Stuart Crawford – Page 66 – Ulistic Projects Blog

February 18, 2019February 17, 2019

A Look At The 2018 Cybercrime Stats

What Is the Big Picture in Terms of Cybercrime in 2018?

The past few years have revealed trends that show us cybercrime won’t just go away. The following stats put the breadth of the threat into perspective:

Cybercrime was the 2nd largest crime in terms of the number of incidents reported.
Cybercrime accounts for more than half all criminal activity in the U.K.
An attacker is present in a network an average of 146 days before getting caught. That’s enough time to get what they need without getting caught.

What Did Cybercrime Cost in 2018?

With technology continuing to advance in favor of cybercrime, 2019 is likely to see its share of hacking headlines. The Cyber Security Breaches Survey revealed that 43 percent of businesses experienced some kind of cybersecurity breach in 2018. California alone lost $214 million to cybercriminals.

VPNs are one way people try to protect their online privacy, but user behavior continues to counteract the best firewalls and security strategies. For example, despite knowing the risks of clicking an unknown link or email, many people do so anyway.

What is a Cybercrime Platform?

The cybercrime economy mimics the global economy’s shift towards a platform model. This mirrors the legitimate shift to social media, Amazon and Google. Platforms connect retailers and consumers and give people a place to interact in other ways. Unfortunately, this has given unscrupulous people an opportunity to get to know how these systems work and use that knowledge to commit cybercrimes.

What Is the Most Common File Format Used By Cyber Criminals?

Hackers love Microsoft Office file extensions. They know people trust them and are more likely to click on them. Emails are the most common way that cybercriminals defraud their victims, and they do so by sending files with familiar extensions to mask malware and spyware. People use emails every day for all kinds of communications, including very sensitive information. Unfortunately, it’s relatively easy for bad actors to send you an email that opens you up to viruses, identity theft and other risks.

How Are Cyber Criminals Making Money Off Your Computing Power?

Some hackers aren’t interested in your personal information or causing havoc with your sensitive files. Believe it or not, some cyber criminals break into your computer to steal your computing power. They may use these unauthorized resources to mine cryptocurrencies, for example.

One of the latest threats involves the use of your computer or other devices for bitcoin mining. Symantec has reported an increase of 8,500 percent in the number of people caught coin-mining. This indicates that there are hackers dedicated to accessing and using a victim’s computer resources in lieu of stealing personal data.

How Much Money Can a Cybercriminals Make?

The short answer to this is that an individual with the right skills can earn far more via cybercrime than most legitimate lines of work. Individuals can earn about half a million dollar a year by selling stolen data. There are several levels involved, however. Low-level hackers may be happy with petty crimes that put extra cash in their pocket. Highly specialized hackers can make millions working alone or as a team. Generally, though, hackers make about 15 percent more than those in traditional crime brackets. High earners bring home about$167,000 a month, mid-level earners rake in $75,000 a month and at the low end of the spectrum, petty cybercriminals make $3,500 a month. For instance, someone managing multiple card data forums can bring in millions each month.

How Do Hackers Use Existing Platforms to Make Money?

Just turn on the news any given night and you can find stories on data breaches, the bread and butter of cyber thieves. Personal data can be sold as is or used to created bank accounts and apply for credit cards, which are sold for small or large fortunes. Theft isn’t the only crime possible. Major platforms are targeted for the myriad of data they collect. Even Facebook is not immune. It was in the news for a significant data leak in 2018. Yahoo also had a major breach that compromised 3 billion user profiles. Cybercriminals aren’t shy about going after these giants, so it’s up to you to increase your vigilance at home and at the office.

Are Smart Homes Vulnerable to Cyber Attacks?

Smart home devices usually connect to your home network from an outside network. If your router is adequated protected, you’re opening the front door of your home for cybercriminals. With smart home devices becoming more common, savvy criminals are learning to take advantage of their vulnerabilities.

February 17, 2019

How Construction Companies Can Benefit From Managed IT Services

Construction companies have specific IT requirements. Time is money in any business, but that’s especially true in the construction industry. You need excellent communication and coordination between management and workers and the ability to oversee contractors and order materials quickly. For that, you need top construction planning software and your company needs a comprehensive IT strategy. Just as you subcontract out certain work in your construction projects because it’s more efficient, your IT needs are usually better served by those who can deliver at less cost and more efficacy.

State-of-the-Art Technology

A managed service provider (MSP) offers clients access to state-of-the-art technology. There is no need for constant tech upgrading and the additional cost on the part of your company when you use managed IT. When your company goes the managed IT route, you also won’t experience any unpleasant surprises when it comes to charges. You pay a fixed fee every month, according to your contract. You can also design the right type of IT management for your construction company, as the MSP does not deal with companies on a one-size-fits-all basis when it comes to IT.

State-of-the-Art Skills

When hiring an MSP, you are hiring expertise. You know that, but you may not realize that circumstances may arise in which your business requires an IT specialist in a particular field. If you rely on an in-house team in which no one has this specific skill, you must either pay for training or hire an expert for this certain task. That’s not an issue with managed IT, as you are dealing with a team with state-of-the-art skills that can deal with your company’s problems as needed. Managed IT offers advantages not only over the costs of an in-house team but means you don’t have to outsource to another entity when problems arise.

Security Issues

Your construction company needs top IT support for security. It’s likely that you have an in-house team – especially one consisting of just a few employees – that does not have the expertise to deal with the latest threats. That means your company’s computer systems are far more vulnerable than you might think. Just as your construction business involves core competencies, security is a core competency of any managed IT company.

How an Outside IT Firm Saves Money

It makes no sense for a smaller construction company to hire an in-house IT expert, but it really does not make sense for most larger construction companies, either. When you have in-house IT professionals, you must pay salaries and benefits. When you hire an outside IT firm to provide services, those items are not your concern. A third party IT provider is probably more aware of the latest viruses, malware, cyber threats and other factors that can harm your system than an in-house team. For those providers, staying abreast of current threats is a vital part of their business. If your system is hacked or otherwise compromised, the outside firm is available 24/7. That means reduced downtime when a problem arises.

Even if you do have an in-house IT tech team, a third-party IT provider is not working on the same projects, and this frees up your employees to focus on your business needs and your bottom line rather than dealing with typical IT administrative tasks or outages. A third-party IT provider deals with troubleshooting, upgrades and new tech implementation, allowing your IT employees to concentrate on your construction projects.

With the money saved by outsourcing your IT requirements, you can direct those funds toward areas most needed by your company.

Company Expansion

Managed IT allows for easier company expansion, especially across state lines or nationally. Managed IT with a cloud strategy avoids many of the difficulties construction companies face if relying on their own technology when expanding. You no longer have to worry about primary office connectivity and loss of productivity due to a local power outage.

Peace of Mind

All sorts of factors affect your construction business and your bottom line. Whether it is a common situation such as materials delivery, the weather, permit delays or equipment failure, or the more exotic, such as discovering human remains or artifacts during digging, you know that complications occur on projects. With all that you must deal with on a daily basis, using a managed IT service for your construction company gives you peace of mind for that crucial aspect of your business.

February 17, 2019

Australian MPs Concerned After Recent Cyber Attack

What happens when Australia faces a cyber attack? The Members of Parliament (MP) jump into action. They are concerned about the breach and they want answers. The MPs require that top officials come before Parliament and the Intelligence and Security Committee to discuss how hackers potentially breached Politicians’ network systems and email.

Anthony Byrne, who is the Labor Member of Parliament, insisted that an explanation be given to him by the Department of Parliamentary Services, the Australian Signals Directorate Director-General, Mike Burgess, and Alastair MacGibbon who is the head of Australian Cyber Security Centre.

What Really Happened?

Despite their best efforts and using all possible resources, Speaker of the House of Representatives Tony Smith and Senate President Scott Ryan said identifying the cause of the incident would take time in a joint statement they issued. Also in the statement, they said at this time, there was no evidence that any data was accessed or taken; however, an investigation would continue to ensure the safety of everyone’s information. The investigation has not determined if the attack was from a foreign entity, but they do know it was a robust attack and not a kid in his basement.

There is great concern that this breach was intended to interfere with Australia’s political process similar to what occurred in elections in the US and France. There has been no proof that this was intended to impact the results of the processes occurring in Parliament. There was also no proof of an intent to influence election outcomes.

Other concerns expressed by the MP is that email went down at three o’clock in the morning, however, no one was notified about the breach until the system was already back online, which was not until nine o’clock that same morning. In addition, they were notified by email about the breach, but they weren’t able to get into their email system.

Actions Taken as a Result of Breach

Everyone has watched on the world stage as countries such as the US have experienced email breaches and the possibility of foreign countries negatively impacting their election outcomes. Even if there hasn’t been breaches, just the threat of them have caused morale problems in the country. Feelings of mistrust are already starting in Australia as many are concerned as a result of the attack and have lost faith that the Department of Parliamentary Services are able to handle these growing threats. They feel as though they may not have the expertise to handle these situations.

It was suggested to all politicians that they change their passwords within the expenses system. This is the system that tracks usage of funding received from the public for work purposes. This action was purely a preventative measure. Many measures have been taken over the years to tighten the cyber defences of Parliament. Despite this, the MPs are greatly concerned about their data.

Are There Other Concerns?

This is not the first time Australian politicians and systems have been targeted by cyber attacks. In 2011, the Australian Prime Minister Julia Gillard’s computers were attacked and Chinese intelligence agencies were thought to be responsible. In 2013, Chinese hackers were blamed for stealing blueprints of Australia Security Intelligence Organisation headquarters, presumably to tap into phone and computer lines. In 2017, defense data was hacked and stolen. In 2018, Australian government took aim at Russia for a previous router attack.

In early 2018, the Australian Cyber Security Centre analysed a cyber attack and found that eight Australian web hosting companies were compromised and allowed bad actors the ability to hack into their customers’ websites. In December 2018, the US Justice Department and UK officials charged Chinese government hackers with indictments. At that time, Alastair MacGibbon, the head of the Australian Cyber Security Centre told thousands of Australian businesses that they may have been hacked by the Cloudhopper epidemic that was plaguing heavy-hitting global IT companies like IBM. Last month, the Australian Cyber Security Centre shared some of their findings, which is that data attacks are on the rise in Australia. In the last quarter of last year, there were 262 breaches and 168 of those were considered criminal.

Most likely, Australian officials won’t publicly place blame, but through media leaks, it may come out that China is to blame for this latest cyber attack on politicians. It has been known for a long time that Beijing has an entire unit in their military that handles these type of attacks as well as stealing secrets. Despite being a covert operation, their name is known. It’s the People’s Liberation Army Unit 61398. Even though it will take a significant amount of time to determine who is behind the attack, because of all the known data and frequent accusations from other governments, it is easy to speculate that Beijing is the attacker.

Whoever is behind the cyber attack, it is believed that they could be trying to gather information on a particular party possibly to discredit them, or just to get what they believe is provocative gossip. They also could be intending to derail a particular campaign’s agenda. Quite possibly, it could be used simply to discredit the entire governing body and create distrust within the general public.

February 15, 2019

How Compliance Manager With Microsoft Office 365 Works

Companies today operate under strict regulatory conditions. Complying with those regulations can be daunting, but failure to do so has serious implications. Managing compliance, therefore, is imperative. Microsoft offers Compliance Manager, a unique cross-Microsoft-Cloud tool, that allows organizations to manage and navigate the complex terrain of regulations. Here is how Compliance Manager works to help your company comply with the law and applicable regulations and standards.

Who is Compliance Manager For?

Compliance Manager is for any company or organization that needs a comprehensive and proactive tool to assess, track, verify regulatory compliance and assign tasks related to the same. Anyone who must comply with regulations or standards like the following would benefit from this tool:

EU General Data Protection Regulation (GDPR)
Health Information Portability and Privacy Act (HIPAA)
International Organization for Standardization (e.g., ISO 27001 and ISO 27018)
National Institute of Standards and Technology (NIST)

Essentially, the tool allows you to protect data and meet regulatory requirements via Microsoft cloud services.

What are Compliance Manager’s built-in features?

Compliance Manager features various tools to help your organization comply with regulations and standards pertinent to data protection and security. Here are three specific capabilities featured:

Assessment. The tool allows you to assess compliance from one place. Risk assessments are conducted on an ongoing basis.
Protection. Users can protect data across all devices, applications, and cloud services by using encryption, controlling access, and implementing information governance.
Response. Users can respond to regulatory requests through the incorporation of eDiscovery and auditing tools that allow you to locate relevant data for meaningful responses.

Through these features, Compliance Manager works to help you stay in and proactively manage compliance.

How does Compliance Manager Work?

Compliance Manager works by utilizing a single dashboard to see compliance stature. The dashboard provides summaries of your company’s assessments and action items. From those summaries, you can access controls and tools like exporting data to Excel.

You create assessments for the regulations and/or standards that matter to your company using Office 365, Azure, or Dynamic 365.

From these assessments, you receive actionable insights and detailed information about what Microsoft does to secure your data and help you comply with regulations.

Assessments

On the Assessments page, you are provided snapshots of your company’s compliance with specific regulations and standards — like those listed above — assessments of each.

For instance, compliance snapshots of your company will identify your company’s overall compliance with regulations like GDPR or standards associated with NIST or ISO. Each category is provided a “Compliance Score,” and the higher the score, the better your compliance stature.

On the same page, you are also provided with snapshots of assessments for each of these same categories. An Assessment Status is provided to let you know the status of the current assessment (e.g., in progress).

Under each of these snapshots, whether it is for compliance or assessment, you are additionally informed of:

The created date;
The modified date;
The number of customer-managed actions and the number of those actions that have been addressed; and
The number of Microsoft managed actions and the number of those actions that have been addressed.

Action Items

This page provides guidance on actions that could or should be taken to increase your Compliance Score. These are recommendations and are up to the company to implement.

Controls

Controls are the core of how Compliance Manager works. There are two controls: Microsoft and Customer.

Microsoft managed controls is a family of controls that align your company assessments with the standards and regulations. They are managed controls used to implement the assessment and assess compliance. Customer-managed controls, on the other hand, are controls that you as an organization manage. Here, you can implement actions recommended by Microsoft to increase your Compliance Score.

Compliance Manager is a tool to simplify compliance for organizations. It offers real solutions to a complex problem.

February 14, 2019

Facebook Finally Allows Users To Delete Sent Messages

Users of Facebook Messenger, which number over 1.2 billion people worldwide, now have a new feature that makes life a bit easier after making an “oops.” An oops is a mistake in an instant message that is immediately noticed, right after sending it, by the person who wrote it. It could be that a message includes a goofy typo. Typos are usually much easier to see right after sending a message than before sending it. This is a psychological thing.

The need for message deletion could also come from a message intended for one person that might be accidentally sent to the wrong person or incorrectly to a group. It could be that a group message was sent to someone who should not be included.

One thing that is helpful with this new feature is the ability to remove a photo that was sent in error. If the person receiving the message with the photo does not make a copy of it, it is possible that the mistake goes away when deleted by using the new unsend feature.

This may save considerable embarrassment. There is probably nothing more unfortunate than sending an explicit photo to your mother by accident. Hopefully, she does not see it before you get a chance to unsend it and send her a new message with the correct photo attached.

Ten Minutes to Change Your Mind

Now, for up to ten minutes after being sent, Facebook Messenger allows a person to delete a message. It disappears and then in its place appears the notation that the message was deleted.

Be aware, that there is no delay in sending the message out. Perhaps, if the receiver of the message is not paying close attention to their Facebook Messenger, the message may go unread. However, if a person already read the message, they know what it was about. The time limit of ten minutes for deletion also means that a message is not changeable the next day after a late night, drunken, message-sending binge.

Everyone Has Zuckerberg Unsend Power Now

The idea for message deletion on Facebook Messenger came from users who noticed that some of Mark Zuckerberg’s messages would disappear after a certain amount of time expired. Zuckerberg had this power to remove the messages if he changed his mind about the content with an afterthought. This was a superpower built into Mark Zuckerberg’s Facebook account that allowed him or his assistants to delete messages but was not part of the overall Facebook Messenger software’s capabilities.

Facebook Messenger users in droves petitioned the company to give them this unsend power for their accounts. The company agreed to do this and leaks came out during 2018 that this upgrade was underway.

Facebook also owns WhatsApp. Facebook bought WhatsApp for $14 billion in October 2014. On the WhatsApp system, it is possible to delete a message for up to an hour after it was created. This WhatsApp feature was extended to Facebook Messenger.

Adding this feature to all the Facebook Messenger accounts was not trivial. It took nine months of software retooling to get this feature working for all of Facebook users. Finally, in February 2019, it became available to everyone in the latest Facebook Messenger software release and upgrade.

What’s Next for Facebook Messenger?

Behind the scenes at Facebook, there is an ongoing effort to integrate all the messenger apps into one. Adding this unsend feature is heading in that direction of making Facebook Messenger blend with WhatsApp.

Facebook also owns Instagram, which it bought in 2012 for the bargain price of only $1 billion. Instagram was considered a startup at that time. Instagram has about one billion users now. About 80% of them live outside of the United States. The plans for 2019/2020 are to continue the integration of Facebook Messenger, WhatsApp, and Instagram with a redesigned interface that is simpler to use and elegant.

Until now, WhatsApp operated independently of Facebook Messenger. It has features, like message encryption, that Facebook Messenger does not have. There are also plans to make WhatsApp a payment gateway to challenge payment services like PayPal.

One significant problem is that Facebook is suffering from a serious diminishing of public trust. Many users have been leaving the system and deleting their Facebook accounts. Some do not trust Facebook’s influence over WhatsApp and think that Facebook can be persuaded to put a “backdoor” in the WhatsApp system to allow law enforcement the easy ability to spy on the encrypted communications of the WhatsApp users.

This is not so far-fetched because of the revelations that Facebook allowed its users’ data to be hacked and private information of its users to be misused by hostile foreign governments. The Facebook system was gamed in an attempt to influence the American elections.

Facebook has quite a way to go in order to rebuild trust with the public. There is no point in using any encryption service if the encryption protection can be bypassed by anyone, especially governments. Facebook may find that it loses WhatsApp users by trying to convert them to Facebook Messenger users, since, at this time, most WhatsApp users do not even realize that the service is owned by Facebook.

The Facebook Messenger Behemoth Rises

The New York Times reports Facebook wants to integrate the underlying system structure of Facebook Messenger with WhatsApp and Instagram while keeping the public interface of these three systems appear to be operating as stand-alone apps. This will aggregate the instant messaging of over 3.2 billion users. This move to integrate the three services by the Zuckerberg team brings up serious anti-trust issues and more concerns about privacy and security. Can Facebook really be trusted with all of our most private conversations?

To address privacy concerns, adding point-to-point encryption is one of the main goals for the integration of all three services during 2019 and 2020. The challenge for Facebook may not be convincing its users that it is serious about protecting their privacy as much as being able to avoid having to introduce a “backdoor” in the encryption software to allow government spying on the messages.

The new anti-encryption legislation, which just passed during December 2018 in Australia, suggests that this backdoor policy may become a new standard of government intrusion on privacy. A backdoor makes systems vulnerable to abuse and exploitation. Criminals may gain unauthorized access by exploiting the vulnerability of having a backdoor. Government workers may misuse private data that they can access.

The project requires thousands of Facebook programmers to work on it. Facebook estimates that the upgrade and integration of Facebook Messenger with the other systems will take over one year to complete. That timeline may be overly optimistic when it took nine months for Facebook just to add the unsend feature.

While the unsend feature may keep others from continuing to see a message if deleted within ten minutes, it does not permanently delete the record of the message from the system. Beware that Facebook will continue to store that embarrassing photo you mistakenly sent to your mom forever.

February 13, 2019February 13, 2019

What Is Customer Lockbox And Privileged Access Management In Office 365

Microsoft Office 365 is a suite of services that includes Customer Lockbox and Privileged Access Management. Both tools to assist customers in meeting their compliance obligations and maximizing data security and privacy. These tools are currently only available for customers with Office 365 Enterprise and Advanced Compliance SKUs.

Privileged accounts are being compromised more rapidly every day and sensitive data can be exposed in shorter and shorter periods of time. Therefore, organizations must establish multiple regulations, procedures, and compliance obligations that must be followed before access is provided by anyone. Microsoft Office 365 understands this and has built-in Privileged Access Management to meet these higher levels of security. Lockbox and Privileged Access Management provide granular task-based access control within an approval workflow so organizations can gather privileged access as well as monitor and control sensitive tasks.

Multiple Layers of Protection

Microsoft 365 Customer Lockbox and Privileged Access can assist organizations to meet their compliance obligations through a built-in set of tools offering multiple layers of protection to:

1. access their compliance posture

2. protect sensitive data

3. respond to requests

4. maintain business continuity

5. efficiently reduces costs

This is accomplished by ensuring there is a regulated process flow to handle incoming requests. Virtually all Microsoft operations are fully automated unless during very rare circumstances requiring human involvement that is necessary to troubleshoot and correct a problem. If this intervention is needed, an approval request is generated, and then the approval group is notified by email. The request can either be approved or denied and even blocked. If the request is approved, the task is processed and checked against the privileged access policy and then logged in the Office 365 Security and Compliance Center.

Customer Lockbox Controls

Customer Lockbox allows users to control how Microsoft support engineers access data and features special procedures for explicit data access authorization. This keeps your information secure while the problem is being fixed. Customer Lockbox works with Exchange Online, SharePoint Online and OneDrive For Business.

There are multiple levels of approvals from the Lockbox system before access is granted, so your information remains secure. The request must be very specific and include role, data location details, the specific reason for the access and the duration of the access. There is also an expiration time on all requests, so the content access is removed after the engineer has fixed the problem. The majority of problems do not require Customer Lockbox access, but it is available and very secure. The Customer Lockbox feature can be turned off in the Admin Center.

Refer to this informational video to learn more about how Customer Lockbox And Privileged Access Management In Office 365 can help you keep your information secure.

February 13, 2019

The Risks Of Using Auto-Complete For Passwords

The auto-fill feature that makes it easy to enter in usernames and passwords on various websites may be putting your information at risk.

While auto-fill is a convenient way to keep track of the many combinations of letters, numbers and special characters you need to access sites, the feature is also being used by advertisers and hackers. That’s why many security experts are suggesting turning off the auto-complete feature in your web browser.

Password manager programs embedded in browsers are a simple way to get access to a password-protected website. The password manager auto-fills your details, giving you one-click access to account information meant to be kept private.

How Hackers Get Access

If hackers get access to a compromised website, they can put an invisible form on the site and easily collect users’ login information. If your browser automatically enters this information when it sees the appropriate boxes on a web form, it adds the info everywhere those boxes are found on a page, whether they’re seen by the user or not.

Because most web users use the same username and password for multiple sites, the theft of this information on just one website can expose your information on many others.

Not Just Hackers

It may come as a surprise to learn that hackers are not the only ones trying to use your login information. Some ad networks are using tracking scripts to grab email addresses stored in your password manager for auto-filling. That tech can be used to grab passwords too, whether stored on a browser or an independent password management site.

The ad networks are using the same technique as hackers — an invisible form that captures your credentials provided by the password manager. Here’s a helpful demo page that shows you how it works.

Ad networks are using this information not to hack your data, but to understand what sites you navigate to better target ads to you. And while they claim to only be grabbing email addresses, the potential for further abuse is there.

What Computer Users Can Do

Password managers by themselves are still useful tools, especially given the number of codewords we need to go about daily web browsing. It’s the auto-fill mechanism that needs to be disabled. That’s simple to do.

On Chrome

Go to Settings
Search for Passwords and click on the Passwords arrow
Toggle the Auto Sign-In tab to the left (it should be grayed out not blue)
For more protection, you can stop Chrome from saving any passwords by toggling the Offer to save passwords to the left

On Firefox

Open Options
Click on Privacy & Security in the left-hand navigation
Click on History
Select Firefox will: Use custom settings for history
A new submenu will appear
Unclick on Remember search and form history
To fully disable saving any passwords, go to the Logins & Passwords section (just above History) and unclick Ask to save logins and passwords for websites

On Safari (Desktop)

Open the Preferences window
Click on the Auto-fill tab
Turn off all features related to usernames and passwords

On Safari (iOS)

Go to Settings
Scroll down to Passwords & Accounts and click on it
Toggle the AutoFill Passwords tab to the left

Disabling the auto-fill features means spending a little more time finding and entering usernames and passwords manually. However, these steps protect you from prying eyes looking to gain more information about you and your accounts.

February 12, 2019

14-yr-old Teen Who Discovered Eavesdropping Bug to Be Paid by Apple

Apple is yet to disclose how much it is going to reward a 14-year-old U.S. teenager for discovering a massive security breach on its FaceTime video call system. It is believed that part of the reward money will be set aside for his high school education fund.

On Thursday, Grant Thompson noticed the group FaceTime bug while on a video call with his friends. Apparently, they were discussing different strategies they could implement on Fortnite, a 3D video game which is widely popular among the teenage demographic.

Upon contacting Apple, necessary action was taken and the iOS 12.1.4 iPhone update was then released on Thursday. Prior to the discovery, an unknown security researcher noticed the presence of the FaceTime bug but was unwilling to come out with it, since Apple had not put a bounty on offer.

Missed Opportunity

Towards the end of January 2019, details of a suspicious bug on FaceTime emerged. A couple of users noticed suspicious activity on the widely used video call system among iPhone users.

Sometimes when they contacted friends and family, they could distinctly hear what was happening on the recipient’s end (regardless of whether they answered the call or not). Apple got word of the bug and immediately disabled the recently-launched group Facetime feature on iOS phones.

Earlier that same month, the teenager and his mother phoned the trillion-dollar company with a similar potential security threat. As expected, Apple considered the 14-year-old’s discovery a hoax and thought the boy was craving attention.

The problem was uncovered by Grant on one of his group FaceTime video calls. When Thompson’s plea was given a deaf ear, his mother, Michele Thompson stepped in and repeatedly reached out to Apple via social media and emails. For some reason, Apple was adamant to heed to the vulnerability in their FaceTime feature.

Ever since other users of the video call system came out with a similar bug issue, Apple has credited Grant, who hails from Catalina, Arizona, with this major finding. Grant’s name went viral hours after Apple released a software update to counter the bug’s detrimental effects.

About the Update

The iOS 12.1.4 is the latest update from Apple for all iPhone 5S phones, iPad Air devices and the 6^th generation iPod Touch. A week ago, Apple disabled Group FaceTime when news about the bug emerged.

Apple noted in turn that it solved a similar unknown issue some time ago in FaceTime’s Live Photos feature. On Friday, Apple reported that it solved the major security flaw on its servers. It would also release an advanced software update to re-activate Group FaceTime.

iOS 12.1.4 release notes state that there was an existence of a logic issue in Group FaceTime. It was also emphasized that the bug was fixed with “improved state management”. On Thursday, as of 10 a.m., the system status page of the massive tech company noted that Group FaceTime’s restoration was successful.

iPhone users can update their gadgets by doing the following:

Open settings
Tap on ‘General’.
Select Software Update
Download the update

Once the download is complete, your iPhone will automatically install the new software.

Swift Security Measures

A representative for Apple had this to say in regards to the update and the reported bug: “In regards to the bug that has noticeably established its presence in the FaceTime feature, a security audit has been conducted by our team. Additional updates have been made to not only the Group FaceTime app, but its Live Photos feature as a whole in a bid to enhance our security. This will go a long way in securing our customers who are yet to upgrade to the latest software”.

The representative also revealed a major server upgrade to block older versions of macOS and iOS from making use of FaceTime’s Live Photos feature.

For a global company that is keen on preserving users’ personal information, the bug was a huge misstep. Tim Cook, Apple’s CEO, has often advocated for increased regulation of privacy. In the recent past, he has subtly called out companies that utilize their customer’s vital data for the creation of personalized ads. In this case, it’s safe to say that Apple is not so perfect either.

Apple’s bug bounty program

Apple missed a massive opportunity to solve the FaceTime bug problem soon enough. Based on reports from The Wall Street Journal, as early as the start of January, Apple received warnings from a concerned teen but decided to do nothing about it.

Fortunately enough, before the issue escalated to something even more serious, more and more users noticed the flaw and issued a public outcry to the company.

Apple has offered its sincerest apologies to the teen and his family and is yet to fully reward them for their vocal assistance on the bug issue. The company is not willing to share the exact amount they will pay, but it will be substantial enough to see Grant through high school, according to a report by Reuters.

In regards to this incident, Apple developed the ‘bug bounty program’ in late 2016. In most cases, researchers can receive more than a hundred thousand dollars for reporting bugs early enough. One of the first people to receive substantial compensation from the program was 19-year old Luca Todesco.

In that same year, Facebook followed suit and rewarded a 10-year-old Finnish youngster a whopping $10,000 in bug bounty. The boy allegedly figured out how to delete anonymous users’ comments from all Instagram servers.

Aside from Grant Thompson, a 27-year-old software developer from Texas by the name of Daven Morris was also credited. Unlike Grant, Mr. Morris reported the problem several days after it was already made known.

Either way, Apple rewarded the young man for noticing the problem soon enough.

February 12, 2019

Australian Parliament Considering Changes To Encryption Laws

In early December 2018, the Australian Parliament passed into law a bill called the “Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018.” Australian and international technology companies immediately voiced intense opposition to the new law. Amazon, Apple, Digi, Facebook, Google, LinkedIn, Microsoft, Snap, Twitter and many more have already raised serious objections saying that the law is overly broad, deeply flawed, and lacks sufficient judicial oversight.

The law was passed in such a rush that it had to be stripped of 173 proposed amendments to the bill that were attached to it. The legislators approved the bill on the very last day of legislative sessions before going on their summer break. Like most things done in a hurry, the chances here of making major mistakes are very high.

Legislators agreed to the law as long as they can continue with the debate over adding amendments when they return from summer break. In the meantime, the structure of the law is defined sufficiently to create a global uproar over the law’s focus and major negative impact on encryption.

What Can Happen Under the New Law?

Senior officials of the Australian government (the Director-Generals of Security, the Secret Intelligence Service, and Australian Signals) and the chief officer of intelligence agencies may request companies that are considered a “designated communication provider” to give technical assistance in order to get private data on individuals and organisations.

Technical Assistance Request

Compliance with a technical assistance request is voluntary. Requests may be made in writing or given verbally in the case of an emergency. The idea is to inform the companies of what the needs are so that they can take voluntary steps to be able to comply with future requests about things that are deemed to impact Australia’s national security and the interests of Australia’s foreign relations.

Australia already has a security cooperation agreement with four other countries including the US, UK, New Zealand, and Canada. This means the new Australian law extends beyond the bounds of Australia to include the interests of these and potentially other countries. An Australian interception agency may use this new law to enforce Australian criminal laws and also foreign criminal laws if the offense has the possibility of a three-year sentence, or more, for a conviction.

Technical Assistance Notice

The procedures and the extent of an assistance request and a technical assistance notice are the same. The difference between a request and a notice is that a notice requires compliance. A technical assistance notice requires a communications provider to do acts or things, as required, to help Australian Security, the Australian Security Intelligence Organisation (ASIO), and an interception agency with issues of national security and enforcing criminal laws for serious offenses.

These notices, under the new law, come with an enforcement warrant that includes a confidentiality provision. Failure to comply may result in a fine of up to AUS$10 million (about US$7.2 million) for each incidence.

Technical Capability Notice

Under this new law, Australia’s Attorney General can give a communications provider a technical capability notice. The notice requires compliance. It forces the provider to be capable of doing things that will allow it to be able to give certain kinds of help to Australian Security, the ASIO, and other interception agencies. This capability gives the Australian government what it needs for national security issues and to enforce the criminal laws of Australia and other foreign countries related to serious offenses.

This is the part of the new law that made the CEOs of major technology communication providers nearly lose their minds because it immediately brings up problems with the almost certainty of introducing systemic vulnerabilities and systemic weaknesses. This provision of the new law can force a company to introduce a “backdoor” into their technology, which makes it extremely vulnerable to exploitation.

Systemic Vulnerability

For the purposes of the new law, a systemic vulnerability is something that impacts a whole set of technologies used by a large class of persons, such as instant messages, online banking, text messaging, and real-time chats. It does not include a vulnerability that is introduced when it is selectively applied to a target of just a particular person, even if unidentified.

To understand this concept, it means if a vulnerability is able to be limited to a targeted person and does not affect the entire class of persons it is not to be considered a “systemic” vulnerability. Although the concept is clear, achieving such a targeted vulnerability, which is limited to a single person in a system with widespread use, is extremely challenging, if not impossible.

Consider this example. If there is a need to be able to hack into a device of an individual at the Australian government’s request that is not identified, it means the entire system must have this capability as part of its design.

On close examination, this provision in the law is absurd. Communication providers must have the capability to target any particular person in the group of people using the technology. At the same time, they are not forced to use a systemic vulnerability that impacts the entire group. If a target person is unidentified then it could be anyone in the group! The only way to target them is with a systemic vulnerability; otherwise, it is not possible to find their communications.

Systemic Weakness

A systemic weakness means something that impacts the entire group of users of the technology. If the technology introduced, selectively targets a particular person it is not considered a systemic weakness. A targeted weakness is possible to achieve. However, this is normally something done by the ASIO or other intelligence groups, not by a communications provider or a technology company.

An example would be to surreptitiously gain access to a targeted person’s device and install a key logger to capture information entered on that device. It is possible but it is ludicrous to require a communication provider to do something like that to one of its customers.

Under this new law, communication providers can be forced to do things that violate a particular person’s privacy but cannot be forced to do things that create systemic vulnerabilities or systemic weaknesses. Again, the problem is that needs to have the capability to target any individual out of a group of millions or up to billions of people, means needing to have the capability to target any single person in that group. The mere existence of this capability is, by definition, a systemic weakness.

Designated Communications Provider

The definition, under the new law, of a designated communications provider is immensely broad. Besides the obvious impact on Australian-based companies and those having physical operations in Australia, it also includes any telecommunication carrier, system, intermediaries, service providers, equipment, and any electronic services, including any websites, used by one or more persons in Australia.

By this definition, the investigation of any global system by an officer of the ASIO automatically means that at least one person in Australia is using the system. This provision of the law already caused a global reaction that generated statements from many companies domiciled in other countries besides Australia, saying that Australian laws do not apply to them.

The Technical Paradox of Encryption

Encryption only works if there is no backdoor capability to get around it. In a seminal academic white paper entitled “Key Under Doormats,” published on July 7, 2015, by Professor Harold Abelson of MIT along with the input of 14 peers, the strong evidence-based case against forcing an insecure vulnerability into encryption schemes is clearly presented. Giving the Australian government access to private conversations is the same as, by design, creating an invitation to exploit this access, which makes the entire encryption scheme vulnerable.

Conclusion

The new Australian legislation makes the Australian government seem like wanting to join the ranks of totalitarian governments like Russia, China, and North Korea that have made the use of encryption illegal in those countries. The unintended result may be a global backlash against Australia. This may leave the country in technological isolation from the rest of the world.

It is not only criminals that use encryption. Many find that unbreakable encryption is useful for all kinds of important private transactions such as online banking and financial exchanges. People have the fundamental right to secured communications for many valid reasons. For example, encryption can prevent the loss of many billions due to cybersecurity breaches, protect private medical records, and prevent the theft of intellectual property.

Allowing any government the ability to get around encryption means that criminals will likely find a way to get around it as well. It is quite possible that there are criminals working for the government too. In other words, the new Australian law might actually help criminals when considering the total impact.

The trend in most of the rest of the world is to use more robust encryption, not less. Hopefully, when the Australian legislators come back into session they will have time to give these issues a much more detailed evaluation and add many amendments to improve this seriously-flawed bill.

February 12, 2019February 12, 2019

Business Insights With Visio and Power BI

Microsoft’s Visio Visual and Power BI are two extremely useful software tools that help business owners store, organize, and interpret data with easy-to-understand visual representations.

Using these tools can take your business to the next level. Still, many business owners don’t know about Visio Visual or Power BI. Moreover, many are skeptical as to why data interpretation is important at all.

Why is data interpretation so crucial to your business?

As a business owner, it is vital that you understand the “big picture” of your company’s data. Any given company will have a plethora of diverse data at any given time. This may include:

Sales records, recorded by the hour, day, week, month, and year
Sales records by location
Sales records by department
Floor plans of stores, warehouses, offices, and more
Employee information
Subscriber or client information
Inventory data
And more

Storing all of this data and never looking at it will inevitably hurt your business. Doing this almost certainly means missing the “big picture” and subsequent opportunities for growth and improvement.

How can Visio Visual and Power BI help?

Here are the biggest reasons companies don’t examine, analyze, and interpret their data more often (or at all):

1. They have too much of it.

2. It’s difficult to organize and understand.

This is where tools like Visio Visual and Power BI step in. Both tools create easy-to-see and understand visual representations of your data, with the goal of targeting what’s working and what’s not.

What is Microsoft Visio?

From flow charts and 3D graphs to network schemas and floorplans, Microsoft Visio Visual is one of the most capable pieces of software for creating and manipulating diagrams of all kinds.

What is Microsoft Power BI?

Power BI is another indispensable Microsoft tool that allows businesses to analyze their data in a variety of ways and see and share insights via the dashboard. Everything on Power BI is updated in real time and can be accessed from anywhere in the world via the cloud. This software includes a myriad of invaluable features for analyzing, fixing, and understanding data.

What can you learn from your data with Visio Visual and Power BI?

We know that Visio Visual and Power BI allow you to see your data clearly and concisely. This starts with using Visio Visual creating the necessary charts and diagrams that pertain to your industry.

From this data, the goal is to learn what’s going wrong and why, what’s going right and why, and where you need improvement. For example:

If you own a retail establishment, what’s selling and what’s not?
If you own a restaurant, what ingredients are you constantly running out of?
If you own a transportation business, why are your trucks stocked to the brim one month and empty the next?

This is largely Power BI’s job.

Power BI layers the base data organized by Visio Visual with analytic tools that share insights about how your business is doing across numerous benchmarks.

Empowered with the information and data-based insights both Microsoft Visio Visual and Power BI provide, you can make impactful changes in how you run your business. Try these tools today and see what you think for yourself!