Though it won’t be something most of us would like to hear, staying safe in technology is no longer a matter of being savvy, street-smart and vigilant. The concept of “rugged individualism” is considered one of the foremost tenets of American culture and stems from the countless (and most likely glorified) stories of pioneers and young entrepreneurs fighting what seems like impossible odds to come out on top, merely through tenacity, ingenuity and pluck. What the history books fail to share are the numerous accounts of everyone else barely surviving, or in many cases outright failing. Make no mistake, even experienced technology experts are getting hacked, so the chances of you coming out unscathed in today’s dangerous internet environment are slim to none.
What this means for you
Most likely you are in fact experienced, street-smart and savvy. You might be able to troubleshoot basic technology issues, navigate bizarre support bureaucracies to get a password reset, and even change a tire or check your own oil on that Honda Accord that’s still running like a champ after 100k miles. You know better than to use “Secret1234” as a password, and you’ve even figured out how to block some trackers in your browser from sniffing out your shopping habits. Unfortunately, you’ve learned what would be now considered baseline survival on the internet. Unfortunately, the current state of internet security is thus: at no point can anyone, me or the leagues of hardened technology experts, sit back and say, “There! I’ve learned all I need to stay safe online.” Your internet safety habits are the equivalent of learning how to drive, and like most everyone, we still need a pervasive infrastructure, mechanics and engineers to maintain the elaborate systems that have become essential for us to pursue a modern life. The majority of us aren’t expected to be auto mechanics, or even roughly familiar with how a car even works, and likewise I don’t expect everyone to be a technology expert, BUT you mustn’t take it for granted nor undervalue the true costs of staying safe. The more reliant you become on technology, the more you will have to invest in either training yourself, or take the more practical approach of making sure you have an expert like C2 Technology on speed-dial.
Image by Schäferle from Pixabay
Though it doesn’t come as a surprise to most of the IT community, the Federal Communications Commission (FCC) recently added Russian software developer Kaspersky to its list of companies that should not be used by any entity that receives funding through the FCC. Given the current geopolitical climate, this move probably shouldn’t surprise most everyone else at this point as well. The Moscow-based security and antimalware company has been under significant scrutiny since 2017 after an explosive report from Bloomberg Businessweek exposed the company’s close ties to Russia’s intelligence agencies, leading to the software being banned on all U.S. civilian government networks shortly after its publication.
What this means for you
Depending on who you talk to (including C2), Kaspersky has been on the “no-fly” list for most (non-Russian) security advisors since at least 2017, and for many of my clients who grew up during the Cold War, the software has never been a consideration because of its Russian roots, even though it was considered highly competent in the early 20-teens. It was well regarded enough that it had enough American market penetration to the point that it had to be listed and banned to force its removal from the various U.S. government agencies that had based their choices on more technical versus patriotic considerations.
If you are using it, should you remove it? The answer is obvious if you are an entity that is covered by either the US government ban or the FCC’s prohibitions, but what about your family PC? Politics aside, there are enough solid replacements out there that sticking with Kaspersky isn’t worth potential risk or bad optics it presents to U.S. companies. As for your personal computer? It’s a personal choice, of course, but Kaspersky’s technology no longer stands out from the crowd so don’t give it an edge there. Go with an option that maybe has less baggage at the moment. For personal computers we like Webroot, Malwarebytes or Bitdefender, and if you don’t the extra cash for a paid antimalware platform, the built-in options on both Windows and Mac OS X are decent enough if you are vigilant and stay away from those questionable links in strange emails.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
If there is one thing that is certain, if there is a useful technology invented that is supposed to benefit us, there is a corresponding negative usage that can and will be exploited. After the initial dopamine rush had worn off around Apple’s AirTags, people started waking up to the negative implications of a small, easy-to-conceal, wireless tracking device that utilizes one of the largest global networks in the world. Apple’s “Find My…” network is too useful to not be exploited, and the less ethical are already doing so.
What this means for you
Apple’s AirTags were initially created to track items that could be easily lost or stolen and ostensibly were made inconspicuous so that they weren’t unsightly and so thieves couldn’t easily find and discard the trackers. Once reports started flowing in of the “less orthodox” usage of AirTags, Apple immediately tried to get out in front of the problem by letting everyone know that AirTags themselves have unique, embedded serial numbers and their usage is tied to an Apple account – information they will surrender to law enforcement in a criminal investigation. But they glossed over something that more inventive hackers latched onto – what’s to stop someone from creating a “cloned” AirTag that simply bypasses Apple’s security measures? At the moment, nothing. Someone has already done so, and you can assume that Pandora’s box is not going to be closed any time soon without significant intervention from Apple.
Until that happens, you should get caught up on Apple’s lengthy advice on detecting and finding unwanted trackers. The article goes into great detail for Apple device users, so if you are an iPhone user, finding an unwanted Apple-made AirTag should be pretty straightforward (if not a wee bit unsettling). For the rest of us using Android devices, Apple has released an app called Tracker Detect (watch out for copy-cat apps!) that has to be activated manually. Not nearly as useful as its iOS counterpart, but at least they tried. If you’d like something a bit more robust and not funded by Apple, you can try AirGuard which was developed by a research team out of German university TU Darmstadt. I’ve tried both apps and while they appear to do no harm (other than possibly drain my battery faster), I can’t really verify that they work, as I apparently don’t have any unwanted trackers near me. Yay? Either way, if you suspect you are being digitally stalked, make sure you share your suspicions with your loved ones and authorities and get familiar with this site and its resources immediately!
Image by Thomas Wolter from Pixabay
It seems like common sense, doesn’t it? While accidents and mechanical failures do happen, getting hurt while using a chainsaw usually comes from not understanding what the tool is capable of, or how it works. Fire is hot and teaches a clear lesson in an instant, but Technology, despite having an almost unlimited potential to do harm, isn’t always so obviously dangerous like a chainsaw or stove burner. For certain, if you’ve been personally attacked or hacked via technology, you might be a bit more cautious with certain things than someone who hasn’t been “burned”, but unlike fire, technology is constantly changing, and consequently, requires constant lesson-learning. But it also requires a certain level of respect for its sharp edges which most ignore or forget.
What this means to you
As some of you might already know, being book-smart is different from being street-smart, and knowing how to use a piece of technology is a long way from being savvy about that same piece of technology. As an example, most of us know what email is and how to use it, but many still make poor decisions on using or sharing passwords because they don’t truly understand the consequences of doing so. I still regularly meet with clients who don’t understand why their email account getting hacked could have long-reaching financial impact on themselves, their employer and their customers. Not because they are dumb or foolish, but because they haven’t been trained, and our culture deemphasizes it in favor of shiny bells and whistles. Security is rarely featured in marketing and advertising to consumers – advertisers know that security is not sexy, and increased security is often equated with inconvenience or viewed as a necessary evil like warning labels. Similar to the way the mask mandate fight is colored as an issue of freedom instead of safety and compassion, considering security when making decisions about technology is fighting an uphill, cultural inculcation that has been around ever since seat belts were first invented. Humans aren’t always good judges of what keeps them safe – it’s something that has to be learned, and as an employer or leader, you will want to keep this top of mind when considering how to keep your organization and your people safe, technology or otherwise.
Image by Peggy und Marco Lachmann-Anke from Pixabay
Last week we discussed what a properly equipped home office might look like, but another component that is just as important is the technology infrastructure of the company itself. Thanks to the unstoppable force that is the Internet, small and medium-sized businesses now have access to technology platforms and services that were previously the exclusive purview of larger companies with dedicated IT staff, without the associated enterprise-grade price tag. It’s 2022 – is your company still running on technology from the 90’s?
What we consider to be the standards for SMB infrastructure
If you are a decision maker or manager of organization that has survived and possibly thrived during the pandemic, you probably already understand the fundamentals of a successful business, and possibly grasped the core technology concepts that were a part of keeping your business a going concern while we struggle with Covid. Make no mistake, good people are at the root of your success, but so is making sure your technology is secure, readily accessible, and reliable. To make sure they are all these things, we make the following recommendations to all our clients:
- Hosted Email – For reliability, extensibility and widespread familiarity, your email should be hosted with either Microsoft on the 365 platform, or Google Workspaces. There are other providers out there, but from a support point of view, they are distant, distant thirds to the two giants in the industry. While the primary functionality of email will appear mostly the same to the typical end-user, hosting it on a fully modern and robust platform provides you with better expansion and management, and most importantly, security and the ability to implement multi-factor authentication, something that most simple POP/IMAP services don’t offer. And you should definitely not be running it on a free-mail service.
- Cloud File Sharing – Up until recently, we were staunch advocates of premised-based fileservers. They are fast, secure (if maintained properly) and relatively inexpensive to operate. Then Covid came along and rocked the modern office’s world and suddenly premise fileservers became an obstacle to working from home effectively. Just like Zoom swooping in to fill the meeting gap, platforms like DropBox, Google Drive and OneDrive stepped up to allow geographically dispersed teams to collaborate, just like they did in the office, if a little slower and, of course, much more dependent on the Internet not being down.
- Cloud Collaboration/Communication – Everyone’s fairly familar with Zoom, and while we may be heartily sick of it some days, it’s keeping us safe(r) and connected in the “new normal” working world. There are other tools that allow your scattered workforce to collaborate in robust ways, group chat apps like Slack and Teams are great for staying in touch with (and keeping a gentle hand on) everyone in your organization, as well as offering addons to manage projects or tie-ins to your ERP and CRM systems. Just because they are in isolation does not mean they have to be isolated from their co-workers or critical information. Cloud-based VOIP phone systems can also bring some old-school feel to a completely virtual office, while still providing modern, must-have features like SMS messaging, voicemail to email transcriptions, and fully-automated auto-attendants that can deliver office calls to cellphones, mobile apps and softphones on your home office computer. You can also have a desk phone in your home office that uses your internet to make and take calls, just like you were sitting at headquarters.
- Remote Access and VPNs – For those organizations that cannot (or do not want to) get away from premise-based fileservers, you need to put in better, faster internet (if it’s available, not always a guarantee still in 2022!) and provide centrally managed means for your remote workers to access the premise-bound services. While it’s possible for folks to get access to “free” remote access platforms, using one that is “blessed” by the company and their designated technology support will provide much better security and supportability.
- Malware and Network Protection – Regularly updated and centrally managed malware protection and network firewalls are crucial to keeping all of your technology and services secure. We don’t recommend self-managed solutions for any size organization primarily because your focus should be on your business, not staying abreast of the numerous changes and updates in the cybersecurity world. Not only do we recommend this for all workstations and servers, home and office networks, we also recommend additional filtering services for your cloud-based email, above and beyond the default offerings that are provided. Think of it as a firewall for your email.
- Cloud-based/Remote Backups – your data is the lifeblood of your organization, regardless of the industry. On premise backups are better than nothing, but for improved peace-of-mind and significantly improved continuity and recovery prospects in the event of a catastrophic event (either natural or digital), having your most important data stored somewhere else, encrypted and safe is a must-implement standard. Also consider email and cloud sharing platform backups. Yes they are in the cloud already, but that doesn’t prevent them from being deleted accidentally or even on purpose. Even services like Microsoft 365 only offer a limited roll-back period, whereas managed backups can literally go back to Day 1 (of the backups).
- Regular Security Trainings & Checks – This is something we don’t see very often, even in the most technically-savvy organizations. Your weakest link in technology security is always human. Sometimes its a software developer over whom you have no control, but most often it’s your own employees or vendors. Thankfully there are platforms that can assist with keeping your people current with the most important security fundamentals without taking a lot of their time, or forcing them to sit through boring PowerPoint presentations. Keeping your people vigilant and well-informed will reap huge, long-term security benefits that can’t be realized with hardware and software alone.
If there is one thing that the holiday seasons are known for, it’s the broken-record playlists we are subjected to wherever fine background music is played, but rather than torturing your ears with “All I want for Christmas” for the 50th time today, I’ll sing another familiar tune that starts like this, “Protect yourself before you wreck yourself.” Not quite as catchy as Mariah, and definitely not as earwormy, but you probably already know the words, because I sing this song all year long. Digital crime is up, and more and more people are falling victim to scams and the scumbags who run them.
Here’s your list, you should check it twice
- Back up your data. Preferably to a cloud-based platform that you don’t even have to remember to run. Most self-managed services come as little as $7 a month. Some of us spend more than that on coffee in a single day. Don’t want the cloud? Grab a small, portable hard drive in the multi-terabyte range and set up backups to that device. Most come with a free, downloadable backup app that will handle rudimentary backups. Not as good as cloud-based automatic backups, but better than nothing.
- Turn on 2-factor authentication for your email. This probably won’t cost you anything – even most of the free email platforms offer some form of multi-factor authentication. Yes, having multi-factor is a pain, but you know what hurts even more? Having your email account hacked and used to con friends, family and clients. Don’t be that Grinch this season!
- Keep your work and personal stuff separate. Thanks to Covid, everything is all mixed together. Working from home is great if you are fortunate enough to have that “privilege”, but it also means that it’s harder to keep the two worlds from colliding constantly, especially from a security standpoint. If it looks like you are going to be working from home for the long run, perhaps it’s time to make sure the computer and devices you use for work are dedicated to just that, and not moonlighting as a homework/videogaming platform after hours. Working parents, you know what I’m talking about!
- Keep track of those pesky passwords. Let’s face it, Santa ain’t bringing us the gift of freedom from passwords this year, so treat yourself to a real password manager. Again, the good ones aren’t that expensive, as little as $3 a month! You can even get a family plan that allows you to share passwords – might be useful for multi-generational households and the multitude of streaming services they are guaranteed to be watching!
- Get a “mask” for your computer. Let’s face it, long before the pandemic darkened our doorways, the internet was polluted enough that the smart computer users were masking up with malware protection. The pollution has gotten worse, and shows no signs of abating. Having your computer go out in public without a mask is just asking for an infection and unfortunately monoclonal antibodies won’t save your data.
Image by Arek Socha from Pixabay
In years leading up to the domination of the world by the Internet we used to make fun of organizations and industries that seemed to be dragging their feet on getting modernized – the Navy’s old DOS-based, air-gapped systems seemed so antiquated (even with the Wargames movie sounding very prescient, if simplistic alarms) or local mom-and-pops using mechanical registers, or hospitals and clipboard paper charts. Now that everything has a network connection and is sending and receiving data via the internet, it would seem the Monkey’s Paw curled up all fingers except one and that one is flipping us “the bird.” This latest facepalm comes in the form of devices built by or containing components built by Siemens that use an operating system known as Nucleus, an OS that was written for devices used in industries that require stringent safety and security controls, such as the medical, automotive and aviation controls. Clearly this would mean that the OS must be safer than the usual swiss cheese we see from OS’s like Windows, right? Researchers have found 13 vulnerabilities in the networks stack of Nucleus, an OS that is used in an estimated 3 billion devices.
What this means for you
I won’t go into the gory details of the vulnerabilities as that would only be entertaining for security geeks and I know they aren’t reading my blogs for that sort of fun. Suffice it to say, so far as the researchers know, these vulnerabilities haven’t been exploited in the wild yet and Siemens has supposedly addressed these holes with updates. So why am I spending precious minutes telling you about something that (a) you have no direct control over and (b) might already be taken care of? Precisely because of those things. It’s convenient and comfortable for us to go about our daily lives while ignoring just how much of our surroundings are managed, monitored and controlled by devices that we have zero understanding of how they work, let alone what master to which they report.
We can be sure of two things in this current crazy timeline: if a device can gather and report data, it will do so because data = profit, and if the device was built, programmed or configured by a human, you can be certain that it is less than perfect. Most of the time, we can deal with something that is less than perfect. In fact we are surrounded by imperfections that are suitable, usable and safe. Most of us understand that perfection is an ideal to strive for and not objectively obtainable. Unfortunately for internet security, small imperfections, even when rare or obscure, can lead to massive problems. At the moment, as with the parallel analogy of the ratio of air disasters to safe flights, it feels like security breaches and vulnerabilities are everywhere, when in fact they only make up a very small percentage of the amount of the vast amount of digital transactions that occur every single second. Unfortunately, like plane crashes, though their occurrences may be statistically rare (for the moment), they can be catastrophic when they happen. Engineers strive to reduce the chances that a plane will crash or that an operating system will be vulnerable to attack, but in the end, they are subject to human error. No technology is infallible.
It would be paralyzing to try to anticipate everything that could go wrong – this is the textbook definition of anxiety. However, I think it’s useful to carefully moderate your expectations when it comes to relying on technology to protect you or care for you perfectly. Don’t take your technology and security for granted, and you will be less surprised and better prepared for when it shows its human side.
Image by Bruno /Germany from Pixabay
I tried to think up an appropriate bon mot about a platform like Craigslist getting hacked based upon how old and basic the platform is in comparison to “modern” services, but frankly, their easy-to-use and barebones approach strikes me as a rare unicorn in a world full of apps that (try to) do everything, or ones that do one thing in an overly complicated/cutesy/outlandish fashion to stand out in the crowded field. If anything, you may take my soft spot for Craigslist as an oblique self-burn on my age and get-off-my-lawn attitude about modern apps, but given the amount of troubleshooting I do on its contemporaries, barebones and utilitarian gets it done without a whole lot of fanfare and confusion. Sadly, like all things internet, this has a double-edge: hackers have taken advantage of one of Craigslist’s signature features – anonymous emails – to trick users into installing malware.
What this means for you
If you use Craigslist to offer something up – goods, services, your heart, etc. – you will want to pay attention. Craigslist uses a form of anonymized emails that allow users to keep their identity confidential until they decide they want to interact with someone answering their ad. Unfortunately, this also means an email arriving from an anonymized Craigslist email address claiming to be an official warning about an “inappropriate” ad is probably going to be taken seriously, and links contained in said email will likely be clicked, leading to a malware infection instead of an actual, legitimate Craigslist URL.
Attackers are using camouflage provided by a trusted, familiar environment that they 100% know their target is engaged with, combined with a malware delivery through OneDrive to give them additional cover against the usual malware detection provided by mail services that can smell bad URLs. Even with good malware protection installed on your computer, clicking and opening a document and then following the familiar process to allow editing of the document – something that occurs everytime when opening Office documents delivered via email or the internet (aka OneDrive, Dropbox, Google Drive, etc.), will bypass the usual protections and deliver a malware payload essentially because you allowed it.
This is what you are up against. This is what we all are up against. There is no good protection against this type of chicanery other than being savvy and vigilant, having up to date malware protection installed, backing up your data, and using unique passwords and two-factor authentication wherever possible. There is rarely an instance where the holy trinity of malware protection, backups and strong authentication practices is not warranted. Don’t make excuses – these three things will be your safety net when your vigilance wavers. We are all human and we can and will be tricked. That is one thing I can guarantee.
Image Courtesy of Stuart Miles at FreeDigitalPhotos.net
Don’t let down your guard yet, but it would seem that hackers are focusing their efforts on targets with deeper pockets than you or I. Sinclair Broadcasting is the latest infrastructure victim to have their operations significantly disrupted by a ransomware attack that took dozens of televisions stations completely offline for hours in various markets across the country. As one of the largest media companies in the US, Sinclair owns and operates nearly 300 stations in the US, and according to unverified reports from inside sources at Sinclair, many of the stations are connected via a common Active Directory structure that allowed attackers to jump from station to station, encrypting servers and paralyzing the the affected station’s ability to broadcast any of its regularly scheduled programming.
What this means for you
Sinclair doesn’t own any stations local to Southern California as far as I can tell, so most of us probably went about our weekend blissfully unaware that a ransomware attack locked down an undisclosed number of stations. Though they as of yet have not released specifics, it’s possible they are the latest victims to run afoul of a new RaaS (Ransomware as a service) called BlackMatter which, perhaps not coincidentally, has also shown up in a new advisory from CISA, the FBI and the NSA that warns of threat actors using the new platform to target critical infrastructure, including two recent attacks on agricultural targets in the US. While these attacks may not impact you or I directly, infrastructure attacks are definitely worthy of our attention as they can and will cause widespread disruption to activities and services we take for granted, and in some cases like hospitals or law enforcement agencies could actually be life-threatening. And here’s something you may not have considered – each of these attacks most likely started with and individual getting tricked into giving up a password that gives the hackers a toehold, and that is all they need. Unfortunately, in this increasingly complicated technology landscape it is becoming ever more difficult to keep passwords safe, mainly because we are always being asked for them. How many times a day are you confronted with a password request that makes you question it’s legitimacy? It’s a challenge to keep up with technology on a good day, but when the hackers have you on guard 24/7, you really can’t afford to not pay close attention.
Unfortunately, there isn’t any silver bullet or magical tip I can provide to help you here. It’s most important to know where and when a service might ask for a password, and how to recognize legitimate requests based upon having more than just a passing familiarity with applications and services that require passwords that protect sensitive data or privileged access. If anything, err on the side of not entering a password if you aren’t 100% certain. Additional protection will come from using multi-factor wherever it is made available to you, and of course, using unique, hard to guess passwords for all your important services.
We’ll keep it short and sweet this week. Earlier this year, an advanced form of spyware was discovered on a small group of Middle-Eastern journalists’ iPhones that was eventually traced back to a developer in Isreal called NSO Group. Purportedly designed for law enforcement agencies to combat terrorism, the spyware known as Pegasus appears to have been utilized by one or more government agencies to spy on a select group of iPhone users. At the time, it was unclear how the exploit was being deployed, so no defense or patch could be provided to stop Pegasus from being installed. After months of research, Canadian internet watchdog group Citizen Lab uncovered the flaw and announced it this week in the news, timed in concert with a security update from Apple that should be applied immediately to all iOS devices and MacOS devices.
What this means for you
If you have a late model iPhone, Mac computer, Apple Watch or iPad, check the settings immediately for any available updates and apply them as soon as you can get to a solid internet connection and have your device connected to a power source. The iOS version you are looking for is 14.8, and on Macbooks and iMacs it will be MacOS 11.6.
- Update your iPhone, iPad, or iPod touch – Apple Support
- Update your Apple Watch – Apple Support
- Update macOS on Mac – Apple Support
As of this writing, the actual number of people who have been impacted by this flaw and Pegasus is very small, but now that the actual flaw has been revealed, there is a possibility that others beside the NSO Group will attempt to take advantage of the window that is typically open while people get patched which can be days or even weeks. While Pegasus is designed for spying, there will surely be other malware types released to attempt to exploit this flaw that may be more straightforward in doing harm. Don’t be one of the ones caught sleeping on this update. Get patched now!