Blog – Page 27

Microsoft Ending Forum Support For Older Operating Systems

June 21, 2018 by Joseph Martin

Big changes are coming from Microsoft starting in July (exact date unknown), and it has potentially dire implications if you’re using some of the company’s older technology.

Microsoft announced that in July, they’ll no longer provide forum-based support for a wide range of products and software, including:

Microsoft Band

Zune

Surface Pro

Surface Pro 2

Surface RT

Surface 2

Microsoft Security Essentials

Internet Explorer 10

Office 2010

Office 2013

Windows 7

Windows 8.1

Windows 8.1 RT

Although the company didn’t cite a specific reason for the change, it seems obvious that this is another move to push people into buying the latest and greatest of the company’s offerings. Unfortunately for them, the announcement has been met with more than a little hostility, and for good reason.

Consider that the company has pledged to continue to support Windows 7 until 2020, and Windows 8.1 (and variants) until 2023. Given that we’re still quite some distance from those EOL dates, closing an important avenue of support for a product the company is still ostensibly supporting seems a bit premature. Nonetheless, there’s no indication at this time that the company has plans to extend the forum support for any of these products beyond July.

In some instances, this won’t prove to be problematic. Few people still use Internet Explorer 10 as anything more than a curiosity, and Zune was never especially popular, so the loss of those forums isn’t likely to cause much backlash. However, in the case of Windows 7 and 8.1, not only has the company pledged support for years to come, but those products are still actively used by a significant minority around the world, and those users aren’t thrilled with the recent announcement.

In any case, given that the company is unlikely to change course, this is all the more reason to make upgrading a priority if you’re still using any of the products mentioned above.

Attackers Targeting Job Seekers Via Listings And Recruitment

June 20, 2018 by Joseph Martin

Cyber-criminals around the world are increasingly focusing their attention on job seekers. According to the security firm Flashpoint, there has been a notable uptick in ploys involving phony job listings that attempt to get job seekers to give up personal information.

Perhaps the biggest surprise is the fact that this is only now becoming a growing threat. After all, from the cyber-criminal’s point of view, it’s low hanging fruit. Job seekers expect that they’ll be asked for all types of personal information when applying for positions, after all.

As long as the criminals take the time to make their offers appear legitimate, most applicants wouldn’t think twice about sending in their resume (complete with physical address and phone number), and then, a bit later in the process, their social security number and other personal and confidential information.

According to Flashpoint analyst David Shear, it’s not just personal information the criminals are after, however. Increasingly, criminals are seeking to engage the services of the people who “apply,” by using them as unwitting money mules, or using them as part of an intricate money laundering scheme.

On top of that, it’s all too easy for the criminal to respond to an applicant’s inquiry with an email containing an attachment (usually a poisoned PDF). Again, since the applicant thinks he (or she) has replied to a legitimate offer for employment, odds are excellent that they’ll open the attachment without hesitation.

At that point, whatever payload the poisoned file contained is installed onto their computer, which can have devastating consequences, depending on the nature of the malware the criminals want to install.

Shear also notes that he and his team have seen an increase in the number of inquiries on the Dark Web asking after compromised business accounts, and offers this explanation as to why: “Attackers want access to business accounts in order to leverage their phony job listings and recruit people who would ultimately participate in fraud without their knowledge.”

All that to say, job seekers beware. It seems that no low is too low where these criminals are concerned.

TicketFly Customer Information May Have Been Hacked

June 20, 2018 by Joseph Martin

Another week, another high-profile data breach, but this one can be filed under “Missed Opportunity.” The site in question is “TicketFly,” which is a web-based event ticket sales website owned by a company called Eventbrite. The TicketFly website was down since May 31st, and the normal homepage had been replaced by an image of Guy Fawkes with the message “Your Security Down I’m Not Sorry.”

The page formerly contained links that pointed to compromised customer information, but those have subsequently been removed by the company, which is still scrambling to recover.

Unfortunately, TicketFly was given every opportunity to avoid the incident altogether. The hacker responsible for taking the site down goes by the handle “IsHakdz,” and claims that he contacted TicketFly, warning them of serious security flaws that would allow a hacker to take control of the site and all of the company’s databases. He asked for 1 Bitcoin to reveal the technical details. When the company failed to respond, he decided to show them he was serious, and did exactly as he claimed he could do.

While you might question the hacker’s actions, his motives seemed pure enough, and the reality is that many companies have “Bug Bounty” programs where they pay researchers who find critical security flaws. The bounty payouts are typically less than a bitcoin, but the idea is the same. Unfortunately, TicketFly didn’t have such a program and even after having been warned of the flaws in their system, they took no meaningful action until the hacker forced them to do so.

While it’s not impossible to envision a scenario in which this hacker would resell the data he was able to get his hands on, the actions of this particular individual seem to point in the opposite direction. Even so, if you’ve made a purchase on the TicketFly database, it’s better to be safe than sorry, and carefully monitor the payment card you used to make the purchase. It goes without saying that you should change your TicketFly password immediately.

Study Shows Employee Satisfaction Is Higher With Technology Improvements

June 18, 2018 by Joseph Martin

A new study recently published by HPE Aruba called “The Right Technologies Unlock The Potential Of The Digital Workplace,” reveals some interesting details about technology in the workplace that’s worth paying attention to.

The study was conducted by collecting feedback from more than seven thousand companies of various sizes around the globe. These were broken broadly into two groups: “Digital Revolutionaries,” which made more and better use of cutting edge technology, and “Digital Laggards” which were slower to adopt the latest and greatest technologies.

The headline statistic is that 51 percent of employees working in companies employing more technology reported greater job satisfaction, and an impressive 72 percent of employees in these companies reported a greater ability to adopt new work-related skills.

Other intriguing statistics include:

31 percent of respondents in the “Digital Laggard” category indicated that tech aided their professional development, compared with 65 percent in the “Digital Revolutionary” category

92 percent of respondents said that more technology would improve the workplace overall

69 percent of respondents indicated a desire to see fully automated equipment in more widespread use in the workplace

Joseph White, the Director of Workplace Strategy, Design and Management at Herman Miller said in a press release:

“No matter the industry, we’re seeing a move toward human-centric places as enterprises strive to meet rapidly changing expectations of how people want to work. This depends upon combining advances in technology -which includes furnishings- with the cognitive sciences to help people engage with work in new ways. This will not only mean singular, premium experiences for individuals, but also the opportunity for organizations to attract and retain the best talent.”

The study notes, however, that cyber security issues remain as challenging as ever. Survey respondents reported lower than average cyber security awareness, which could lead to greater risks and exposure as workplaces become increasingly digitized.

While a small majority (52 percent) of respondents reported thinking about cybersecurity often (daily), fully a quarter have connected to unsecured WiFi and one in five reported using the same passwords across multiple web properties. These are the two most dangerous cybersecurity-related behaviors.

Clearly, increased technology has its risks.

Microsoft Purchases GitHub – What Does This Mean For Open Source?

June 16, 2018 by Joseph Martin

Microsoft just made a big, significant purchase that has raised more than a few eyebrows. They just acquired GitHub for a hefty $7.5 billion.

What makes the purchase interesting and potentially troublesome is that Microsoft is the world’s largest proprietary software company, and GitHub is the world’s largest open source hosting service.

The natural question on everyone’s mind then, is what does this mean for open source? Is it doomed? Is it soon to go the way of the dinosaur, or will Microsoft hold the reins of power loosely and let open source continue to flourish?

Those are fair questions, especially given that GitHub is used by more than 28 million developers around the world, and is home to more than 85 million code repositories. In addition to that, the company was built on Git, which is an open source version control software written by Linus Torvalds (the creator of Linux). Its founders have worked hard to develop innovative workflows that have made the hub easy to use and work with.

The fear is that Microsoft will start strangling those developments and insist that GitHub begin using proprietary Microsoft products. While it’s too early to say for certain, the early indications are encouraging. Microsoft has stated that GitHub will be allowed to retain its status as an “open platform” and its service will continue to be offered for free.

Having said that, there will be some changes, including the fact that Microsoft will be offering integration between its AppCenter mobile testing service and projects hosted on GitHub. This builds on previous collaborations between Microsoft and GitHub. Last year, GitHub announced that they would support Microsoft’s “Git Virtual File System,” which the company designed for enterprise-sized data repositories.

The skeptics are right to be skeptical, but so far, the early indications are positive. Note that it’s not a done deal just yet. The merger is subject to regulatory approval in both the US and the EU.

Microsoft Is Issuing Surface Book 4 Replacements

June 14, 2018 by Joseph Martin

Do you own a Surface Book 4? If you do, you may have been unfortunate enough to get one that suffers from a peculiar screen flickering issue. It’s not known exactly how many Surface Book 4’s have been affected by the issue, but thousands of angry users have been comparing horror stories about it on various discussion forums around the web.

For their part, Microsoft has been very slow to even acknowledge the existence of the issue, even though there are some user videos showing the screen flicker in real time. In addition, there are videos of various crude hacks and workarounds owners have been using to get the screen to behave normally. These have included popping their computers in the freezer or running a hair dryer over them. Even when these “fixes” worked, they only worked for short periods of time.

Finally, the company has officially acknowledged the problem, and have now begun offering to replace the units for anyone dealing with “Flickergate.” Sadly, it’s too little, too late for some frustrated users, who have shelled out an average of $450 to replace the problematic screens on their own.

If you have a Surface Book 4, are dealing with the aggravating screen flicker issue and haven’t replaced it on your own yet, stop by Microsoft’s website and follow the prompts to see if you qualify for a replacement.

Over the past couple of years, Microsoft has done a good job at demonstrating nimbleness and responsiveness to customer complaints, which makes their handling of Flickergate more than a little disappointing. Our hope is that in the months ahead, whatever shape or form the next issue the company faces might be, they’ll return to recent form and be much more responsive than they were this time around.

Embedded Sound Waves Could Damage Your Computer

June 14, 2018 by Joseph Martin

It seems like a new attack vector emerges on a weekly basis, and this week is no exception. The latest threat: Emails containing specialized audio files whose acoustic vibrations can damage your computer’s hard drive. This is possibly damaging to the point of causing system failure, data corruption, and making it impossible to successfully reboot your machine.

As the researchers point out, “Intentional acoustic interference causes unusual errors in the mechanics of magnetic hard disk drives in desktop and laptop computers, leading to damage to integrity and availability in both hardware and software such as file system corruption and operating system reboots. An adversary without any special-purpose equipment can co-opt built-in speakers or nearby emitters to cause persistent errors.”

It should be noted that as scary as this type of attack sounds, in practice, it is of limited value. An increasing percentage of laptops and desktop PCs sold today come with SSDs for storage, which are not vulnerable to this type of attack.

In addition to that, not just “any” sound will do. For the attack to be successful, the acoustic vibrations have to be strong enough to do real harm, and quiet enough that the attack is difficult to detect, lest it be aborted immediately. The combination of those two factors make it unlikely that this one will gain widespread attention from the hacking community. Nonetheless, it pays to be both mindful and vigilant, especially if you have an older PC or work in an office with older equipment.

The research team who discovered the new attack vector have created a new sensor fusion model that could be delivered through a firmware update. Once updated, it would prevent unnecessary head parking in the hard drive, thus limiting the potential damage the attack could cause. So far, there has been no word that PC manufacturers are considering making the necessary changes to their firmware. Time will tell.

Apple Users Are Getting Group Facetime

June 14, 2018 by Joseph Martin

Apple’s Legions of users love FaceTime, but there’s a problem with the highly popular app. It only allows you to see and talk to one person at a time. Apple fans have been clamoring for Group FaceTime for almost as long as the app has existed, and soon, they’ll get their wish.

Beginning with iOS 12, Group FaceTime will finally be “a thing,” allowing you to simultaneously talk with up to 31 of your contacts. Even better, the new functionality will allow you to turn any iMessage group chat into a group FaceTime session, and switch back to iMessage at will.

Don’t want to be on camera in a group setting? Apple has an answer for that too. The company has announced that when Group FaceTime is rolled out, you’ll be able to place an Animoji over your face, or apply one of several different photo filters to disguise you. This is because they know that some days, you just might not feel “camera ready.”

At the end of the day, Group FaceTime is probably going to be a lot like tabbed browsing was for many users. Until you try it, and until it’s readily available, you won’t truly appreciate its value. Once you try it for the first time, it won’t be long before you’re unable to imagine life without it. It’s a cool, indispensable addition whose time has come.

Kudos to Apple’s loyal fan base for keeping Group FaceTime on the radar, and kudos to Apple itself for finally listening to their customers and giving them what they want. While we could quibble that they took longer than we’d like to make this feature a reality, in the end, they listened. That is the essence of business, isn’t it? Giving your customers what they want.

T-Mobile Site Leaked Data On Millions Of Customers

June 13, 2018 by Joseph Martin

ZDNet Researcher Ryan Stevenson recently found a big problem on T-Mobile’s website regarding an unprotected API. As a result of the flaw, untold millions of T-Mobile’s customers’ account information was left exposed and completely unprotected. Literally anyone who stumbled across the site and tried to abuse it could access a wide range of customer information with no password required.

This includes, but is not limited to:

Customer name

Phone number

Mailing Address

Account Number

The status of the account (current, past due, suspended, etc.)

In an unknown number of cases, tax IDs and PINs were also exposed.

T-Mobile has a bug bounty program and pays a bounty to anyone who discovers a flaw that impacts the company. Stevenson received a $1,000 reward for discovering the issue, and subsequent research revealed that the flaw had been present on the company’s website since October, 2017 or prior.

T-Mobile’s handling of the incident has been less than stellar so far. Although they have acknowledged the existence of the issue and have already moved to correct it, the company has issued no information relating to how many customer records were exposed.

There is no evidence that any of the exposed records were inappropriately accessed. Typically, when an incident like this occurs, the company in question provides details relating to the scope and scale of the incident, informs all potentially impacted customers and usually provides a year of free credit and identity monitoring. So far, none of that has occurred.

While it’s certainly possible that the company may take these steps in the future, we were both surprised and disappointed that they had not already done so, especially given the fact that this was essentially a self-inflicted wound. Here’s hoping that in the days ahead, they do something to earn back the lost trust.

FBI Advises Users To Reboot Their Routers

June 13, 2018 by Joseph Martin

Cisco’s Talos Security Team has identified a new threat, and it’s a nasty one impacting more than half a million consumer-grade routers in the US. According to the Talos Team’s report, the new malware is impacting a broad cross-section of routers made by TP-Link, QNAP, Netgear, Mikrotik, and Linksys.

Known as “VPNFilter,” the malware currently infecting routers appears to be the first stage in a multi-phase attack, with the first segment allowing the hackers to collect a wide range of communications data and slave the device to launch attacks on others. The code also contains a kill command that allows the hackers to destroy the device at will.

As of now, the FBI has already taken swift action and has seized a domain used by the hackers as a means to deliver the later stages of the attack. They report that the primary and secondary means of further infection have been dismantled. They also report, however, that the hackers still have a fallback method of infection, which relies on sending “poisoned” data packets to each infected device.

Based on an evaluation of the code and the presence of redundant mechanisms for delivering the later stages of the infection, the code has been traced to a Russian hacking group with deep ties to the Russian government. The group is known by a variety of names, including Fancy Bear, Sofacy, APT 28, and Pawn Storm.

On the heels of seizing the domain, the FBI released a statement that includes:

“The FBI recommends any owner of small office and home office routers reboot the devices to temporarily disrupt the malware and aid the potential identification of infected devices. Owners are advised to consider disabling remote management settings on devices and secure with strong passwords and encryption when enabled. Network devices should be upgraded to the latest available versions of firmware.”

Microsoft Ending Forum Support For Older Operating Systems

Attackers Targeting Job Seekers Via Listings And Recruitment

TicketFly Customer Information May Have Been Hacked

Study Shows Employee Satisfaction Is Higher With Technology Improvements

Microsoft Purchases GitHub – What Does This Mean For Open Source?

Microsoft Is Issuing Surface Book 4 Replacements

Embedded Sound Waves Could Damage Your Computer

Apple Users Are Getting Group Facetime

T-Mobile Site Leaked Data On Millions Of Customers

FBI Advises Users To Reboot Their Routers

Contact Info

Navigation