Blog – Page 34

Google Changing Name Of Android Wear Without Updates

April 3, 2018 by Joseph Martin

Wearable computing devices from smart watches to glasses are struggling to find an audience, and Google’s Android Wear operating system hasn’t gotten much love in recent years. It has weakened as major players in the tech space have struggled to find a market for these products. On the face of it, these products would seem to be wildly popular, but still haven’t quite captured the imaginations of a critical mass of the consuming public.

Google’s recent announcement that it was rebranding Android Wear to “Wear OS,” is the most significant move we’ve seen in over a year. However, without significant updates, simply changing the name isn’t going to improve the OS’s visibility or viability.

The name change was driven by the fact that when the OS was first released, it appeared only on smart watches, but the company later added iPhone compatibility, which made the name less than perfectly applicable. In a blog post related to the rebranding effort, Google referred to Wear OS as “a wearables operating system for everyone.”

It’s hard to make a convincing argument that Google is all that interested in wearables. One needs only to compare the company’s handling of Wear OS with the way Apple handles wearable products and OS’s.

We had to wait two and a half years between the version 1.0 and version 2.0 of Wear OS. Android Wear was released more than 13 years ago, and since its release, the company hasn’t made any updates or announcements except for the recent blog post announcing its rebranding.

There are some signs that Google has long term plans for the floundering operating system, though. The company has been recruiting high-profile brands including Tommy Hilfiger, Michael Kors, Hugo Boss, Guess, Gc, Fossil and others to make and sell Android watches. It will be interesting to see what the company does in coming months.

Intel Taking Additional Steps To Prevent Security Flaws

April 2, 2018 by Joseph Martin

By now, you’ve almost certainly heard of “Spectre,” one of two recently discovered security flaws that impact every chip made by Intel in the last ten years.

The story of Spectre, and Intel’s response to it has been an interesting one. In response to the flaw’s discovery, Intel rushed a firmware patch, but quickly had to take it back and recommend that users not install it, because it created as many problems as it solved.

Intel has since released a better, more stable patch, but hasn’t stopped there. The company recently revealed that it is introducing various hardware protections against Spectre-like vulnerabilities that may be detected in the future.

According to Intel’s CEO, Brian Krzanich, “(We have) redesigned parts of the processor to introduce new levels of protection through partitioning. As we bring these new products to market, ensuring that they deliver the performance improvements people expect from us is critical. Our goal is to offer not only the best performance, but also the best secure performance.”

While that is welcome news for people planning to make purchases in the near future, owners of existing Intel-powered equipment will still have to have to rely on firmware updates for Spectre protection. This unfortunately comes with the tradeoff of a hit to CPU performance.

In tandem with that update, the company also announced that as of now, they have firmware updates available for all of its products launched within the last five years. This coupled with their recent partnership with Microsoft to help deliver Spectre updates to their legions of impacted customers should provide peace of mind, even with the expected hits to system performance.

Unfortunately, with new variants of Spectre and Meltdown being discovered on a regular basis, this is likely not the last we’ll hear about this issue.

Massive Malware Attack Stemmed From Bittorent App

April 2, 2018 by Joseph Martin

According to a Microsoft security researcher, a massive malware attack attempted to install a cryptocurrency mining software on more than 400,000 computers in less than twelve hours. The failed campaign is noteworthy because of the attack vector used. It was a supply chain attack implemented by compromising Bittorrent, a highly popular program used to share and download files.

Until recently, security professionals discounted the very possibility of supply chain attacks, regarding them as highly improbable occurrences. The sad truth, however, is that they’re becoming increasingly common. Over the past couple of years, we’ve seen a growing number of them, including CCleaner, which is a popular disk-maintenance program. A poisoned version of it was delivered to more than two million of the software’s users.

In another supply chain attack, M.E. Doc (a tax and accounting application which is widely used in the Ukraine) was tainted and contained the NotPetya wiper worm, and shut down computers all over the world just last year.

Then there was a collection of Android apps that came preinstalled on phones from not one, but two different manufacturers that allowed hackers unfettered access to the data on those phones. In fact, this is actually the second time Bittorrent has been hijajcked. Last year, a tainted version of the client installed ransomware on Macintosh computers around the world.

Fortunately, this latest attack was not successful, although Microsoft researcher reported that Windows Defender blocked more than 400,000 attempts to infect computers between March 1st and March 6th , with the actual Bittorrent infection occurring sometime between February 12 and February 19. In this instance, the threat was regional, with most of the computers being located in Russia, Turkey, and the Ukraine.

While this was the latest supply chain attack, it certainly won’t be the last. Worst of all, these kinds of attacks are notoriously hard to prevent because updates coming from trusted sources are often installed without question.

Does Your Business Have A Cybersecurity Incident Response Plan?

March 30, 2018 by Joseph Martin

If your company has an incident response plan that you can rely on in the face of a cyber attack, then you’re ahead of most of the world, according to research recently conducted by the Ponemon Institute. Shockingly, more than 75 percent of survey respondents from around the world admitted that they have no formal incident response plan. Even worse, half of the companies that indicated they had an incident response plan said that it was informal.

Curiously, given these statistics, 72 percent of organizations indicated that they were more resilient today than they were the year before. They also indicated a high level of confidence in their staff to respond appropriately to any problem that arose.

Given the stark reality and the ever-increasing number of attacks, that comes off more like bravado than genuine confidence. Ted Julian, the Vice President of product management of IBM Resilient (sponsor of the Ponemon Institute’s research) had this to say:

“Having the right staff in place is critical, but arming them with the most modern tools to augment their work is equally important. A response plan that orchestrates human intelligence with machine intelligence is the only way security teams are going to get ahead of the threat and improve overall cyber-resilience.”

This year, most of the provisions of a new piece of legislation, GDPR (General Data Protection Regulations) come into effect, and companies that don’t have a formal incident response plan by then could pay a hefty price. Even if that weren’t the case, the research concluded that the overall cost of a data breach was nearly a million dollars lower on average when companies were able to deal with the breach decisively and contain it within thirty days.

The bottom line is, if you don’t have one yet, now is the time.

You Can Now Search Google From iMessage With App Download

March 29, 2018 by Joseph Martin

There’s a fun, new update for Apple’s iMessage app that will probably make lots of power users happy. As long as you also have Google’s iOS app installed, you’ll be able to perform Google searches from within iMessage itself.

In order to make it work, you’ll have to go into the app drawer (App Store icon) and enable the iMessage extension. Once enabled, all you have to do to use Google search is to tap on the Google shortcut icon to get the search box. Even better, the update includes shortcuts for watching trending YouTube videos, scoping out nearby restaurants, checking out local weather conditions, and even a handy GIF search. There’s also a quick news search option.

If you search for restaurant recommendations, the new app makes the results easy to share in the conversation you’re having. Although curiously, this feature doesn’t carry over to YouTube videos or news. Even so, it can be situationally useful.

In a similar vein, Google’s keyboard app, “GBoard” also now has search built into it. In fact, you don’t even have to have GBoard installed. As long as you’ve got the core Google App, the search extension will appear in iMessage’s app drawer.

These are small changes, but if you spend a lot of time texting, you’ll find them invaluable. Think back to prior text conversations you’ve had. There have probably been a number of occasions when you found yourself wishing you could do a quick search on whatever topic you were talking about.

It’s great to see these kinds of changes as the cellphone market continues to grow. When the iPhone first burst onto the scene, apps were few and far between. Now, not only are there untold thousands of apps on the market, but they are becoming increasingly integrated. That’s very good to see.

New Freemium Offer Mines Cryptocurrency

March 28, 2018 by Joseph Martin

Freemium software is certainly nothing new. They are free apps that offer premium features if you don’t mind ads displaying while you’re using it or paying a small fee to have the ads removed. At least one company is trying a new business model on for size, albeit with limited success.

The company is Qbix, and their freemium app is called “Calendar 2.” It’s a solid calendar app with more features than Apple’s default app, and the Qbix offers its users premium features if they’re willing to allow the company to make use of CPU cycles to mine cryptocurrency.

Hackers around the world have been enslaving the computers of unsuspecting users and using their processing power to mine cryptocurrency, all while making millions in the process. However, this is the first instance we’ve seen of a company attempting to bring the business model mainstream.

Unfortunately, there were two issues with the release of the latest version. First, there was a bug in the way the mining app was implemented that kept it running, even if users opted out of the default setting (which is, of course, to accept the arrangement).

Second, and even more disturbing, the mining software consumed twice as much processing power as the calendar app claimed that it would. Both flaws were discovered by Calendar 2 users, who did not have nice things to say about the app and expressed their concern that Apple had allowed the app on the App Store in the first place.

For Apple’s part, the company seems to have no problem with the revenue scheme, provided that the offering company gets the consent of the user. Although given Calendar 2’s less-than-spectacular-success with the idea, the company may well change their Terms of Service to forbid it going forward.

New Chips Support Increased Network Speeds To 400Gbps

March 27, 2018 by Joseph Martin

Marvell Semiconductor has a new product out, and it’s a game changer. Their new “Alaska” chip (the Alaska C 88×7120) is the first on the market to support the new 802.3 standard. The 802.3cd is on tap to eventually replace current Ethernet ports running at 25Gbps to 100Gbps with ports that will run at 50Gbps, 200 Gbps, and 400 Gbps.

The future is now.

Granted, the Alaska chips aren’t for sale just yet, but they are sampling to customers (“Sampling” in the chip world is akin to beta testing in software). The chip supports sixteen 50 Gbps ports, four 200 Gbps ports, and two 400 Gbps ports, which will quadruple network output. Even better, the new chips support both copper and fiber-optic wiring, as well as SerDes (long-reach serialization/deserialization) on system and line side interfaces, allowing OEMs to use the chips for wide-area interfaces.

Also of interest, the new chips use PAM4 (pulse-amplitude modulation), which is a four-level signaling scheme that’s designed to replace NRZ (non-return to zero) binary modulation, and even better, the new PAM4 protocol will be backwards compatible with NRZ hardware.

The port density on the new chip has been optimized to enable both Quad Small Form Factor Pluggable – Double Density and Octal Small Form Factor Pluggable port types for 500 GbE, 200 GbE, and 400 GbE deployments.

If all of those technical details make your head spin, not to worry. The short of it is that once these chips go mainstream, network output is going to increase dramatically, which means that network speeds are about to get even faster.

Unless you run or manage a huge data center, you’ll probably never have direct contact with these chips. However, as big data centers begin deploying them, you’ll absolutely see the benefits.

Attacks on Health Organizations Increasing At Alarming Rate

March 26, 2018 by Joseph Martin

It used to be the case that credit card companies and retail outlets were the primary targets of hackers around the world. Make no mistake, they still get attacked with regularity, but the hackers have found a new and even more lucrative target: Health Organizations.

According to a new report jointly produced by the Ponemon Institute and Merlin International, the medical/healthcare industry suffered nearly a quarter (23 percent) of all the data breaches that occurred in 2017. It gets worse. Those breaches exposed PHI and PII of more than five million individuals.

The reason for the shift away from credit card data to medical records comes down to profits. PHI and PII can often be sold on the Dark Web for ten times the amount that credit card information will bring. The hackers are simply obeying the laws of economics and going where the money is.

Brian Wells, the Director of Healthcare Strategy at Merlin International had this to say about the report:

“In an increasingly connected, digitally centric world, hackers have more opportunities and incentive than ever to target healthcare data, and the problem will only increase in scope over time.

Healthcare organizations must get even more serious about cyber security to protect themselves and their patients from losing access or control of the proprietary and personal information and systems the industry depends on to provide essential care.”

Worst of all, a shocking percentage of medical/healthcare companies don’t seem to be serious about cyber security at all. Although the average cost of a medical data breach is approximately four million dollars, a staggering 49 percent of companies in the industry don’t have an incident response plan of any kind. There’s no process in place to properly respond to an attack, or to mitigate the fallout if a breach occurs. These companies are sitting ducks.

Used with permission from Article Aggregator

Beware Fake Craigslist Email Could Contain Ransomware

March 24, 2018 by Joseph Martin

If you post ads on Craigslist for short term employment, be aware that there’s a new malspam campaign that aims to distribute Sigma ransomware on the computers of unwary users.

By all outward appearances, the emails seem to come from Craigslist in response to ads posted in Craigslist’s “Gigs” section for short term employment. The emails will generally express interest in whatever job the user has posted and include a protected Word or RTF document which recipients will assume are resumes.

If the recipient enters the password to unlock the document, they’ll then be presented with a screen that asks them to enable the content in the document. Unfortunately, this is the step that dooms the user. The file isn’t a resume at all, but merely a delivery vehicle.

As soon as the content is enabled, the ransomware will be installed, the user’s files will be encrypted, and then will “helpfully” post a message explaining that the files have been encrypted, and explaining that to get access to them again, they’ll have to pay a $400 fee, which rises to $800 if the user waits longer than seven days to request the decryption key.

Unfortunately, there’s no known way to decrypt Sigma-encrypted files other than paying the ransom.

This is a new twist on a very old game. Even worse, it’s enjoying a relatively high success rate because people who post ads for short term employment on Craigslist expect to get responses from people they don’t know. They expect that those people will be sending resumes for review.

The “tell” is that when a potential employee sends you a resume, it’s almost certainly not going to be password protected. In this case, your best bet would be to reply to the sending and ask them to send you a non-protected resume if they’re genuinely interested in the job.

Biometric Authentication Seeing Wide Adoption In Businesses

March 23, 2018 by Joseph Martin

According to a new report published by Spiceworks, nearly 90 percent of businesses will use some type of biometric technology for authentication by the year 2020. In fact, some 62 percent of companies already use biometrics in some form, with another 24 percent stating their intention to do so within the next two years.

The particulars break down like this:

57 percent of companies using biometric authentication use fingerprint scanners

14 percent use facial recognition

Five percent make use of hand geometry recognition

Three percent use iris scanners

Two percent use voice recognition

Two percent use palm-vein recognition

There are only a handful of companies that provide biometric solutions. Of those, Apple dominates the space, providing 34 percent of fingerprint scanning solutions and 14 percent of facial recognition solutions.

The rest of the market breaks out as follows:

Lenovo Fingerprint Manager is used by 13 percent of companies that utilize biometrics

Samsung fingerprint readers are used by 13 percent

Microsoft’s Windows Hello (face login) is used by 13 percent

Android’s Face Unlock is used by seven percent

As widespread as biometric adoption has been, only 10 percent of CIOs felt that biometric solutions were secure enough to be the sole means of authentication. IT security professionals have reached largely the same conclusion, with just 23 percent of them thinking that biometrics could replace traditional text-based passwords within the next two years.

The two biggest hurdles they see are the relative lack of transparency provided by biometric solutions providers about flaws and vulnerabilities discovered in their systems, and the lack of transparency around the biometric data collected by vendors.

Peter Tsai, a senior technology analyst at Spiceworks had this to say about the report: “Many IT professionals aren’t convinced biometrics can serve as a secure and reliable replacement for the standard username and password combo. Unless technology vendors can address the security issues and privacy concerns associated with biometrics, the technology will likely be used side-by-side in the workplace with traditional passwords or as a secondary authentication factor for the foreseeable future.”