(252) 565-1235

Carolina IT Group

Call Us (252) 565-1235 Request Support Contact Us

Girl Scouts Can Now Earn New Badges For High Technical Skills

by

The girl scouts have officially moved into the 21st century.

The Girl Scouts of America recently announced the creation of a whole raft of new badges that address (in the organization’s words) “some of society’s most pressing needs.”

A total of 30 new badges will be available exclusively for girls between the ages of five to eighteen for efforts and advocacy in the following areas:

Computer Science

Cybersecurity

Environment

Robotics

Space Exploration

Badges are awarded on the basis of completing specific tasks. So, for instance, when a girl learns how to code and completes a small project, she could be awarded with the new computer science badge, and when she builds a simple robot, the robotics badge would be awarded.

This is part of an ongoing effort to boost interest and participation in fields where women are generally under-represented.

According to the Girl Scouts USA CEO, Sylvia Acevedo:

“Whether they are fighting cybercrime, exploring how engineers solve problems, or advocating for issues affecting their community, Girl Scouts are learning how to proactively address some of the foremost challenges of today, while also building skills that will set them up for a lifetime of leadership.”

In recent years, the Girl Scouts have struggled to maintain enough membership nationally to remain viable. This is at least one of the reasons why the Boy Scouts of America announced in October 2017 that they would begin accepting girls into their program.

It remains to be seen whether the move to modernize the badges available to girls in the organization will be enough to boost membership and ensure the organization’s long-term viability. Even if it’s not, it’s a fantastic idea and long overdue. Kudos to Girl Scouts’ leadership for taking innovative action, and to all the girls who earn these new badges!

LTE Networks May Be Vulnerable To Hacking

by

Researchers from Ruhr-Universität Bochum and New York University in Abu Dhabi have discovered serious security flaws in 4G LTE networks that allow hackers to spy on, listen in on, intercept, and disrupt phone calls and text messages.

Given that billions of people rely on 4G LTE networks for cellphone communications, it’s a serious issue, and there are no easy fixes. So, don’t expect these flaws to be patched out of existence any time soon.  Worse still, the planned 5G networks currently in development may well suffer from the same (or similar) flaws.

Based on their research, the team was able to develop a trio of new attacks that specifically target weaknesses in the 4G LTE architecture.

One of these, dubbed “aLTEr” is a DNS spoofing attack that allows a hacker to become the “man in the middle,” intercepting communications, and gives them the ability to spoof alerts, texts, and other messages.

All three of the attacks developed by the team take advantage of weaknesses found in “Layer Two” of the LTE network.

This is the data layer that rests atop the physical channel.  Its function is to maintain wireless communication between users and the network itself, and has an organizational function that (among other things) manages how users access various resources on the network, helping to protect data via encryption and to correct errors in transmission.  Obviously, a hack that can exploit this layer could be devastating indeed.

If there’s a silver lining, it lies in the fact that these three attacks are exotic. It would be difficult for a casual or even a fairly determined hacker to execute to any real effect.  Unfortunately, it would be a much easier task for a state-sponsored group to pull off, and that’s the big fear here.

Hopefully, since 5G networks are still in the planning stages, something can be done before they’re rolled out to limit the effectiveness, or perhaps even negate these new types of attacks, but that remains to be seen.

Microsoft Edge Mobile Browser Blocks Android And iOS Ads

by

As most people know, Microsoft Edge was the company’s “reboot.”  After trying for years to patch and update their beleaguered Internet Explorer, Microsoft ultimately decided to scrap it and start fresh.  Since Edge’s launch, it has struggled to gain traction with users.

Recently, Microsoft has upped the ante, at least where Edge for iOS and Android devices are concerned.  A recent update sees the browser outfitted with a built-in ad blocker.  Prior to the update, if you wanted an ad blocking solution, you’d have to download and install it separately.  This move saves users a step, and gives you one less thing to think or worry about.

It’s a good move, but that alone is unlikely to give Edge the surge in popularity it needs to catch up with other browsers.

To provide some perspective, currently, Microsoft Edge is installed on about five million Android devices, based on stats from the Google Play Store.  Contrast that with 100 million installs of Mozilla’s Firefox, and more than a billion Chrome installations.

Those are sobering numbers that underscore just how much ground Edge needs to cover to even be playing in the same league as other popular web browsers on mobile devices.  While we don’t have statistics for installs from the Apple Store, it’s hard to imagine that they’d be any better, and, are probably a fair bit lower.

That’s not to say that Microsoft’s move wasn’t good, because it definitely was.  Anything that a company can do to cut down the number of unwanted, annoying, and potentially dangerous ads is a very good thing. Odds are that the company’s recently move will be copied by the major players in the browser world.  Even if it doesn’t boost Edge’s numbers much, that’s a win for anybody who uses the internet.  Kudos to Microsoft for making the change.

New SSD Drive Can Hold 8TB of Storage

by

Good news for the business world in general, and the owners of data centers, in particular.

Mass storage is about to get vastly more efficient thanks to Samsung’s recently launched solid state drive, which manages to pack an impressive 8TB of storage into a delightfully small footprint, measuring just 11cm x 3.05cm.

Not only do the new drives deliver twice the storage capacity of the SSDs used in high-end servers and slim line laptops, but it also has an impressive read speed of 3100 MB/s, and write speeds of 2000 MB/s.  The read speed of the new drive is five times faster than the speeds you typically get from SATA SSDs, and the write speeds are three times faster.

When hyper-scaled, that means that enterprise server system could perform more than a million IOPS in a 2U rack space, and that translates into a significant ROI for large-scale data centers.

It gets even better.  Samsung is planning to release a 512 gigabit version of its 3-bit V-NAND SSD later this year, which will allow significant improvements in processing speeds for big data applications.

What we’re talking about here, ultimately, is storage and processing density.  The new SSD is built with 16 512GB NAND package, stacked in sixteen layers of 256 gigabit 3-bit V-NAND chips that were specifically engineered with massive SSDs in mind.

This allows data centers to triple total system density in the same footprint, and allows for a mind-boggling 576 terabytes of storage in 2U rack servers.

This is paradigm shifting and will make cloud-based service providers even more attractive. The most successful of these already have hyper-scale data centers in place, already have a wealth of experience when it comes to handling Very Large Data sets and experience dealing with applications designed to sift through those mountains of data.  Enterprise users, rejoice!

Vulnerability In Mac OS Went Unnoticed For Years

by

Researchers at Okta Security have stumbled across something big.  Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.

While at first glance that doesn’t sound so bad, the implications are terrifying.  In a nutshell, code signing uses cryptographic “signatures” to verify and validate code.  If code bears the digital signature, it is considered trusted.  If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.

Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.

An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.

Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.

Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.

Josh Pitts, an Okta engineer, sums the issue up:

“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products.  To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”

A completely fair assessment.  Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed.  We won’t always be so lucky.

Another Vulnerability Found In Intel CPU’s

by

More bad news for Intel. Yet another security flaw has been identified in the processors the company makes.  This one is so newly discovered that the full technical details have yet to be released.  Here’s what we know so far, from a recent Intel announcement:

“System software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch…Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other process through a speculative execution side channel that infers their value.”

In simpler terms, what this means is that a hacker could use this exploit to gain partial cryptographic keys used by other programs running on the target computer.

While related to the recent Spectre and Meltdown security flaws, this one is different in two ways.  First, it’s not quite as severe as the formerly discovered flaws in scope or scale.  To make use of this, one would require an incredibly exotic attack that would simply be beyond the capabilities of most hackers.

Also, it should be noted that where Spectre and Meltdown impacted dozens of chipsets dating back more than a decade, the “Lazy FP State Restore” flaw only impacts chips beginning at Sandy Bridge.

The other key difference is that the flaw in this case, does not reside in the hardware.  That’s good news for businesses of all shapes and sizes, because it means that when Intel and their hardware vendors have a patch ready, it will be quick and relatively painless to install it.

Unfortunately, since the initial discovery of Spectre and Meltdown, a number of variants of those flaws have emerged, and now this new one.  It’s unlikely that this will be the last we’ve seen of these types of issues, so if you’re using Intel equipment, brace yourself.  There’s likely more to come.

Yahoo Messenger Will Shut Down In July

by

It’s the end of the line for Yahoo Messenger.  As of July, it will be no more, marking the end of an era.

The announcement comes just six months after AIM (the old AOL messaging program) was shut down.  The first major messaging programs from the early days of the internet will soon be a thing of the past.

Users will have six months to download their chat histories from Yahoo Messenger. If they  haven’t gotten what they need by then, they’ll lose their chance forever.

It probably won’t come as a major blow to most people.  Although it used to be one of the most popular and widely used communications programs, its popularity has slipped markedly in recent years, to the point that there’s little justification in continuing support for it.

The company had this to say on the matter:

“We know we have many loyal fans who have used Yahoo Messenger since its beginning as one of the first chat apps of its kind.  As the communications landscape continues to change over, we’re focusing on building and introducing new, exciting communications tools that better fit consumer needs.”

Currently, the company has no direct replacement for Messenger.  The closest match would be a group messaging app called “Yahoo Squirrel,” which is currently in beta.  Users interested in the new tool can request an invitation at squirrel.yahoo.com.

For the rest of us, Yahoo Messenger’s loss isn’t likely to cause problems from a business perspective. This, along with Microsoft’s retirement of the venerable MS Paint, serves as a reminder that the internet is growing up.  Many of the tools we’ve used and taken for granted for years are now fading away.  It’s a brave new world.

Contact Info

740 Greenville Blvd. SE., Ste. 400-374
Greenville, NC 27858

Phone: (252) 565-1235