Archive for RB

KOSA: A Bad Idea for Online Safety

KOSA: A Bad Idea for Online SafetyThe Kids Online Safety Act, known as KOSA, is another half-assed publicity grab. The politicians fail to address the root cause of the problem – data collection. We can all agree that social media is bad for kids. There is enough proof from multiple studies and former social media company employees. Therefore, KOSA is not the answer. It will infringe on the rights and interests of all internet users.

Kids Online Safety Act

Two-tier Internet in the U.S.To begin with, the Kids Online Safety Act, known as KOSA introduced by Senators Richard Blumenthal (D) and Marsha Blackburn (R), would establish a two-tier Internet in the U.S. The bill requires that sites that are ‘likely to be accessed by kids‘ act in the “best interest of users who are 16 or younger.” That means that all platforms would be responsible for mitigating the risk of physical or emotional harm to young users. This includes “the promotion of self-harm or suicide, encouragement of addictive behavior, enabling of online bullying or predatory marketing.” Sound nice; however, KOSA is not the solution we need. Here are some of the reasons to oppose KOSA:

Kids Online Safety Act safety

The KOSA requirements would mandate that platforms have parental controls. These government-mandated controls could be harmful to kids in abusive situations. According to Fight for the Future, a coalition of over 50 civil society groups, “KOSA risks subjecting teens who are experiencing domestic violence and parental abuse to additional forms of digital surveillance and control that could prevent these vulnerable youth from reaching out for help or support.

Additionally, the KOSA requirements would endanger VPNs (one of the government’s favorite boogey-techs). The group wrote; “… by creating strong incentives to filter and enable parental control over the content minors can access, KOSA could also jeopardize young people’s access to end-to-end encrypted technologies, which they depend on to access resources related to mental health and to keep their data safe from bad actors.”

KOSA is government censorship

seeking to make political pointsKOSA would give the President control over what people see online. The government would create a “Kids Online Safety Council” that would advise the government on implementing and enforcing KOSA. As a result, the legislation’s requirement to restrict access to topics such as sex education, LGBTQ issues, and mental health from minors could cause platforms KOSA could force platforms to self-censor just to avoid the hassle and costs.

Furthermore, Fight for the Future writes that censorship would be politically driven. “Online services would face substantial pressure to over-moderate, including from state Attorneys General seeking to make political points… KOSA would cut off another vital avenue of access to information for vulnerable youth.”

KOSA encourages more data collection

incentivize sites to collect even more informationAccording to Fight for the Future, the bill would incentivize sites to collect even more information about children to verify their ages and place further restrictions on minors’ accounts. They explain,

“Age verification may require users to provide platforms with personally identifiable information such as date of birth and government-issued identification documents, which can threaten users’ privacy, including through the risk of data breaches, and chill their willingness to access sensitive information online because they cannot do so anonymously.”

Therefore, they conclude, “Rather than age-gating privacy settings and safety tools to apply only to minors, Congress should focus on ensuring that all users, regardless of age, benefit from strong privacy protections by passing comprehensive privacy legislation.”

Kids Online Safety Act unintended consequences

unintended consequencesKOSA would also create unintended consequences. The unintended consequences include driving children to use less secure or more harmful platforms. The Kids Online Safety Act would make kids more vulnerable to online predators who could exploit their age verification information. It would also undermine the trust and communication between children and parents, as well as between platforms and users.

rb-

There are valid concerns about the impact of social media on us all. But the Kids Online Safety Act misses the point. Congress should be targeting data collection. Nearly all social media platforms and online businesses collect personal data from their users. The EFF points out that all social media firms harvest and monetize our personal data and incentivize other online businesses to do the same. The result is that detailed information about us is widely available to purchasers, thieves, and government subpoenas.

Consider location data brokers, for example. Our apps collect detailed records of our online activities without our knowledge or genuine consent. The app developers sell it to data brokers, who will in turn sell it to anyone who will pay for it. An election denier bought it to try to prove voting fraud. One broker sold data on who had visited reproductive health facilities.

If a bad actor or the government wanted to buy this data, it could probably find a way to do so. Collecting more data will not stop the bad actors from acquiring PII.

The better approach is to limit how all businesses collect personal data. This would de-incentive data collection and reduce the supply of data for bad actors.

Everybody should be allowed to make informed choices based on their own values and preferences.

 

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Independence Day 2023

Celebrate Independence Day
Have
a blast this Fourth of JulyIndependence Day 2023

 

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

 

ChatGPT Hacking: What You Need to Know and Do

ChatGPT Hacking: What You Need to Know and DoChatGPT is an artificial intelligence chatbot. It can interact with users in a conversational way. It is powered by a large language model called GPT-4. GPT-4 can understand and generate natural language responses based on user prompts. People can use ChatGPT for various purposes, such as getting information, entertainment, education, or productivity. ChatGPT is reportedly the fastest-growing consumer application in history. 

Hackers are going after ChatGPTThe artificial intelligent chatbot from OpenAI has been the cool kid on the tech block since November 2022. Followers of the Bach Seat are smart enough to know what that means. Hackers are going after ChatGPT. Recent reports from cybersecurity researcher Group-IB have found over 100,000 ChatGPT logins for sale on the dark-web.

Attractive to attackers

The AI is using you to learn more things. Every time you interact with it, ChatGPT gathers more info about you. Unlike Google, which collects data on what you are doing, you are feeding your info into ChatGPT. The information ChatGPT gathers from you also makes its attractive to attackers.

you are feeding your info into ChatGPTDid you ask it for a strong password for your checking account? ChatGPT remembers.

Did you ask it about a medical condition? ChatGPT remembers it and added it to its “intelligence.”

Did you ask it to proofread your report for the boss? ChatGPT now knows all the confidential corporate info in your report.

Information-stealing malware

Attackers want that info too. They can scoop up the data from a hacked ChatGPT account. Hackers can use the stolen data to impersonate users, access their online accounts, steal their money or assets, blackmail them, or sell their information to other criminals or advertisers.

According to the Singapore based firm, attackers are using the Raccoon information-stealing malware to scoop up ChatGPT credentials. The Raccoon malware is a subscription based crimeware that attackers can license for as little as $200.00 a month and embed in a malware laden email. 

How to protect yourself from ChatGPT hackers

The first step is to be careful about what you share with ChatGPT. Don’t give it any personal or sensitive information that you wouldn’t want anyone else to know. Remember that ChatGPT is not a human friend, but a machine that can store and process your data.

The second step is to use a strong and unique password for your ChatGPT account. Use a combination of uppercase and lowercase letters, numbers, and special characters. Avoid using easily guessable passwords or reusing passwords from other accounts. Use a password manager to generate and store complex passwords that are hard to guess or crack.

Periodically change your ChatGPT password. This will minimize the risk of unauthorized access. Avoid using the same password for an extended period and ensure new passwords are strong and unique.

The third step is to configure ChatGPT for more privacy.

Clear Your ChatGPT Conversations: To keep the information you’ve shared with ChatGPT away from attackers, regularly clear your saved ChatGPT conversations. To clear your ChatGPT conversations:

  1. ChatGPT GeneralLog in to ChatGPT.
  2. Click on your account name in the bottom left corner of the ChatGPT interface.
  3. Click Clear all chats.
  4. Click again to Confirm.

All of your saved conversations should be deleted. This can limit the amount of data stored on ChatGPT, which can help reduce the impact in case of a data breach.

Turn off chat history and model training: You can prevent ChatGPT from using your personal info to grow the AI. To disable chat history and model training,

  1. Log in to ChatGPT.
  2. Click on your account name in the bottom left corner of the ChatGPT interface. 
  3. Click Settings.
  4. Click Data Controls.
  5. Toggle Chat history & training to off.

ChatGPT says that while history is disabled, new conversations won’t be used to train and improve our models and won’t appear in the history sidebar. They do retain all conversations for 30 days to monitor for abuse.

They also point out that this will not prevent unauthorized browser add-ons or malware on your computer from storing your history.
The other limitation is that this setting does not sync across browsers or devices. You will have to enable it in each device.

Another step is to monitor your ChatGPT activity and report any suspicious or unauthorized actions. You can check your chat history and settings on the ChatGPT website or app. If you notice anything unusual, such as messages you didn’t send or changes you didn’t make, contact ChatGPT support immediately and change your password.

Finally, educate yourself and others about the risks and benefits of using ChatGPT. Read the terms of service and privacy policy of ChatGPT before using it. Learn how ChatGPT works and what it can and can’t do. Share this blog post with your friends and family who use ChatGPT and help them stay safe online.

Where is MFA?

Multi-factor authentication is the gold standard for securing your online accounts. You should enable 2FA whenever possible. 2FA adds an extra layer of security by requiring an additional verification step, such as a unique code sent to a mobile device, to access the account. But ChatGPT does not offer this basic security tool.

rb-

We have seen this list after years and years of preaching account security. ChatGPT should receive the same level of attention you give to other sensitive accounts like your email, take the necessary steps to protect your ChatGPT account and yourself.

ChatGPT is an amazing technology that can enrich our lives and experiences. But like any other technology, it comes with some challenges and dangers that we need to be aware of and prepared for. By following these steps, you can enjoy chatting with ChatGPT without compromising your security or privacy.


How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

UEFI Malware: The Silent Threat to Your PC

UEFI Malware: The Silent Threat to Your PCHackers have been compromising PCs with UEFI malware and your anti-virus software doesn’t know it. Cybersecurity firm Eclypsium has detected an ongoing campaign that targets motherboards manufactured by Taiwan based Gigabyte Technologies (2376). The attacks use a hidden backdoor installed by Gigabyte which is being exploited by attackers.

millions of Gigabyte motherboardsThe flaw impacts up to millions of Gigabyte motherboards. The flaw goes back to the AMD 400-series chipsets up to the latest Intel 700-series or AMD 600-series motherboards. Eclypsium found that every time a computer with an affected Gigabyte motherboard (PDF) restarts, its firmware silently runs an update program which downloads and launches another piece of software. While this is meant to keep your PC hardware up to date, Eclypsium says the hidden code implemented insecurely, it can use an HTTP connection, potentially allowing the mechanism to be hijacked and used to install malware instead of Gigabyte’s intended program.

Because the updater program is triggered from the computer’s UEFI firmware, it loads before Windows loads, making it difficult to detect or remove. UEFI stands for Unified Extensible Firmware Interface, and it is the software that runs before the operating system starts. By running before the operating system, any planted malware can bypass security mechanisms such as Secure Boot and antivirus scans. UEFI malware can also persist across operating system reinstalls or hard drive replacements, making it difficult to detect and remove.

How to determine if your PC has UEFI malware

There are a few steps you can take to check for signs of infection:

  1. Use the command prompt to check the motherboard model. Open the Command Prompt from the Start Menu, and type in:
wmic baseboard get product,Manufacturer

Windows will return the manufacturer and Product.

Command prompt

2. If the command prompt freaks you out, you can use the Windows GUI to find you motherboard’s manufacturer. From the Start menu type “System Information” into the search bar and bring up the System Information app.

System information
The System Information page will display. BaseBoard Manufacturer is the motherboard manufacturer, and BaseBoard Product is the name of the motherboard.



3.If neither of these options work, you can try a 3rd party utility. HWInfo, and CPU-Z are popular 3rd party tools that can determine the manufacturer of your motherboard.

What to look for

Some UEFI malware may cause noticeable changes in your system performance, stability, or functionality. For example, you may experience frequent crashes, blue screens, boot errors, slow boot times, missing files, network issues, or unexpected pop-ups. These symptoms may also be caused by other factors, so they are not conclusive evidence of infection, but they can be indicators that something is wrong.

What to do if you have UEFI malware

If you suspect that your PC has UEFI malware, you should take immediate action to remove it and prevent further damage. The best way to do this is to reset or reflash the firmware using a trusted source from your device manufacturer. This will overwrite the malicious code and restore the original firmware. However, this process can be risky and complex, and it may require physical access to the device or special tools. You should carefully follow the instructions from your device manufacturer and back up your data before attempting this procedure.

How do I prevent UEFI malware?

The first step is to dig into you BIOS and set a BIOS password. This will help prevent any future changes without your knowledge. If getting into the BIOS makes you nervous, you can use software.

Some antivirus systems include a UEFI scanner. For example, Microsoft Defender ATP has a UEFI scanner that brings its protection capabilities to the firmware level. Another example is Kaspersky Anti-Virus for UEFI (KUEFI) Kaspersky says KUEFI provides effective protection from rootkits and bootkits and ensures safe OS loading.

These tools detect a threat, they will alert you and provide instructions on how to repair the firmware. However, not all antivirus programs have this feature, and some UEFI malware may evade detection by hiding or encrypting itself.

Gigabyte has released an update to close the hole.

rb-

UEFI malware can compromise your system security and privacy. To protect yourself from this type of attack, you should:

  1. Keep your firmware and operating system updated with the latest patches and security fixes.
  2. Use a reliable antivirus program that can scan and protect your firmware as well as your files.
  3. Avoid opening suspicious attachments or links from unknown sources.
  4. Be careful when downloading or installing software from untrusted websites.

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

A Coffee Nap Can Boost Your Energy

A Coffee Nap Can Boost Your EnergyThe next time you need a power nap to make it through another long day, try a coffee nap. A coffee nap combines to of my favorite things, coffee and a nap. A coffee nap involves drinking a cup of coffee and then taking a short nap of 15 to 20 minutes. This combination can help you feel more alert and refreshed than just having a coffee or a nap alone.

How does a coffee nap work?

caffeine to reach your brainA coffee nap works by taking advantage of the way caffeine and sleep interact with a chemical in your brain called adenosine. Adenosine is a neurotransmitter that signals tiredness and promotes sleep. As you go through the day, adenosine levels build up in your brain, making you feel sleepy. When you sleep, your brain clears out adenosine, making you feel more awake.

Caffeine is a stimulant that blocks the effects of adenosine by binding to the same receptors in your brain. This means that when you drink coffee, you feel more awake and energized. However, it takes about 15 to 20 minutes for caffeine to reach your brain after you drink it. This is where the nap comes in.

adenosineBy drinking coffee quickly and then taking a short nap, you can make better use of the waiting time for the caffeine to kick in. During your nap, your brain will clear some of the adenosine, making more receptors available for caffeine. When you wake up, you will have less adenosine and more caffeine in your brain. This gives you a  double boost of feeling less tired and more alert.

The benefits of coffee naps

Coffee naps have been shown to improve various aspects of cognitive performance, such as reaction time, memory, attention, and learning. They can also help you overcome the post-lunch dip that many people experience in the afternoon. Coffee naps are especially useful for people who are sleep-deprived or work night shifts, as they can help them stay awake and alert.

Coffee naps are especially usefulOne study found that drivers who consumed 200 milligrams of caffeine (about two cups of coffee) before taking a 15-minute nap performed better. Another study showed that those who took coffee naps had better memory recall than those who only had coffee or napped.

Another study showed that participants who drank 200 milligrams of caffeine before taking a 20-minute nap were more energized and performed better on computer tasks than those who just took a nap; took a nap and then washed their face; took a nap and then were exposed to bright light upon waking; and those who just rested.

How to take a coffee nap

How to Boost Your Energy with a Coffee NapTo take a coffee nap, follow these steps:

Drink a cup of coffee quickly. You can use any type of coffee, but avoid adding sugar or milk as they may slow down the absorption of caffeine.
Set an alarm for 15 to 20 minutes and lie down in a comfortable and quiet place. Try to fall asleep as soon as possible. If you can’t fall asleep, just relax and close your eyes.
– Wake up when your alarm goes off and enjoy the benefits of your coffee nap.

Tips to make your coffee nap more effective

– Avoid taking coffee naps later than six hours before bedtime, as caffeine can interfere with your night’s sleep.
– Avoid napping for longer than 20 minutes, as you may enter deep sleep and feel groggy when you wake up.
– Experiment with different amounts of caffeine and nap durations to find what works best for you.

rb-

A coffee nap is a simple technique that can help you boost your energy and performance during the day. By drinking coffee before taking a short nap, you can enhance the effects of both caffeine and sleep on your brain. Coffee naps can improve your alertness, memory, reaction time, and mood. Try it out next time you need a power nap and see how it works for you.

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.