up Conditional Access if your plan includes it. These Microsoft 365 rules can require two-step login and block risky sign-ins. Huntress says properly set rules can prevent this type of attack.
• Be suspicious of any request to enter a code. If someone asks you to type a code on a Microsoft page and you didn’t start that sign-in yourself, stop and call your IT contact.
• Check your inbox rules. Look for rules you don’t remember, especially ones with odd names or ones that delete or move mail. Do the same for your list of devices and sign-in methods.
• Clean up completely if an account is taken. Sign the user out everywhere, reset the password, then remove any devices and login methods the attacker added.

The bottom line

Two-step login is still worth having. It just shouldn’t be your only layer. If you’re not sure how your Microsoft 365 sign-ins are set up, High Definition Technologies can review them with you and close the gaps.

Sources: Huntress, Help Net Security.

On October 28, an activist group published a searchable list of more than 40,000 people who work for or with the U.S. Department of Homeland Security. The group says it got in through the single sign-on system DHS employees use to log in. You don’t need to be a federal agency to learn from this one.

What happened

A group calling itself “Department of Peace” handed a large set of DHS personnel records to the nonprofit Distributed Denial of Secrets, which published them on October 28. The group says it got the data earlier this year by getting into Okta, the service DHS uses so employees can sign in once and reach many internal systems.

News outlets including CNN and TechCrunch reviewed the data and say at least part of it appears to be real, though incomplete. According to CNN, a source said some undercover personnel were exposed. DHS has not said how the attackers got in, and the investigation is ongoing. This also comes a few months after a separate breach of a DHS information-sharing network, first reported in July.

Why single sign-on matters here

Single sign-on (SSO) is the “log in once” button many businesses now use with Microsoft 365, Google Workspace, Okta and similar services. It’s convenient and, set up well, it’s more secure than a pile of separate passwords. But it also means one account can open email, files, accounting and everything else.

That makes the sign-on system a master key. If an attacker gets it, they don’t need to break into each system one by one. And as this leak shows, even a list of who has access to what is valuable. It tells criminals exactly whom to target next.

What a small business should take from this

• Turn on two-step login everywhere, starting with your main account. An app prompt, passkey or security key is far stronger than a text message code.
• Give people only the access they need. The office manager doesn’t need the server admin login. Fewer keys means less to lose.
• Remove access the day someone leaves. Old accounts that still work are one of the most common ways in.
• Take login alerts seriously. “New sign-in from an unknown device” emails are easy to ignore. Read them, and ask about the ones you don’t recognize.
• Expect fake “government” emails. Leaks like this fuel convincing phishing. Before you click a link about SAM.gov, the IRS or any agency, go to the site by typing its address yourself.

The bottom line

Single sign-on isn’t the problem. An unprotected master key is. If you’re not sure how your business logins are set up, or whether two-step login is really on for everyone, High Definition Technologies can review it with you and close the gaps.

Sources: TechCrunch, CNN, CyberScoop, NBC News.

Security cameras protect your business, but they can also be one of its weakest spots online. The fix is simple and doesn’t cost much: give your cameras their own separate network.

Why cameras are a target

A network camera is a small computer with an operating system, a web page for settings and a network connection. Many are installed once and never updated. Some still use the password they shipped with.

That’s exactly how the Mirai botnet grew in 2016. It took over hundreds of thousands of cameras and other devices by trying common default passwords, then used them to knock major websites offline. The cameras’ owners usually had no idea.

What a separate camera network does

A VLAN (virtual LAN) splits one physical network into separate ones. Your cameras and recorder live on their own network, and your computers, phones and payment systems live on another. Then you set simple rules:

• Cameras can talk to the recorder (NVR), and nothing else.
• Cameras can’t reach your office computers, file storage or point-of-sale system.
• Cameras can’t reach the internet directly. The recorder handles any remote viewing.
• Only the people who should see the video can reach the recorder.

If a camera is ever hacked, the damage stays inside that small network.

Five more habits that keep cameras safe

• Change every default password before a camera goes into service, and use a unique one.
• Keep firmware updated on cameras and the recorder. Check for updates a few times a year.
• Don’t open ports on your router to view cameras from outside. Use the maker’s secure app or a VPN instead.
• Record locally on a recorder you control, so video isn’t lost if the internet goes down.
• Retire unsupported cameras. If the maker no longer releases updates, it’s time to replace them.

The performance bonus

Cameras send video around the clock. On their own network, with a PoE switch powering them, that steady traffic stays away from your staff’s computers and video calls. Everyone gets a smoother network.

Our take

Most modern business network gear, including the Ubiquiti UniFi equipment we install, makes a separate camera network a few minutes of setup. If your cameras share a network with your office computers today, it’s one of the most worthwhile fixes you can make this year.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers, cameras and networks for homes and small businesses. Email us at [email protected].

Sources: Cloudflare: What is the Mirai botnet?.

On October 21, the PHP project shipped emergency fixes for two critical security flaws nicknamed PHP2Shell. PHP runs most of the web, including nearly every WordPress site, so if your business has a website, this one is worth five minutes of your time.

What happened

PHP is the programming language behind a huge share of websites, from WordPress and Joomla to online shops and custom business tools. Researchers at Calif, OpenAI and Wiz found two bugs in the core of PHP that had been hiding for years. Both involve PHP leaving its memory in a broken state when a web request ends badly, for example when the server runs out of memory partway through.

An attacker who sends the right kind of request can turn that broken memory into a way to run their own commands on the server. No password is needed. From there they could plant a hidden back door, steal database passwords and keys, deface the site, tamper with checkout pages or move deeper into a company network.

Why it was a scare

• Attacks started early. Amazon says its decoy servers saw an exploit attempt on October 17, four days before the fix came out. Cloudflare also reported early attacks.
• Details leaked. Word of the flaws spread on social media before the planned release, so the PHP team released its fixes a day early.
• It touches almost everything. Every common way of running PHP on a web server is affected. Setups using Apache with mod_php are at the highest risk.
• Lots of servers run old PHP. Security firm Bitsight found that only about a third of the PHP servers it could identify run a version that received this update. The most common version it saw, PHP 7.4, is years out of support.

Is my website affected?

If your site runs on PHP, it was affected until it was updated. That includes WordPress, WooCommerce, Joomla, Drupal and many custom sites. Firewalls, security plugins and changes to your website itself don’t fix this. The only real fix is updating PHP on the server.

Most small businesses don’t manage their own server. Your web host or web designer does. So the job for you is simple: ask them.

What to ask your web host or web designer

• “Is our site’s PHP updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer?”
• “If we’re on PHP 8.1 or older, when are we moving to a supported version?” Those versions don’t get regular fixes anymore.
• “Did you check the running version, not just the installed package?” A server can have the update installed but still be running the old version until it restarts.
• “Have you checked for signs we were attacked before the update?” Because attacks started before the fix, look for unknown admin accounts, new files and odd changes.

If your site sits behind Cloudflare, it has had some extra protection since the flaws were announced. Cloudflare says that protection is temporary and doesn’t replace the update.

Don’t forget the less obvious places

PHP also runs inside some routers, firewalls, storage boxes and control panels. Palo Alto Networks has confirmed its firewall software is affected, and other vendors were still checking at the time of writing. If you have network equipment with a web dashboard, check the vendor’s security page for updates.

Our take

We patched every system we run on October 21 and 23. The lesson for small businesses isn’t to panic. It’s to know who is responsible for updating your website and equipment, and to make sure they actually do it. If nobody can answer that question, that’s the real problem to fix.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers, cameras and networks for homes and small businesses. Email us at [email protected].

Sources: BleepingComputer, Bitsight, Help Net Security.

October is Cybersecurity Awareness Month, an annual campaign that has been running since 2004. This year, agencies like the SBA, the FTC and NIST have been holding sessions on scams and fraud for small businesses. You don’t need a seminar to get safer, though. Set a timer for 15 minutes and work through this list.

1. Turn on multi-factor authentication (5 minutes)

Multi-factor authentication, or MFA, means a stolen password alone isn’t enough to get into your account. Turn it on for, at a minimum:

• Your email (it’s the key to resetting everything else)
• Your bank and payment accounts
• Your Microsoft, Google or Apple account

An authenticator app or a passkey is stronger than a text message code, but any MFA beats none.

2. Fix your weakest passwords (3 minutes)

Use a password manager so every account gets its own long, random password. Start with the accounts above. If you reuse one password everywhere, one leak opens every door.

3. Update everything (3 minutes)

Check for updates on your computer, phone and browser, and turn on automatic updates. Still on Windows 10? You can get an extra year of free security updates. And don’t forget your router; here’s a quick router checkup.

4. Check your backups (2 minutes)

Make sure your important files are backed up somewhere other than the computer they live on, and that at least one copy isn’t always connected. Then try restoring one file. If it works, you’re in good shape. Ransomware is getting nastier, as this report shows.

5. Agree on a “slow down” rule (2 minutes)

Most scams work by rushing you. Agree with your family or team that any urgent request for money, codes or passwords gets verified by calling back on a known number, no matter how real the voice sounds. Here’s how AI voice-clone scams work.

Done? Go one step further

• Put guests and smart devices on a separate Wi-Fi network.
• Remove apps and browser extensions you no longer use.
• Write down who to call if something goes wrong, and keep it somewhere other than your computer.

Small steps, done consistently, stop the vast majority of everyday attacks. Fifteen minutes this month can save a very bad day later.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers and networks for homes and small businesses. Email us at [email protected].

Sources: Nextgov/FCW, CISA Secure Our World.

Ransomware used to be a computer problem: criminals lock your files and demand money to unlock them. A new report shows it’s turning into a personal one, with attackers pressuring employees and their families directly.

How the pressure works

According to the report, attackers dig through social media, leaked data, public records and company websites to find out where employees live, who their relatives are, even which schools their kids attend. Then they use those details to make threats feel real. Among organizations surveyed:

• About a quarter had employees doxxed, meaning their private details were posted online.
• About 23% faced swatting, a fake emergency call meant to send armed police to someone’s home.
• Some reported threats of break-ins (19%), abduction (17%) or physical harm (13%).
• A quarter said someone needed medical or mental health care afterward, and 24% hired personal security.

The attacks are getting smarter, too

Some 84% of victims said the attacks against them involved AI in some way, though the researchers note that’s based on what victims reported. And 87% of attacks went after identity systems, the accounts and logins that control who can access what. Only half of the organizations had a dedicated backup of those systems.

Paying doesn’t end the problem: 69% of victims were hit more than once. The FBI doesn’t support paying ransoms, since there’s no guarantee you get anything back and the money funds the next attack.

What a small business can do

You don’t need a giant security budget to make yourself a much harder target:

• Turn on multi-factor authentication for email, banking and every admin account. This one step blocks a huge share of break-ins.
• Keep backups offline and test them. A backup you have never restored is a hope, not a plan.
• Limit admin access to the few people who truly need it.
• Agree on an emergency contact method outside of company email, like a phone tree, in case your systems are down or being watched.
• Talk to your staff. Make it easy and blame-free to report a strange call, text or message, at work or at home.
• Trim what’s public. Review what your website and social pages reveal about employees.

If you’re ever hit, disconnect affected computers, don’t wipe anything, and report it to the FBI or CISA.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers and networks for homes and small businesses. Email us at [email protected].

Source: Cyber Security News on the Semperis 2026 Ransomware Risk Report.

The phone rings. It sounds exactly like your boss, your bank or a longtime client, and they need a payment sent today. In 2026, that voice could be completely fake.

How good have the fakes gotten?

Good enough to fool people who should know better. In 2024, a finance employee at the engineering firm Arup sent $25.6 million after a video call with people he thought were his colleagues. Hong Kong police later confirmed they were all deepfakes. A 2026 study by researchers at Harvard and Meta found that people failed to recognize nearly a third of AI voices, and heavy AI users were no better at spotting them than anyone else.

The Federal Trade Commission has warned that scammers are cloning the voices of business executives to get money or sensitive information, and in September it asked for public input on whether online ad platforms are making these impersonation scams easier.

Warning signs

• Urgency. “This has to go out in the next hour.”
• Secrecy. “Don’t mention this to anyone yet.”
• Unusual payment methods. Wire transfers, gift cards or cryptocurrency.
• Requests for codes. No real bank, boss or vendor needs your one-time login code or password over the phone.
• A changed bank account. A vendor suddenly asking you to pay a new account is one of the most common setups.

Simple habits that stop it

• Hang up and call back using a number you already have, from a business card, a contract or the company’s official app. Scammers can fake caller ID, but they can’t redirect a call you place yourself.
• Require two people to approve any payment or bank change over a set amount.
• Set a code word with family members and key staff for emergencies.
• Use your carrier’s call blocking tools. The FCC has guides at fcc.gov/blockit.
• Report it at reportfraud.ftc.gov, even if you didn’t lose money.

The technology behind these scams will keep improving. The good news is that the defense is old-fashioned and still works: slow down and verify.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers and networks for homes and small businesses. Email us at [email protected].

Sources: KTVZ / Stacker, FTC, FTC voice cloning comment.

Your router is the front door to everything on your network, and it’s easy to forget it’s there. A new government warning about a popular router brand is a good excuse to give yours a quick checkup.

What happened

At the end of September, CISA warned about a flaw, tracked as CVE-2026-84411, in the web management page built into MikroTik’s RouterOS. An attacker who can reach that page can send a single specially crafted request and, in the worst case, run their own code on the router with full control, or simply knock it offline. MikroTik recommends updating, and BleepingComputer noted the company had not yet published its own security notice when the warning came out.

It isn’t MikroTik’s only recent problem. Poland’s national computer emergency team reported attackers chaining together other RouterOS flaws to take over routers that had remote login exposed to the internet.

Do you need to worry?

MikroTik is popular with small businesses, internet providers and tech hobbyists. If you have one, update it now. If you aren’t sure what brand your router is, look at the label on the bottom or the login page.

Even if this exact flaw doesn’t affect you, the lesson applies to every router: devices that are never updated and that can be reached from the internet are exactly what attackers look for.

A 10-minute router checkup

• Update the firmware. Many newer routers can update automatically. Turn that on.
• Change the default admin password. If it’s still what’s printed on the sticker, change it today.
• Turn off remote management unless you truly need to manage the router from outside your home or office.
• Use WPA3 or WPA2 encryption for Wi-Fi, never “open” or WEP.
• Put guests and smart devices on a separate network so a cheap smart plug can’t be used to reach your laptop.
• Check the age. If your router no longer gets updates from the manufacturer, it’s time to replace it.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers and networks for homes and small businesses. Email us at [email protected].

Sources: BleepingComputer, CISA advisory ICSA-26-272-06.

If your computer still runs Windows 10, here’s some good news you might have missed: Microsoft has extended its consumer security update program by a full year, to October 12, 2027.

What happened

Windows 10 reached its official end of support in October 2025. To keep people safe while they moved to Windows 11, Microsoft offered a paid add-on called Extended Security Updates, or ESU, that was supposed to stop in October 2026. Microsoft didn’t make a big announcement about the extension. It simply updated its ESU documentation and added an editor’s note to a Windows blog post saying you can enroll any time until the program ends on October 12, 2027.

Who qualifies

• Your PC must run Windows 10 version 22H2 with the latest updates installed.
• It must be the Home, Pro, Pro Education or Workstations edition.
• You need to sign in with a Microsoft account that has administrator rights. If you use a local account, Windows will ask you to switch.
• Child accounts aren’t eligible.

How to sign up

Open Settings, go to Update & Security, then Windows Update, and look for the option to enroll in Extended Security Updates. If you don’t see it, install any waiting updates first and check again. Not sure which version you have? Press the Windows key, type winver and press Enter.

Don’t treat this as a reason to wait forever

An extra year is helpful, especially with PC prices climbing because of a worldwide memory shortage (we explain that here). But security updates are all you get. New features, newer apps and some hardware will keep moving on without Windows 10. Use the year to plan:

• Check whether your current PC can run Windows 11. Many machines from before 2018 cannot.
• If it can, upgrade on your own schedule instead of in a rush next fall.
• If it cannot, budget for a replacement now, while you still have security updates protecting you.

Businesses should note that Microsoft’s business ESU program works differently and is priced per device, so check your plan before assuming you’re covered.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers and networks for homes and small businesses. Email us at [email protected].

Sources: Help Net Security, Microsoft Q&A.