'Critical' Israel power grid attack was just boring ransomware

Ransomware via a phishing attack hit Israel Electric Authority, not the power grid, but it still freaks out the world as the incident is dubbed a 'severe cyber attack;' that morphed in the media into an attack that took out the Israeli power grid.

Minister puts nation on alert, SANS Institute says move along, nothing to see here ...

The SANS Institute has moved to quell reports that Israel's energy grid has been hit by malware, revealing instead that the attacks were ransomware infecting the nation's utility regulatory authority.

Reports emerged after energy minister Dr Yuval Steinitz said a "severe" attack had hit the authority in what he reportedly called "one of the largest cyber attacks" the agency had experienced.

"We are handling the situation and I hope that soon, this very serious event will be over," Steinitz says.

Reports emerged suggesting the incident could impact the energy grid similarly to the targeted and sophisticated attacks against Ukraine, revealed earlier this year.

SANS security man Robert Lee says Israel-based analyst Eyal Sela of ClearSky Security says the reports are misleading.

"The Israel Electric Authority the Minister mentioned is in no way related to the networks of the Israeli electric companies, transmission, or distribution sites," Lee says.

"The Israeli Electric Authority is a regulatory body of roughly 30 individuals and this cyber attack is only referencing their networks.

"...new reporting shows that the cyber attack was simply ransomware delivered via phishing emails to the regulatory body's office network, and it appears it in no way endangered any infrastructure."

It is not known what ransomware infected the machines.

The latest versions of the most sophisticated malware – such as CryptoWall – cannot be removed without paying ransoms, while new and less-popular ransomware offerings contain encryption implementation flaws that allow the scumware to be removed without footing the extortion.

Secret SSH backdoor in Fortinet hardware found in more products

A recently identified backdoor in hardware sold by security company Fortinet has been found in several new products, many that were running current software, the company warned this week.

Discovery comes a month after competitor Juniper disclosed unauthorized code.

The undocumented account with a hard-coded password came to light last week when attack code exploiting the backdoor was posted online. In response, Fortinet officials said it affected only older versions of Fortinet's FortiOS software. The company went on to say the undocumented method for logging into servers using the secure shell (SSH) protocol was a "remote management" feature that had been removed in July 2014.

In a blog post published this week, Fortinet revised the statement to say the backdoor was still active in several current company products, including some versions of its FortiSwitch, FortiAnalyzer, and FortiCache devices. The company said it made the discovery after conducting a review of its products. Company officials wrote:

As previously stated, this vulnerability is an unintentional consequence of a feature that was designed with the intent of providing seamless access from an authorized FortiManager to registered FortiGate devices. It is important to note, this is not a case of a malicious backdoor implemented to grant unauthorized user access.

 In accordance with responsible disclosure, today we have issued a security advisory that provides a software update that eliminates this vulnerability in these products. This update also covers the legacy and end-of-life products listed above. We are actively working with customers and strongly recommend that all customers using the following products update their systems with the highest priority:

• FortiAnalyzer: 5.0.0 to 5.0.11 and 5.2.0 to 5.2.4 (branch 4.3 is not affected)
• FortiSwitch: 3.3.0 to 3.3.2
• FortiCache: 3.0.0 to 3.0.7 (branch 3.1 is not affected)
• FortiOS 4.1.0 to 4.1.10
• FortiOS 4.2.0 to 4.2.15
• FortiOS 4.3.0 to 4.3.16
• FortiOS 5.0.0 to 5.0.7

Undocumented backdoors have long been a security concern because they make it possible for outsiders to gain unauthorized access to sensitive devices. Backdoors have received increased scrutiny since network hardware maker Juniper dropped last month's bombshell that there was unauthorized code added to its Netscreen line of firewalls. Among other things, the unauthorized code in the Juniper product allowed attackers to surreptitiously decrypt encrypted traffic. While Fortinet officials say the backdoor in its products had no malicious intentions, there's little doubt it could be used for covert eavesdropping by people with knowledge of its presence.

Is it time to move from Windows 7, 8 and 8.1 to Windows 10?

While standing in line at a burger joint recently, we spotted a sign in the manager's office that proclaimed, "Happy employees are productive." That pretty much sums up the Windows 10 experience from the user perspective. It's fast, feature-filled, easy to use and works across many types of devices. Although a unified experience across multiple devices (and using one account) was introduced in Windows 8, it remains a key factor in Windows OS usability. But because the mouse and keyboard still rule the desktop, it's equally important that the Start menu is back in Windows 10, in all its full glory.

Since its introduction in July 2015, Windows 10 has been well-received by consumers, partly because of the free upgrade and partly because it's a great OS for end users. These days, Windows 10 is also finally gaining traction with businesses. A Spiceworks survey of IT executives indicates that 73 percent expect to deploy the software by 2017. Let's take a look at the pros and cons involved in making that upgrade.

Why upgrade?
The unified experience is here to stay, offering a "one app platform, one security model, and one management approach" that should resonate with IT managers who must mind the budget and allocate staff time resourcefully. Microsoft has said that Windows 10 is its best and final full OS release. Going forward, the company will focus on its Windows as a Service (WaaS) model, in which updates and incremental upgrades will be rolled out as they are needed. WaaS should help organizations remain current on "upgrades," making for a more secure environment along with a less costly and time-consuming update-handling process.

Microsoft points to several good reasons to upgrade to Windows 10, such as the addition of new features and functionality, a more responsive system, easy provisioning and less overall burden on IT staff. In our opinion, a few key factors worth upgrading for include the following:

• More control over deployments: Windows Update for Business provides feature upgrades and servicing updates from the cloud, which can target groups of endpoints for staggered and more controlled upgrade deployments. Essentially, IT staff can specify which groups of devices get updated and when such updates will occur. This is particularly important when mission-critical or line-of-business applications need to be tested in advance before deploying updates, so as not to "break" anything when updates are applied.
• In-place upgrades: Microsoft has removed most of the complexity and effort involving in upgrading from Windows 7 or 8/8.1. Performing an in-place upgrade is easy and, for the most part, seamless. In our experience, in-place upgrades have taken about 30 minutes on average, with little to no user input needed during the process (and where automated answer files can easily handle such input for hands-off implementations). Clean installs are rarely necessary, and this applies to any device being upgraded, not just desktops and laptops.
• Component independence: The OS treats system components as independent parts, which means they can be updated separately from the Windows core operating system. Likewise, Windows 10 provides excellent device handling, andWindows 10 is usually on-target in the drivers that it installs by default (and where issues may manifest, images can be customized easily to include such drivers for automated installations).
• Security: The new OS includes trusted boot, which prevents malware from springing up before the boot process is complete. With UEFI Secure Boot, trusted boot allows only trusted software to run during start-up. And multi-factor authentication, which includes PINs, biometrics, a trusted PC and more, is highly streamlined and enables users to sign on to devices easily and with lightning speed.

Furthermore, Mobile Device Management (MDM) is also available across Windows 10 devices and supports laptops, tablets, smartphones and Internet of Things (IoT) devices. Enterprises can use Windows 10 IoT lockdown capabilities to prevent access to unauthorized USB devices, for example, and allow only trusted apps to run on devices.

Upgrade concerns
All of the rah-rah aside, there are indeed some downsides to upgrading, but they apply to nearly any major upgrade and not just Windows 10. For starters, an organization-wide OS upgrade is a major undertaking that requires thorough planning and testing before any production machine is affected. Legacy equipment and OSes generally cause the most issues, especially where automated deployments are concerned. Old hardware and supporting equipment may need to be upgraded or replaced outright. All of that takes time and money.

Organizations must also consider licensing costs, which can be substantial. Consumers and small businesses can upgrade from qualified OSes for free (at least for a while), but large organizations and enterprises must purchase enterprise licenses and software assurance contracts. One bright light for enterprise managers is that customers can license Windows on a per-user basis with a primary device running Windows Pro or other qualified OS. This eliminates the need to keep track of every device from the perspective of licensing.

Consider that an upgrade from Windows XP to Windows 7 costs an average of about $1,000. Although upgrading to Windows 10 should come in well under that figure, even $500 per user (as an example) in a large environment still produces an eye-popping number.

Apple Can Still Read Your End-to-End Encrypted iMessages

If you are backing up your data using iCloud Backup, then you need you watch your steps NOW!

In government fight against encryption, Apple has positioned itself as a staunch defender of its user privacy by refusing the federal officials to provide encryption backdoors into its products.

When it comes to Apple's iMessage service, the company claims that it can't read messages sent between its devices because they use end-to-end encryption, which apparently means that only you and the intended recipient can read it.

Moreover, in case, if the federal authorities ask Apple to hand over messages related to any of its users, there is nothing with Apple to offer them.


"If the government laid a subpoena to get iMessages, we can't provide it," Apple CEO Tim Cook told Charlie Rose back in 2014. "It is encrypted, and we do not have a key."

But Wait!

There are still hundreds of Millions of Apple users whose data are stored on Apple's servers in plain text even after Apple's end-to-end encryption practice.

Apple Stores Your Backup in Encrypted Form, But with its Own Key

It turns out that Apple forgets to offer its so-called privacy benefits to users with iCloud Backup enabled.

If you have enabled iCloud Backup on your Apple devices, the copies of all your messages, photographs and every important data stored on your device, are encrypted on iCloud using a key controlled by the company, and not you.

This allows Apple, and hence anyone who breaks into your account, to see your personal and confidential data.

In past, we have seen incidents like The Fappening in which hackers broke into Apple's iCloud accounts to steal nude selfies of over hundred famous celebrities and thus circulated them on the Internet.

Apple allows you to switch off iCloud Backup whenever you want, but it doesn't offer a way to locally encrypt iCloud backups that would allow the company to store your personal data, including iMessage and SMS messages, on its servers but not access it.

Give the Encryption Keys in Hands of Users
Yes, it is possible to do encrypted non-cloud backups locally through iTunes, though it isn't always a so obvious choice to average users.

No doubt, Apple provides end-to-end encryption for your messages that even Apple can not access or read it, but only if you avoid the backup feature that it encourages its customers to use every time.

In fact, the company asks users to set up an iCloud account as soon as they activate their new iPhone or iPad.

However, Apple doesn't clearly states that by doing so, users otherwise 'unreadable' iMessages and other personal data become very much readable to the company as well as to anyone – whether it's law enforcement agents with a court order or hackers with access to your account.

Although it's difficult to say how many Apple users are affected, the most recent estimation from Asymco indicates there were around 500 Million iCloud users in March of 2014.

However, the exact number of users actually using iCloud Backups isn't clear yet.

Motherboard reached out to the company, but neither Apple told the estimated percentage of people using iCloud backup, nor it gave a reason for not giving users the option to store cloud backups that are encrypted locally.

One reason could be:  By allowing such backups, Apple doesn't want that its users who forget the passcode could not decrypt their data.

How to Turn Off iCloud Backup on the iPhone
We know, there is a war against the federal authorities and Apple over encryption. The law enforcement agencies are not at all happy with Apple using stronger encryption in its devices that makes it impossible for them to collar criminals.

In this situation, if Apple ignores such critical loopholes in its products, it would be possible for the federal officials to force the company to hand over its users data citing law orders.

For many users, the encryption offered by Apple is more than enough. However, if you do not want the company to access your data, the only solution is:

• Backup your personal data locally through Apple's iTunes.
• Turn off iCloud Backup. Go to Settings → iCloud → Storage & Backup → iCloud Backup.
• Now, tap the OK button to confirm that your iPhone will no longer be backing up your data automatically to your iCloud storage.

New year, new job – but beware of fake offers looking to scam you

January is traditionally a month of change for most people, be it starting new fitness and diet regimes, promising to travel more, vowing to make better use of their time, or even just giving their house a good clear out. For others, however, the beginning of a new year is a time of dramatic change, with many taking to the internet in search of a new job.

A recent survey carried out in the UK by employment website Indeed found that over 30% of employees were actively looking for new employment as part of their new year goals, while a further 11% of respondents said that finding new work was definitely on their list for 2016. Considering the increase in people scrambling for new career opportunities at this time of the year, it isn’t surprising that some criminals have seen this as a chance to take advantage of unsuspecting victims.

False offers that demand payments
One such example of a false job offer discovered in the United States required the candidate, who having successfully passed the first phase of the selection process, to log onto Yahoo Messenger for another interview. It was during this stage that she was told that to be contracted for the role she would need a number of software programs, but that the company would provide them for her if she passed them on her bank account information.

After becoming suspicious at this point, the potential candidate did some investigating online and discovered that, despite the company existing, scammers were using its name to pull off cybercrimes and that the job offer was in fact bogus.

Another such scam was spotted on Facebook, with cybercriminals yet again using the name of a reputed company to post false job offers. The process was similar to the previous one, with supposed employer requesting that applicants send payment as part of their application.

How to spot bogus job offers
If you are applying for a job offer online, here are a few quick tips to help you spot an offer that might just be too good to be true:

• Never part with your money! No matter how good the job offer is, nobody should have to give money to a potential employee when being offered a job.
• Don’t give out bank information during interviews. There is no need for a potential employee to have access to this information for an interview.
• Try to online use reputed job listing websites. If you are in doubt, double check on the company’s website to see if it is listed there. Many of these scams use the names of legitimate companies to trick people.
• Be cautious with potential new contacts on LinkedIn, as there has been an increase in fake profiles looking to steal user information.
• There is only a cellphone supplied for enquiries as opposed to a direct landline.
• The company is using a free email service for correspondence such as Gmail or Yahoo. Legitimate job related emails should come from corporate accounts.
• If you are offered a job just on the basis of your CV, be suspicious. Most recruitment processes have a number of stages and an interview is definitely one of them.
• Be wary of offers for jobs that you never applied for.
• Finally, be aware of job offers that are too good to be true. If they’re offering you the chance to work from home and earn a huge salary, then it’s more than likely a scam.

By keeping your wits about you when looking for a jobs online, and following the tips above, you can avoid being a victim of identity theft and fraud. Remember, if it looks too good to be true, then it likely is!

Hacker-Friendly Search Engine that Lists Every Internet-Connected Device

Meet an all-new Hacker’s Search Engine similar to Shodan – Censys.

At the end of last month, security researchers from SEC Consult found that the lazy manufacturers of home routers and Internet of Things (IoT) devices have been re-using the same set of hard-coded cryptographic keys, leaving around 3 millions of IoT devices open to mass hijacking.

But how did the researchers get this number?
Researchers uncovered these devices with the help of Censys – a new search engine that daily scans the whole Internet for all the vulnerable devices.

Censys Maintains Complete Database of Everything on The Internet
Censys is similar to hacker's search engine Shodan, which is designed specifically to locate any devices that have been carelessly plugged into the Internet without much attempt at preventing unauthorized access.

However, Censys employs a more advanced method to find vulnerabilities in the devices and make the Internet a safer place.

Censys is a free search engine that was originally released in October by researchers from the University of Michigan and is powered by the world's biggest search engine Google.

Censys is part of an open source project that aims at maintaining a "complete database of everything on the Internet," helping researchers and companies unearth Online security mishaps and vulnerabilities in products and services.

How Does Censys Work?
Censys collects information on hosts and websites via daily scans of the IPv4 address space – the internet protocol version 4 that routes the majority of the Internet traffic today.

In order to do so, the new search engine uses two companion tools:

• ZMap – an open-source network scanner
• ZGrab – an application layer scanner

Censys then maintains a database of how hosts and websites are configured, allowing researchers to query the data through a search interface, report builder, and SQL engine.

ZMap scans over 4 Billion IP addresses on the Internet and collects new data every day. It also helps determine whether the machines on the internet have security vulnerabilities that should be fixed before being exploited by the hackers.

"We have found everything from ATMs and bank safes to industrial control systems for power plants. It's kind of scary," said Zakir Durumeric, the researcher leading the Censys project at the University of Michigan.

Obvious flaws in addition to issues caused by IT administrator failures can also be found.

Here's the MIT Technology Review on Censys, titled "A Search Engine for the Internet’s Dirty Secrets."

More details on the Censys architecture and functionalities are available in the team's research paper.

If you would like to give Censys a try, you can follow the step-by-step tutorial offered by the developers.

Rise in cybercrime among top drivers of investment in forensic data analytics

Cyber breaches and insider threats, which include malicious insiders stealing, manipulating or destroying data, are the fastest-growing risks according to executives and are driving investment in forensic data analytics, according to a new survey.

EY’s 2016 Global Forensic Data Analytics Survey, "Shifting into High Gear: Mitigating Risks and Demonstrating Returns," found that internal fraud risk ranks highest for the application of FDA at 77% and cyber breach or insider threat risk ranks second at 70%.

Sixty-nine percent say that they need to do more to improve their current anti-fraud procedures, including the use of FDA tools. Notably, this figure increased to 74% for the C-suite cohort.

Of those respondents citing regulatory pressure as the reason to improve their procedures, C-suite respondents were found to be the most concerned as regulatory enforcement becomes more rigorous and widespread.

“For organizations, the threat of cybercrime is an everyday reality, posing a dynamic and relentless challenge," says David Stulb, EY’s Global Leader of Fraud Investigation & Dispute Services (FIDS).

"This means that boards and senior management need to incorporate FDA as a critical component of their risk management and compliance programs. This is especially critical given the current regulatory enforcement environment and market reaction to instances of alleged corporate fraud, bribery and cyber breach.”

Increased FDA investment
With just 55% of respondents saying that their FDA spend is sufficient, a drop from 64% in our  2014 survey, it is no surprise that three out of five say that they plan to spend more on FDA in the next two years. When looking at the reasons for increased investment, the survey found that responding to growing cybercrime risks and increased regulatory scrutiny are the top drivers at 53% and 43%, respectively.

How FDA tools are deployed is also changing, with 63% of respondents saying they invest at least half of their FDA budget on proactive monitoring activities.

FDA use on the rise
In response to these increased risks, the use of advanced FDA is becoming mainstream, with new technologies and surveillance monitoring techniques widely used to help companies manage current and emerging fraud and cyber risks.

The rising maturity of corporate FDA efforts is also evident through the growing sophistication in their use of data. Seventy-five percent of respondents routinely analyze a wide range of structured and unstructured data, enabling them to gain a comprehensive view of their risk environment.

David Remnitz, EY’s FIDS Global and Americas Forensic Technology & Discovery Services (FTDS) Leader, remarks: “Given the level of pressure organizations are facing on fraud prevention, it is no surprise that the majority of respondents are expending more effort on proactive initiatives.

"Today, FDA is becoming indispensable to proactive risk management. Organizations need to recognize the role FDA can play not only in their reactive investigations, but also in their proactive surveillance, compliance, anti-fraud and cyber breach response efforts.”

Report: Security pros losing confidence

Security professionals were less confident in their security infrastructure in 2015 than in 2014, according to a report released by Cisco.

In 2014, 64 percent of security pros said that their infrastructure was up to date, while only 59 percent felt the same way about 2015. In addition, in 2015, 54 percent said they strongly believe that they do a good job of building security into procedures for acquiring, developing, and maintaining systems, compared with 58 percent in 2014.

"Despite all the hard efforts, there is concern that both the speed at which the technology and capabilities being deployed, and the number of people, qualified individuals to be hired, and the overall approach in the face of an overwhelming number of attacks," said John N. Stewart, chief security and trust officer and senior vice president at Cisco Systems. "This is causing confidence to go down."

Aging infrastructure was another issue raised in the report.

An analysis of more than 115,000 Cisco devices showed that 92 percent were running software with known vulnerabilities, 31 percent were no longer on the market, and 8 percent were "end of life."

The financial services industry has the highest percentage of devices that had passed their last day of support, at 20 percent.

Jason Brvenik, a principal engineer at Cisco, said that the likely explanation for this is that the financial sector has long been an early adopter of technology.

"They have more devices deployed in more places, and would have aging infrastructure," he said.

On an unrelated note, the Cisco report also uncovered browser extensions as a dangerous attack vector often overlooked by security teams.

According to Cisco, adware and browser injections were among the most difficult threats to detect, taking up to 200 hours. By comparison, downloaders that target Microsoft Word users are typically detected in less than 20 hours.

Security teams often spend less time on adware and browser injections, classifying them as lower priority.

"It's seemingly benign, it seems to offer value to the user, they like to use it," said Brvenik.

But they create invasive paths that attackers can use to install more dangerous applications, he said -- and more than 85 percent of organization were affected by malicious browser extensions.

The main problem, he said, is that many users are running out-of-date browsers that allow these malicious extensions to slip through.

"We know organizations have legacy applications that require them to legacy versions of browsers," he said. "But I advocate that, if you could, you should restrict them from accessing the Internet. They need to deploy a firewall to decide whether a version of a browser is allowed to access the Internet or not. They will significantly reduce their exposure if they enforce that policy."

Attackers use SQL injections to manipulate search engine rankings

Akamai Technologies, Inc. has issued a new Web security threat advisory from the company’s Threat Research Division. Threat Research has identified a sophisticated search engine optimization (SEO) campaign that uses SQL injections to attack targeted websites.

Affected websites will distribute hidden Hypertext Markup Language (HTML) links that confuse search engine bots and erroneously impact page rankings.

Over the course of a two week period in Q3 2015, Threat Research analyzed data gathered from the Akamai Intelligent Platform and observed attacks on more than 3,800 websites and 348 unique IP addresses participating in the various campaigns, revealing the following key findings:

• Evidence of mass defacement – when searching the Internet for the HTML links that were used as part of this campaign, Threat Research identified hundreds of web applications containing these malicious links.
• Attacks manipulated search engine results – when searching for a combination of common words such as “cheat” and “story”, it was apparent that the “cheating stories” application appeared on the first page of the leading search engines.
• Analytics showcased impact of attacks – Threat Research looked at Alexa analytics and the ranking of the “cheating stories” application dramatically increased during the three month span.

Search engines use specific algorithms to determine page rankings and indexing for sites on the web, and the number and reputation of links that redirect to the web application influence these rankings. The SEO attackers created a chain of external links that direct to stories of cheating and infidelity on the web to mimic normal web content and impact search engine algorithms.

“The ability to manipulate page rankings is an enticing proposition and business for attackers,” said Stuart Scholly, Senior Vice President and General Manager, Security Business Unit, Akamai. “If successful, attacks can impact revenue and, most importantly, the reputation of many organizations and companies using the Internet.”

Mitigation
Attacks in the campaign have demonstrated a unique understanding of search engine operations, and accordingly, Threat Research recommends the following defense techniques:

• For Web Application Developers
• Ensure that you have implemented proper input validation checks for all user-supplied data that will be used within a back-end database query. Reference: https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
• Only use prepared statements with parameterized queries when constructing SQL queries based on user-supplied data. Reference: https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

• For Web Application Defenders
• Deploy a Web Application Firewall (WAF) that is configured in a blocking mode for SQL Injection attacks.
• Consider profiling and monitoring the HTML response body format to help identify if there are significant changes such as an increase in the number of web links.

Cyber criminals using email scam to spread virus via WhatsApp

MILLIONS of WhatsApp users are being warned to watch out for a fake email that will install a dangerous virus on their phones.

Clever cybercriminals have created the malware which is specifically designed to trick WhatsApp users on either iPhones or Android devices.

The virus is being circulated via email and is designed to look like it’s been sent by a legitimate source, researchers at Comodo Labs say. Fraudsters hope users will open the scam email and download the attached virus, which then infiltrates their phone.

Emails from the criminals contain sneaky subject lines including, “new voice message” or “an audio memo was missed” followed by a play button.

Others have received messages including “a brief audio recording has been delivered”, “a short vocal recording was obtained” and a fake notification about a video note.

Although none of the emails come from a WhatsApp address they are “disguised with an umbrella branding”, Comodo confirmed.

WhatsAppers should be aware that all voice memos, audio memos, recordings and notifications will be received in the app only.

Every scam email contains a compressed ZIP file which unleashes the secret malware into your phone when downloaded. The virus then duplicates in multiple system folders and adds itself into an auto-run in the computer’s registry.

“Cybercriminals are becoming more and more like marketers, trying to use creative subject lines to have unsuspecting emails be clicked and opened to spread malware,” said Fatih Orhan, a director of Comodo Antispam Labs.

“As a company, Comodo is working diligently in creating innovative technology solutions that stay a step ahead of the cybercriminals, protect and secure endpoints, and keep enterprises and IT environments safe.”

From Today Onwards, Don't You Even Dare to Use Microsoft Internet Explorer

Yes, from today, Microsoft is ending the support for versions 8, 9 and 10 of its home-built browser Internet Explorer, thereby encouraging Windows users to switch on to Internet Explorer version 11 or its newest Edge browser.

Microsoft is going to release one last patch update for IE8, IE9 and IE10 today, but this time along with an "End of Life" notice, meaning Microsoft will no longer support the older versions.

So, if you want to receive continuous updates for your web browser and avoid being exposed to potential security risks after 12 January, you are advised to upgrade your browser to Internet Explorer 11, or its new Edge browser.

End of Life of Internet Explorer 8, 9 and 10 
"Internet Explorer 11 is the last version of Internet Explorer, and will continue to receive security updates, compatibility fixes, and technical support on Windows 7, Windows 8.1, and Windows 10," Microsoft says.

This move could be part of Microsoft's bigger plan to move its users to the new Edge browser, which is currently available only on Windows 10 PCs.

With the launch of Microsoft Edge last April, the company attempted to encourage Windows 10 users to switch to Edge if they are using its rival browser, such as Google Chrome or Mozilla Firefox, as the default web browser.

Edge has been designed completely separate to Internet Explorer, and promises speed and usability, with support for Cortana -- Microsoft's virtual assistant.

Around 340 Million Users Run Internet Explorer
For higher adoption of Edge, Microsoft is finally ending support for Internet Explorer 8, 9 and 10. However, an estimated 340 Million Windows users are still running Internet Explorer, and nearly half of those are believed to be using one of the expired IE versions.

Therefore, the older versions of the browser will receive KB3123303 patch today that will feature "nag box" asking users to upgrade their browser.

If you have "Automatic Updates" turned ON, you most likely upgraded to IE11 already. However, users with older IE browsers can turn "Automatic Updates" ON by clicking on "Check for Updates" in the "Windows Update" section of the Control Panel.