Branding – Page 5

Panera Bread Customer Accounts Exposed To Threats

April 25, 2018 by Joseph Martin

Panera Bread company is the latest to find itself in hot water. Recently, security researcher Dylan Houlihan discovered that the company had failed to encrypt (or otherwise protect) a file containing usernames, email addresses, physical addresses, phone numbers and loyalty account numbers for a staggering thirty-seven million of its customers.

The file was found stored as plain text, and accessible to anyone who bothered to go looking for it. The good news is that no one appears to have absconded with the data, so odds are that even if you’re a Panera customer, you’re not at risk. The bad news is that Panera’s handling of the incident to this point has been dreadful, to say the least.

First, the company was slow to even acknowledge that there was a problem, and when they did, they attempted to downplay the number of users the oversight impacted. Second (the truly disturbing part of the ongoing story), even when the company did acknowledge the scope and scale of the incident, they left the plain text file on the website. It was completely unsecured until the security professional (Houlihan) contacted them a second time.

To date, their most detailed response has been that the investigation into the matter is ongoing.

There’s a harsh lesson here for any business owner. This is a textbook example of how not to respond to an incident like this. There are so many different things Panera could have done to make this a non-issue. The first of which would have been to immediately take the file down or secure it. Next, to immediately notify all the customers on the list (just in case the file had been downloaded by hackers). Lastly, issue a detailed action plan that assured customers that the company was taking steps to make sure something like this would happen in the future. Sadly, exactly none of that has happened.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Microsoft Helping With Ransomware In Office 365

April 23, 2018 by Joseph Martin

Microsoft recently made small but significant changes to its Office 365 subscription service and to OneDrive, which are often used in tandem. The goal is to make it easier for users whose files have been encrypted by ransomware (or otherwise corrupted) to recover them.

The most significant of the changes is a new button that Office 365 users will see a new “File Restore” function in both applications. If you’ve saved your Office 365 files to OneDrive, you’ll be able to restore files in a thirty-day window. In the event that your files are accidentally deleted or corrupted, getting them back is as simple as pressing the button and selecting the files to be restored.

That’s a huge win for Office 365 and OneDrive users, but there’s more.

The additional changes include:

A mobile alert sent to the phone number you select, which will inform you if your files may have been encrypted or otherwise tampered with

Support for end-to-end email encryption in their mail service (Outlook), including the web version of the mail app

Office now scans all links embedded in PowerPoint, Excel and Word documents to check if they point to malicious content on the web

All file attachments and links embedded in emails are now scanned for known phishing threats and viruses

Outlook.com now gives users the ability to prevent email recipients from forwarding your emails

The ability to password protect OneDrive shared links

That last one is also significant, and is a feature that OneDrive’s user base has been clamoring on about for quite some time. OneDrive has made it incredibly easy to share files via a link-based system, but unfortunately, never offered users a way to secure those links. That, thankfully, has now changed.

Individually, all these changes are quite good, but taken together, they represent a significant step in the right direction. Kudos to Microsoft for taking the threat of ransomware so seriously, and adding specific features to help protect their users.

Joseph Martin

Hackers Zone In On Microsoft Products To Attack

April 17, 2018 by Joseph Martin

Congratulations to Adobe Flash Player for not being the software most targeted by hackers. Security vendor “Recorded Future” has just published their annual list of the software hackers most commonly focus on when targeting computers and handheld devices for attack.

For the last several years, Adobe’s Flash Player has topped the list, but this year they have been dethroned. Microsoft now has the embarrassing honor. There are multiple Microsoft programs on this year’s list, with some of them having exploits that date back more than a decade.

It’s a shameful honor to say the least, and even worse, in this year’s report, Microsoft captured seven of the top ten places.

The most often abused security flaw this year was CVE 2017-0199. Found in a variety of Microsoft Office products, the flaw allows a hacker to embed and execute VBS (Visual Basic Scripts) that contain Powershell commands into an Office document. Recorded Future has found exploit kits for sale on the Dark Web that automate the process going for between $400 and $800.

Hot on the heels of the #1 entry is CVE 2016-0189, which is one of a whole raft of Internet Explorer vulnerabilities that allow hackers to take unfettered control of a victim’s PC, laptop, or smartphone. It is one of the reasons Microsoft has moved away from IE in preference for Microsoft Edge.

Despite this dismaying news, Recorded Future notes that attacks via exploit kit are down significantly, with a staggering 62 percent drop in new variants.

The report’s author, Scott Donnelly, had this to say:

“The observed drop in exploit kit activity overlaps with the rapid decline of Flash Player usage. Users have shifted to more secure browsers and attackers have shifted as well. Spikes in cryptocurrency mining malware and more targeted victim attacks have filled the void.”

Despite the shifting landscape, the central lesson is clear. Hackers tend to take advantage of known exploits. Companies that keep their software properly patched dramatically reduce their chances of being targeted.

Joseph Martin

Most “Wannacry” Hacks Were On Windows 7 Machines

April 17, 2018 by Joseph Martin

Last year’s Wannacry attack was bad, but in many ways, it was a self-inflicted wound. According Webroot’s recently published “Annual Threat Report,” almost all of the machines that succumbed to the Wannacry attack were running Windows 7. That attack is estimated to have caused in excess of $4 billion in total losses.

The central problem is that businesses have been much slower than individuals to make the shift from Windows 7 to the much more secure Windows 10. For example, in January 2017, only one Enterprise computer in five was running Windows 10, a figure which climbed to 32 percent by year’s end.

Contrast that with the number of Enterprise computers running Windows 7. In January 2017, a staggering 62 percent of Enterprise computers were still running Windows 7. That figure declined as the year went on, but only marginally, dropping to 54 percent by the end of the year.

Meanwhile, Windows 8 was running on 5 percent of Enterprise computers in January 2017, and had dropped to 4 percent by the end of the year. Windows Vista and XP both represented a tiny fraction (less than 1 percent) of Enterprise OS’s.

Contrast that to the Windows 10 migration figures for individuals. In January 2017, 65 percent of home users had made to switch to Windows 10. By the end of the year, that figure had grown to an impressive 72 percent.

A Webroot spokesperson had this to say about the report:

“While Windows 10 won’t solve all security woes, it’s a step in the right direction. Combined with advanced endpoint protection that uses behavioral analysis and machine learning, adopting Windows 10 can greatly reduce enterprises’ vulnerability to cyber-attacks.”

All that to say, if you haven’t moved away from outdated operating systems at your company, this is yet another compelling reason to do so immediately. No matter what legacy systems you may be running that rely on old OS’s, it’s just not worth the risk.

Joseph Martin

Apple Releases Major iPhone and iOS Device Update 11.3

April 13, 2018 by Joseph Martin

There’s a lot to talk about in Apple’s latest update to iOS. Version 11.3 boasts some significant changes and is well worth getting. We’ll go over the highlights below.

Battery management is the biggest and most significant change. Last year, the company found itself in hot water when they began quietly throttling older phones and slowing down their performance because older phones have batteries that begin to degrade. In the absence of throttling, it’s entirely possible that a user’s phone will simply shut down when it attempts to run a process that requires more power than the aging battery can provide.

Despite the company’s good intentions, their decision to throttle older phones met with serious backlash from their normally adoring customer base, and the company has changed their approach in 11.3. Now, throttling is optional and under user control if you have an iPhone 6, 6S/6S Plus, 7, or 7 Plus SE. However, all users, regardless of model now have access to a new battery health screen so they can keep tabs on the condition of their battery and make good decisions about if and when to replace.

Another significant change is the addition of a new Health Records section, which allows users to get easy access to their medical records if their doctor also utilizes the app.

On the business side, the 11.3 update comes with Business Chat, which allows select businesses to communicate with customers directly in the iMessage app, rather than via social media or email. While there aren’t a lot of companies taking advantage of this feature yet, you can bet that in coming weeks, you’ll see a slew of big names signing up to take advantage of the service.

There is a raft of other, smaller features in 11.3, but even if there weren’t, the “Big Three” mentioned here would make the update well worth getting. Kudos to Apple!

Joseph Martin

Amazon Removing Music Storage Service At End Of April

April 11, 2018 by Joseph Martin

If you use Amazon’s Cloud MP3 Locker to store your music online, now is the time to start looking for a new home for it. Last year, the company announced that they were ending the service, but didn’t provide a firm date. April 30, 2018 will be the last day you’ll be able to access your music if you don’t take action.

Back in December, the company stopped allowing users to upload new tracks to their music storage system, which users were formerly allowed to store up to 250 songs for free.

In the company’s most recent announcement about the coming changes, they made two important clarifications. First, there is a back-end way you can keep access to your existing music files, but it requires action on your part. You’ll need to log in, go to your Music Settings and click the “Keep My Songs” button. Failing to take this step will result in your music being deleted.

Second, the company stresses that these changes do not apply to music purchased through Amazon Prime, or Amazon’s digital music streaming service. Those files will still be available, with no action needed on your part.

While it’s a sad development, it’s not surprising in the least. Increasingly, companies that provide cloud-based storage are streamlining or scaling their services back. Amazon isn’t the first, and they certainly won’t be the last. Last year, both DropBox and Microsoft Onedrive (two prominent players in the cloud storage ecosystem) announced scalebacks to the amount of storage offered in their free accounts.

While it’s true that storage has become increasingly low cost, it’s also true that the growth in popularity of cloud storage has exploded. Companies offering the service have had to scale back, lest they become completely overwhelmed.

In any case, there’s still time to move or preserve your files, but you’ll want to take action sooner rather than later.

Joseph Martin

Facebook Post Removals May Soon Get An Appeals Process

April 10, 2018 by Joseph Martin

There are some big changes coming to Facebook, which may have some serious unintended consequences.

In a recent interview, Mark Zuckerberg indicated that he’s considering allowing users to independently appeal to the content moderation team if their posts get taken down for violating various community policies.

On the surface of it, this seems like it would be a good thing. Zuckerberg said that the move is designed to give people in the Facebook communities what they want, rather than reflecting short-term, profit-driven wishes of the shareholders.

It’s a significant change because as of right now, Facebook only allows for appeals if content was removed for violation of copyright laws. In addition, the appeal must be made via a DMCA (Digital Millennium Copyright Act) notification, which makes it a somewhat daunting process.

Zuckerberg describes the new approach as follows: “So maybe the folks at Facebook make the first decision based on the community standards that are outlined, and then people can get a second opinion. You can imagine some sort of structure, almost like a Supreme Court, that is made up of independent folks who don’t work for Facebook, who ultimately make the final judgement call on what should be acceptable speech in a community that reflects the social norms and values of people all around the world….I think we can build that internally as a first step.”

All of that looks good on paper, but there are some major problems with this approach.

First, the company will struggle to find enough volunteers to monitor content and appeals to keep pace with demand. Given the size of Facebook’s footprint on the web, that’s a very real concern. The new, easier appeal policy is certain to cause the number of appeals to explode.

Second, if not done with great care and forethought, it could further polarize the platform. It could lead to the development of more estranged “information silos,” which runs counter to what the company ultimately wants its global network to be. In addition to that, it could easily lead to a massive backlash against the company.

Time will tell, but the coming months should be interesting indeed.

Joseph Martin

MyFitnessPal User Information Data Breach Affects 150 Million

April 9, 2018 by Joseph Martin

Another week, another high-profile data breach. This time, it’s Under Armour in the hot seat. Under Armour acquired the MyFitnessPal app back in February 2015, and the company recently announced that their new acquisition was hacked in late February 2018.

So far, the company is taking all steps we’ve come to see as usual in these circumstances. They’ve notified their user base about the scope and scale of the attack, which impacted a hefty 150 million users. In conjunction with the announcement of the event itself, they assured their users that the theft of data was limited to user names, email addresses and encrypted passwords.

Although the stolen passwords are encrypted with bcrypt (which is a highly secure solution), the company is still recommending that all of the app’s users change their passwords immediately, just to be safe. Under Armour also assures its MyFitnessPal users that no credit card information was exposed.

In a departure from the routine we’ve come to expect in situations like these, the company is also warning users to be aware that since their emails were stolen, they may be subject to phishing scams in an attempt to get more of their personal information.

That announcement, in part, reads as follows:

“Please note that the email from MyFitnessPal about this issue does not ask you to click on any links or contain attachments and does not request your personal data. If the email you received about this issue prompts you to click on a link, suggests you download an attachment, or asks you for information, the email was not sent by MyFitnessPal and may be an attempt to steal your personal data. Avoid clicking on links or downloading attachments from such suspicious emails.”

While Under Armour’s handling of the incident has been solid so far, one has to wonder how many more of these incidents we’ll see before companies start taking data security more seriously.

Joseph Martin

Google Changing Name Of Android Wear Without Updates

April 3, 2018 by Joseph Martin

Wearable computing devices from smart watches to glasses are struggling to find an audience, and Google’s Android Wear operating system hasn’t gotten much love in recent years. It has weakened as major players in the tech space have struggled to find a market for these products. On the face of it, these products would seem to be wildly popular, but still haven’t quite captured the imaginations of a critical mass of the consuming public.

Google’s recent announcement that it was rebranding Android Wear to “Wear OS,” is the most significant move we’ve seen in over a year. However, without significant updates, simply changing the name isn’t going to improve the OS’s visibility or viability.

The name change was driven by the fact that when the OS was first released, it appeared only on smart watches, but the company later added iPhone compatibility, which made the name less than perfectly applicable. In a blog post related to the rebranding effort, Google referred to Wear OS as “a wearables operating system for everyone.”

It’s hard to make a convincing argument that Google is all that interested in wearables. One needs only to compare the company’s handling of Wear OS with the way Apple handles wearable products and OS’s.

We had to wait two and a half years between the version 1.0 and version 2.0 of Wear OS. Android Wear was released more than 13 years ago, and since its release, the company hasn’t made any updates or announcements except for the recent blog post announcing its rebranding.

There are some signs that Google has long term plans for the floundering operating system, though. The company has been recruiting high-profile brands including Tommy Hilfiger, Michael Kors, Hugo Boss, Guess, Gc, Fossil and others to make and sell Android watches. It will be interesting to see what the company does in coming months.

Joseph Martin

Intel Taking Additional Steps To Prevent Security Flaws

April 2, 2018 by Joseph Martin

By now, you’ve almost certainly heard of “Spectre,” one of two recently discovered security flaws that impact every chip made by Intel in the last ten years.

The story of Spectre, and Intel’s response to it has been an interesting one. In response to the flaw’s discovery, Intel rushed a firmware patch, but quickly had to take it back and recommend that users not install it, because it created as many problems as it solved.

Intel has since released a better, more stable patch, but hasn’t stopped there. The company recently revealed that it is introducing various hardware protections against Spectre-like vulnerabilities that may be detected in the future.

According to Intel’s CEO, Brian Krzanich, “(We have) redesigned parts of the processor to introduce new levels of protection through partitioning. As we bring these new products to market, ensuring that they deliver the performance improvements people expect from us is critical. Our goal is to offer not only the best performance, but also the best secure performance.”

While that is welcome news for people planning to make purchases in the near future, owners of existing Intel-powered equipment will still have to have to rely on firmware updates for Spectre protection. This unfortunately comes with the tradeoff of a hit to CPU performance.

In tandem with that update, the company also announced that as of now, they have firmware updates available for all of its products launched within the last five years. This coupled with their recent partnership with Microsoft to help deliver Spectre updates to their legions of impacted customers should provide peace of mind, even with the expected hits to system performance.

Unfortunately, with new variants of Spectre and Meltdown being discovered on a regular basis, this is likely not the last we’ll hear about this issue.

Joseph Martin

Panera Bread Customer Accounts Exposed To Threats

Microsoft Helping With Ransomware In Office 365

Hackers Zone In On Microsoft Products To Attack

Most “Wannacry” Hacks Were On Windows 7 Machines

Apple Releases Major iPhone and iOS Device Update 11.3

Amazon Removing Music Storage Service At End Of April

MyFitnessPal User Information Data Breach Affects 150 Million

Google Changing Name Of Android Wear Without Updates

Intel Taking Additional Steps To Prevent Security Flaws

Contact Info

Navigation