There are two main categories of jigglers:

• Software Jigglers: A computer program that is installed on the host which automatically moves the cursor at a set interval.
  Pro’s: Cheap or Free, easily configurable, no extra circuitry
  Cons: User may not be authorised to install software, easy to detect by IT department
• Hardware jigglers: A device which tricks the operating system into thinking its a mouse.
  An onboard micro-controller generates random or predefined movements
  Pro’s: Plug & Play, No configuration, hard to detect, reliable
  Con’s: Costs money, harder to reprogram

In this article we will be using a Digispark which is an affordable development board powered by a ATtiny85 micro-controller running at 16MHZ with 6K usable flash which can communicate with a host over USB. These boards are incredibly capable and can be used for a wide range of tasks including injecting keystrokes and mouse movements.

When you get your Digispark it will look similar to the picture, for this project we will not be using header pins and we will be programming the device through USB.

1. 1. 1. The first step of programming the Digispark is downloading the latest Arduino programming IDE.
         https://www.arduino.cc/en/Main/Software
         
      2. Next is downloading and installing the Digispark drivers. You may need to accept multiple notifications through the install process.
         https://github.com/digistump/DigistumpArduino/releases
      3. Once both the Arduino IDE and Digispark drivers have been installed, add the digispark JSON configuration file to the IDE. This is done by opening the Arduino IDE, clicking on ‘File, Preferences’ and adding the following URL into the ‘Additional Boards Manager URL’s’ box, then click ‘OK’.

         https://raw.githubusercontent.com/digistump/arduino-boards-index/master/package_digistump_index.json

         

      4. Once installed, go-to Tools –> Board and select “Board Manager
         
      5. In the top left hand corner change the Type to “Contributed” and click the install button on the “Digistump AVR Boards by Digistump package”. This will allow the Arduino IDE to program the Digispark controllers.
         
      6. Once installed, go-to Tools –> Board and select “Digispark – Default 16.5mhz”. This set’s the IDE to compile the code for the Digispark board.
         
      7. Next go-to, Tools –>Programmer and set it as “USBtinyISP”
         
      8. We have created an opensource simple Mouse Jiggler sketch (program) for the Digispark v3 which moves the cursor every 10-30 seconds in a square pattern. Download and open it in Arduino IDE.
         Download: MouseJiggler.ino
      9. Click on the “Upload” button to compile the sketch and upload it to the Digispark.
         
      10. If successful, you should now see the Digispark flash every 10-30 seconds to indicate a ‘mouse jiggle’. The mouse movement should be near undetectable.

We hope you you enjoyed this post. If you did please leave us a comment below.

The post How to make a mouse jiggler with Digispark first appeared on Air-Gap.

Contrary to popular belief RSA SecureID hardware tokens do not have a radio receiver’s in them and don’t have anyway to communicate. In Fact they are actually more similar to a digital watch and operate on the principle of both parties knowing a shared secret, also known as symmetric key cryptography

When each RSA token is manufactured the current time is set alongside a unique 128bit ‘seed’ which is only known by the individual token and the manufacturer. Every 60 seconds the token generates a new 6 digit code using a mathematical formula containing elements of the secret seed value and current timestamp. Exactly how this algorithm works is still a secret, but what we publicly know is it’s based on a secure one way AES hash.

As the user signs in, the RSA’s authentication servers run the same formula using their copy of the same ‘seed value’ and the servers time which should generate the same code. If the codes don’t match, the server will run the same calculation but plus/minus a minute to check if the token is running a little fast or slow. Should one of those codes work the server will recognise that the built in clock of the token must have drifted and will apply a ‘token offset’ for next time.

If the codes are still not working despite a +- 1 minute correction, the server will calculate all the possible codes +- 10 minutes and try it against those. Should the code match any of these the authentication server will acknowledge it as a possible match and challenge the user by asking for the next code in the sequence to ensure it wasn’t just a lucky guess. If the code isn’t correct the user will need to contact the organisation and request a new token.

Despite these tokens working on straight-forward and relatively low-tech concepts, they are incredibly effective and significantly improve security when used for 2 Factor authentication. While not all services allow you to use RSA token, many popular services allow you to use apps like ‘Google Authenticator’ which operate very similarly.

Was this article useful and did you have any questions?
Leave us a comment below

The post How RSA SecureID tokens work first appeared on Air-Gap.

Using Excel formula’s you can easily create the raw SQL statements which can be executed on the database without the need for third-party plugins or special tools.

Creating Insert Statement’s

In this example we are wanting to insert 5 rows containing a staff members idNo and Name.

1) The first step is to arrange the data in the layout you want it to be inserted.

2) Double click into the next blank column beside you’re first row and insert the following formula.
= “insert into table_name (first_column,second_column) values ( ‘” & A2& “‘, ‘” & B2& “‘);”

3) You will need to start changing the 3 default formula values: table_name, first_column, second_column and cell no’s if they are different from this example. In this example we are using staff as the table name, idNo as the first column and Name as the second column.
If you are inserting more fields you will need to expand the formula by adding the extra column information.
For example: = “insert into staff (idNo,Name, Age) values ( ‘” & A2& “‘, ‘” & B2& “‘, ‘” & D2& “‘);”

4) Click enter when you have finished modifying the required fields, you should see your SQL insert Statement for the first column.

5) Click on the right hand corner of the SQL statement and drag it down to the last column.

6)When you let go, excel should automatically generate the remaining SQL statements. These can be copied out and executed on your database.

Creating Update Statements

A similar technique can be used to create ‘Update’ statements. In this example we are updating the ‘rrp’ field of the ‘stock’ table for a particular ‘partNo’. The ‘partName’ column is unused in this example and is typical of what you may find in the real world, you should always update rows using the tables unique ‘Primary Key’.

1) Like the first example, layout your data into columns

2) Double click into the next blank column beside you’re first row and insert the following formula.
= “update table_name set column_value_to_update = ‘” & C2 & “‘ where column_primaryKey = ‘” & A2 & “‘;”

3) Change the 3 default formula values: table_name, column_value_to_update, column_primaryKey and the cell no’s if they are different from this example.

4) When you are happy with the formula, drag down the cell to generate the SQL statement

Did you find this guide useful?
Leave us a commend below

The post Creating MYSQL Insert and Update statements with EXCEL first appeared on Air-Gap.

Increasingly fraudulent emails have become very deceptive with some being almost indistinguishable to genuine emails, this guide will help teach you some tricks to spot phishing .

1) Look at the email address

The easiest way to weed out the worst of the scam messages is looking at the email address its common from. If it ends in an unfamiliar domain like ‘.ru, .online, .store’, looks a little strange or has a spelling mistake like service@paypall.com with two L’s it’s almost certainly a scam as the address is taking you to a different site. Just note that email address its appearing to come from can be faked!

2) Different Reply address

An attacker almost always wants the ability to receive an email back from you, even if they appear to appear to have sent it from a fake email address. Click reply and see if the address changes.
If the new email is not identical to the alleged sender, especially if it goes to a free email account like Gmail or a strange email addresses its most likely fake.

3) Spelling Mistakes

Very rarely do large companies make obvious spelling mistakes in their emails. Spam and phishing messages may have poor spelling due to having a poor understanding of English or may even be added intentionally so all but the most gullible targets fall for it, making it more efficient for the attacker.

4) Hover over links

As a rule you should never click on links in emails as they may sneakily lead to a different website than what they display. Hover the mouse pointer over the link with your mouse and look at the URL in the box below. If it doesn’t match exactly match the above text its almost certainly a scam.

5) Urgent sounding

Most malicious messages want you to react urgently and perform a task such as verifying sensitive information, logging into an account, sending money or to click on a link to claim a parcel. While not evidence any urgent sounding or bizarre email should raise suspicion.

6) Is the email personalised with your personal details?

It’s unlikely your Bank or Colleagues have forgotten your name! Important emails should be personally addressed with your Full name and if applicable account number. Generic titles such as ‘Dear Sir’, ‘Dear Madam’, ‘Dear Friend’ is good warning size.

7) Verify the contact details in the signature field

If you have doubts about the email, check the name, job title and look at the log. Does the name sounds overly generic, is that person who you normally talk too and does the contact number match your the details you have on file?

8) Call the company

If your still not completely convinced there is no shame in giving the company a call and confirming if they sent the email. Make sure you call the company by visiting their official website or through the Yellow Pages and do not use the contact details from the email. Emails requesting you change the banking details of a organisation should always be confirmed with a phone call.

9) Unusual Attachments

You should always be careful opening attachments, especially if they have unusual file extensions like ‘.js’, ‘.vbs’, ‘.exe’ hidden inside of a zip file. Many new attackers are no longer sending these attachments due to spam filters stopping them, its becoming common now to send a pdf with a shortened URL linked to a phishing site.

10) Trust your instincts

Sometimes you will just have a gut feeling something isn’t right but you can’t just put pinpoint exactly what is. Don’t ignore this feeling, often its normally right! When in doubt treat it as suspect and get someone else to look at it. Its always better to play it safe.

11) Take the Test

Are you ready to see how good your skills are?
Click on the link below and see if you can spot the difference between genuine and phishing emails!

https://phishingquiz.withgoogle.com/

If you think you think you may have accidentally fallen a phishing email don’t panic and don’t try to ignore it. The faster you act the less damage can be caused.
Take a screen shot of the email or the website you visited, note down what information may have been compromised (ie bank credentials) and contact the organisation to alert them. If something was possibly downloaded or an attachment clicked, immediately contact your IT Support.

Do you need assistance or obligation free advice with phishing emails, spam filtering or IT support? Please feel free to give us a call on 1300 733 240 or send us a message .

Know any more tricks to identifying and fighting suspicious emails?
Leave us a comment below

The post How To Spot Phishing Emails first appeared on Air-Gap.

The answer to that is usually NO. Most people just want a reliable affordable server, dedicated IP, snapshot backups and a easy to use firewall. My personal favourite which meets this criteria is Vultr which we use for testing, development and deployment of non critical workloads.

It’s quick and easy to spin up servers, management features are straightforward and you don’t have to be a detective to figure out the billing.

Pictures really sum up a thousand words here.

Main Dashboard

This is the main dashboard you are presented with when first signing on. In this demo environment we have 3 servers in 3 different data centres. Their location, status and billed amount for the month is clearly visible. Servers in the dashboard can be sorted by ‘location’, ‘alphabetically’ or grouped by ‘tag’.

Deploying a new Server

There isn’t a great deal to the process.
1) Click on the data-center you want it located in,
2) Choose an OS, template or Upload an ISO yourself
3) Choose what sized server you want then hit Deploy

Instance Management
By clicking on the instance you get more detailed information about the server such as its hardware specifications and usage statistics. Automatic Snapshot Backups of the server can be taken for an additional cost.

Firewall
Included for free is a basic rule based firewall which sits between the internet and the virtual machines WAN port. Its easy to use and powerful enough for most applications. Firewall rule groups once created an be linked to multiple instances. Currently DDoS protection is not available in the Sydney location.

What’s Hot
-Easiest to use interface on the market
-One of the cheapest cloud providers, and NO CONTRACTS
-Sensible sizes of servers (1 Core/1GB RAM, 2 Cores/4GB RAM etc)
-High performance servers, with SSD storage
-Very transparent upfront pricing which is billed hourly
-Licenced Windows Server instances available for an extra cost
-Ability to upload custom ISO’s for installation
-1 click App Templates: cPanel (extra cost), OwnCloud, Lamp Stack
-Straightforward firewall and private networks
-100% uptime SLA (Credit for downtime)
-Quick Response to Tickets and a comprehensive good documentation library

What’s not
-Instances are charged the full rate, regardless of if they are running or offline.
-Limited number of locations (16 as of January 2019)
-Storage charged in complete blocks (ie 10GB) not per KB like Amazon S3.
-Billed in US dollars
-No High-Availability or inbuilt network load balancers, however home-brew options exist
-No instance monitoring, ie server has gone down, or CPU threshold warnings
-No Paid Support Options

Summary

While we haven’t experienced any issues we wouldn’t recommend using Vultr in production unless you have your own internal safeguards to mitigate against downtime and data loss. Nor is Vultr a direct rival Amazon or Microsoft with its hundreds of different complementary technologies like network load balancers.

For general web hosting we’d recommend against setting up your own linux servers as quite often shared cPanel hosting is faster,cheaper, more stable, more secure and almost always easier to use.

If your just looking to spin up a few linux instances, run a game server or setup services like VPN’s it may be perfectly suited and a fraction of the cost of it’s larger competitors.

Interested in using Vultr? For a limited time, use the link below to get $50 free credit to trial the platform:  https://www.vultr.com/?ref=7774721-4F

What are your thoughts on Vultr, leave us a comment below

The post Vultr, the affordable easy to use cloud first appeared on Air-Gap.

Here are 10 reasons why your organisation should be using a Asset Register.

1. Everything’s easier when it’s a ID number!
   From writing a support ticket to telling a contractor what piece of equipment to pick up, its universally easier to refer to an item by its tag number instead of its description.
2. Recording details about the item
   Don’t get caught off-guard trying to remember something about the item or dig through piles of receipts to track down a serial number. Everything from the purchase price, model number, specs, serial and even a picture can be recorded for future use.
3. When it was last serviced
   Every service technician has equipment that they swear must have been a boomerang in its past life or responsible for half departments headaches. A register is an excellent way of keeping track of recurring problems and ensuring equipment is serviced as scheduled.
4. Location
   Tracking down long lost equipment can be akin to mounting a search and rescue mission to locate a missing person. An asset register can quickly zero in on an items last known position, especially in conjunction with regular stock takes.
5. Reuniting lost equipment
   The reverse case is often true where equipment is discovered in the wrong place without any documentation. The purpose and owner of such equipment can be located in seconds and certainty with a register.
6. Lifecycle Management
   Thousands of pieces of equipment in all shapes and sizes pass through an organisation over the years. Knowing when equipment was purchased, its current status and when it was disposed of is becoming vital for compliance purposes.
7. Statistics and Reporting
   As organisations evolve, the need to know exactly what the company owns is becoming an expectation and not just a luxury. Don’t let a questions such as ‘How many phones do we have on site’ take hours to answer.
8. Assigning expenses to equipment
   This is becoming a requirement in many business as greater emphasis is put on assigning expenses to their respective cost centre. By treating assets as a unique number with a detailed register, costs such as toner, paper, servicing and replacement can be assigned with greater accuracy.
9. Transfer of ownership
   Over the years assets and the responsibilities for them change hands. Asset registers are a great way to Irrefutably track such changes.
10. Integrate it with your other services
    An asset register should be a piece of paper hidden in a draw, take advantage of it by connecting it to your help-desk, Active-Directory naming scheme and company procedures.

Is your organisation looking for an Asset Management Solution? Contact Us to see how we can help

What creative ways is your company using a Asset Register? Comment Below

The post 10 Reasons Why You Should Be Using Asset Registers first appeared on Air-Gap.

VoIP is the all the rage, and it doesn’t mean you need to compromise on poor call quality and awkward hard to use software phones.

Traditional phone services work by delivering voice signals over dedicated copper lines from your

telcos exchange to either individual handsets or a PABX. Thanks to the maturity of the internet and evolution of phone systems, voice signals can be delivered over the internet and across computer networking infrastructure.

More competitive plans

The main drive for VoIP is value and flexibility. Not being forced to rent telephone lines allows enormous flexibility in choosing plans from a wide range of providers which best meet your organisations exact requirements.

Typically most plans are broken down into either ‘Pay as you go’ or a fixed monthly fee per handset which includes a fixed number of calls. How many handsets and how you use them will decide which approach is best.

When comparing plans make sure you consider:

• Number of lines:How many concurrent incoming/outgoing calls do you need
• Is the service charged per device or per incoming/outgoing line
• How many and what type of incoming telephone numbers (DID) do I need, and how much will they cost.
• Does the service include hardware such as new VoIP handsets.
• Is the PABX (brains responsible for routing calls) located on premise or hosted on the cloud ?/li>

Redundancy
The cost of losing telephones for even a few minutes is enormous. When traditional ISDN and PSTN telephone services fail it can take hours to divert numbers and days for the fault to be fully fixed.

Being delivered over the Internet, VoIP phones and the computer network as a whole can be made resilient against a range of common issues such as failover to 4G if the main internet link being severed, powerback if the power fails or an instant diversion if the site is unable to take calls.

Scalability and Management

Adding new phones or a new number to the pool is no longer an expensive project. Unlike traditional telephones, VoIP phones do not need dedicated telephone wiring and can are powered off the same Ethernet socket as your computer. This enables flexible deployment and substantial cost savings when deploying handsets or wiring up a new premise.
In most cases changes such as new numbers and new call groups can be configured remotely without the need for a onsite visit, saving you time and money.

21st Century Features

Modern VoIP systems are more than just phones bringing enterprise features at affordable prices!  Some of these Include:

• Advanced call management: Calls can be transferred, queued and forwarded throughout the organisation with minimal fuss.
• Voicemail To Email’: Ensures staff are up to date, even when out of the office.
• Call Recording: Calls can be recorded and stored for quality assurance./li>
• Conference calling: Between staff members, offices and external numbers
• Calendars and Contact Lists: Company and Personal contact lists

Are you reaching the limitations of your existing telephone system and considering VoIP or wanting to find out how VoIP can work for you? We’d love to chat, drop us a line or email.

The post Is your business VoIP Ready? first appeared on Air-Gap.

In what country will the website be hosted and will it be hosted in a professional data-centre?

Websites can be hosted anywhere, from a old computer stuffed a closet in India to a dedicated server in a local data centre.

With websites every second counts, ~40% of people abandon sites if they take any longer than 3 seconds to load and Google will actively penalise you in search rankings.

What CMS (platform) will you be using and how many years experience do you have working with it ie WordPress?

There are many different types of ‘platforms’ which run a website. The majority of sites run off ‘WordPress’, a graphical highly modifiable framework which is easy to use and has industry wide support.

Some platforms like ‘Wix’ are exclusively hosted by one company which you are at their mercy with for costing and availability. Developers specialises in different areas and what platform they use will heavily influence price, performance, look, third party support and customisation. Be sure to get multiple quotes and advice from different sources.

How much involvement will I have, and what are my responsibilities?

Every developer will have different strategies of how they operate. Many will take your money and deliver a complete site in several weeks time with minimal input, while others will design the site and prefer you to write your own content.

Both have their own advantages and disadvantages, most notably being cost, relevance of content and your personal time investment. If you already have a fair idea of what your after and are prepared to write your own content you can save substantial amounts of money.

Will the developer be using a template, or designing it from scratch?

Most websites you visit are based off templates, it reduces development time from weeks to hours which is good for cost, however not so great if your looking for complete originality.

This isn’t to say templates all look the same, you can certainly customise most with different colours, pictures and text however you might bump into a similar site one day. If you want custom work, be prepared to pay for it.

Is the site optimised for mobile devices?

Driven by the uptake of smart phones, “52.2 percent of all website traffic traffic worldwide {is} generated through mobile phones” and this number is increasing every day. Quite simply if the site isn’t compatible with mobile devices you’ve just cut your websites audience in half.

Will the site have social media integration?

Social Media is the lifeblood of marketing in the 21st century. It allow’s you to put a face to your customers, build a loyal community and target your audience effectively. Regardless of if your a fan of Facebook or not, its a necessity.

Is the site backed up, and if so how often and how long are the backups stored?

Your website will become an investment worth thousands of dollars and hundreds of hours of work. Things sometimes go wrong  be it faulty servers, accidents while updating the site to hackers.

Your site should be backed up at-least once a week, preferably every day. Make sure you ask and confirm this as shockingly not all developers include this.

Is there are a SLA (Service Level Agreement), what is the guaranteed up-time and what is the compensation?

Like your phone, your website is a vital business tool and when its down it will start costing lost sales. Most developers and hosting providers will have a formal agreement in place called a SLA (Service Level Agreement) which guarantees performance, up-time and service with penalties if broken.

No provider can guarantee 100% uptime, most reputable providers will guarantee of ~99.5% which equates to 44 minutes of permissible downtime per month. Very rarely do providers fall below this threshold however if availability is critical you will need to consider enterprise grade hosting.

What SEO (Search Engine Optimisation) is included?

Unfortunately websites don’t rank themselves on the first page of Google and its a daunting process to be ranked in the top. There are two ways to rank first in Google, spend thousands of dollars a month on Google Adwords or produce useful well optimised content for readers to consume.

Every site should at-least have basic SEO optimisation included, so Google knows what your site is about and can easily read your pages. To rank high, research will need to be performed on what keywords are effective for your industry, analysing of competitors techniques, designing marketing campaigns and production of new content like blog posts.

Realistically this process could cost hundreds of dollars a month excluding the cost of advertisements. Check with your web-developer on what is included to avoid disappointment.

Be realistic on your expectations. It takes years and tens of thousands of dollars to rank 1st. Anyone who can promise immediate results is lying!

Are Emails included?

Email addresses which match’s your business name adds instant credibility.
Ask your developer if an email address is included or is an option for an extra fee.

What is the end-to-end expected cost?

This is probably the most important question which will decide who gets the job.
Quality websites are expensive to to create and good developers charge accordingly.

Ensure the end price should include: Domain name registration, development costs, paid plugin, commercial paid pictures.

What are the ongoing cost, and how are modifications charged?

Almost all developers will charge a flat monthly fee on-top of the initial setup amount for ongoing support, hosting and SEO.

Occasionally you may want to update the design, edit the content or add a new page. Ask the developer how much their hourly rate is for modifications and if their is inbuilt functionality for you to modify pages yourself.

How long will it take to complete the website?

Starting a website is exciting, ask your developer how long the website is estimated to take. Realistically it will take at-least a couple of weeks to design, setup and build the site.

Will I own the website and domain name?

This is the question developers like to tippy toe around and more often than not leads in legal action. If you were to have a fallout with company managing the site will they allow you to transfer it?

Your domain name “www.example.com.au” should always be owned and be in the name of the business, no exceptions. You should also insist for full ‘developer’ access to the site and FTP credentials for your records, even if you don’t intend to use them.

Good luck on your new website.
If you need any help or advice please feel welcome to give us a call on 1300 733 240 or send us a message.

Were these tips useful or do you have more tips?
Leave us a comment below

The post Essential questions to ask your web developer first appeared on Air-Gap.