Archive for RB

| April 16, 2016
Comments Off on Hey Lobbying Tech Spender

Hey Lobbying Tech Spender

-Update 04-26-2016- As if to prove my point, Democratic Presidential candidate Bernie Sanders just named Verizon one of America’s Top Ten Tax Avoiders. VZ has a corporate tax rate of -2% for the last 6 years according to the post. Verizon has the #4 lobbying spender.

Hey Lobbying Tech SpenderJust in time for the U.S. tax deadline, the Business Insider has a report which details the amount of money the tech titans spent on bribing lobbying the politicians in DC. Thanks to one of the small bits of transparency in the gooberment, the U.S. House of Representatives requires companies to file government lobbying records. You can search their disclosures here at the Office of the Clerk of the House. (rb- Use this while you can, it’s likely to be shut down at any time by politicians with things to hide.)

Amazon was the most aggressive tech lobbyist in 2015The most aggressive tech spender on lobbying in 2015 was Amazon (AMZN) according to research by Consumer Watchdog. The company spent $9.07 million (a company record) on lobbying in 2015, an incredible 91.4% surge from its 2014 spend dedicated to influencing federal regulations last year according to BI.

Amazon lobbied Washington about

tech firms spent over $122M lobbying Washington politiciansDespite Amazon’s aggressive lobbying, Google (GOOG) topped the list of tech companies for the second year in a row. Google spent $16.6 million in 2015 vs $16.83 million in 2014. The biggest spending tech firms spent over $122M lobbying Washington politicians.

How the tech titans spent their money

  1. Google: $16.6 million in 2015 vs $16.83M in 2014.
  2. Comcast (CMCSA): $15.63 million vs $16.8M in 2014
  3. AT&T (T): $14.86 million, up from $14.56M in 2014
  4. Verizon (VZ): $11.43 million, up 1.9% from $11.22M in 2014.
  5. Facebook (FB): $9.85 million from $9.34M in 2014, a company record.
  6. Amazon (AMZB): $9.07 million up 91.4% from 2014 .
  7. Microsoft (MSFT): $8.49 million vs $8.33M in 2014.
  8. Time Warner Cable (TWC): $6.8 million in 2015, down 13.2% from 2014.
  9. T-Mobile (TMUS) $6.14 million, up 1.7% from 2014.
  10. Apple (AAPL): $4.48 million in 2015 compared to $4.11M in 2014.
  11. IBM (IBM): $4.63 million, a 6.5% decrease from $4.9M in 2014.
  12. Intel (INTC): $4.55 million in 2015, up 19.7% from $3.80M in 2014.
  13. Oracle (ORCL): $4.46 million in 2015, down 23.5% from $5.83M in 2014.
  14. Cisco (CSCO): $2.69 million compared to $2.35M in 2014.
  15. Yahoo (YHOO): $2.84 million in 2015 vs $2.94M in 2014.

Tech titans with boxes of meney for politicansBI reminds us that these may seem like big numbers, they’re a tiny part of these companies’ overall expenditures — in the third quarter of 2015, Google spent $3.47 billion on traffic acquisition costs (such as the price of its deal to stay the default search on Apple’s iPhone), and another $6.93 billion on other operating expenses.

rb-

I haven’t written about the tech’s industry lobbying efforts since 2010. Many of the names have remained the same, ATT, Verizon, Google, IBM, Yahoo, and Intel have been bribing lobbying the gooberment for a very long time.

However, just 5 years ago, Apple and Facebook were barely in the lobbying racket.  In 2015, they both ranked at the top in lobbying spending.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , , , , ,
| April 7, 2016
Comments Off on 9 Emails You Should Never Open

9 Emails You Should Never Open

9 Emails You Should Never OpenThe increasing pace of life coupled with mobile computing which bombards us with emails and messages, from more sources, and across more devices than ever before has created what Proofpoint calls a generation of trigger-happy clickers.

fake emails from cyber criminals.Trigger-happy clickers are falling more and more for fake emails from cybercriminals. These fake emails are so convincing and compelling that they fool 10% of recipients into clicking on the malicious link according to the article. To put that into context a legitimate marketing department typically expects <2% click rate on their advertising campaigns.

So, despite the best efforts of security professionals, too many people are still falling prey to email scams at home and work. Whether it’s a get-rich-quick scheme or a sophisticated spearphishing attack, here are some emails to steer clear of:

1. The government scam

These emails look as if they come from government agencies, such as the IRS, FBI, or CIA. If these TLA’s want to get a hold of you, it won’t be through email.

2. The “long-lost friend”

tries to make you think you know themThis scammer tries to make you think you know them, but it might also be a contact of yours that was hacked.

3. The billing issue

These emails typically come in the form of legitimate-looking communications. If you catch one of these, log into your member account on the website or call the call center.

4. The expiration date

A company claims your account is about to expire, and you must sign in to keep your data. Again, sign in directly to the member website instead of clicking a link in the email.

5. You’re infected

you’re infected with a virusA message claims you’re infected with a virus. Simple fix: Just run your antivirus and check. In a recent twist, scammers claiming to be computer techs associated with well-known companies like Microsoft. They say that they’ve detected viruses or other malware on your computer to trick you into giving them remote access or paying for software you don’t need.

Scammers have been peddling bogus security software for years. They set up fake websites, offer free “security” scans, and send alarming messages to try to convince you that your computer is infected with malware. Then, they try to sell you software to fix the problem. At best, the software is worthless or available elsewhere for free. At worst, it could be malware — software designed to give criminals access to your computer and your personal information.

But wait it gets worse – If you paid for their “tech support” you could later get a call about a refund. The refund scam works like this: Several months after the purchase, someone might call to ask if you were happy with the service. When you say you weren’t, the scammer offers a refund.

Or the caller may say that the company is going out of business and providing refunds for “warranties” and other services.

The scammers eventually ask for a bank or credit card account number. Or they ask you to create a Western Union account. They might even ask for remote access to your computer to help you fill out the necessary forms. But instead of putting money in your account, the scammers withdraw money from your account.

6. You’ve won

you won a contest you never enteredClaims you won a contest you never entered. You’re not that lucky; delete it. It’s illegal to play a foreign lottery. Any letter or email from a lottery or sweepstakes that ask you to pay taxes, fees, shipping, or insurance to claim your prize is a scam.

Some scammers ask you to send the money through a wire transfer. That’s because wire transfers are efficient: your money is transferred and available for pick up very quickly. Once it’s transferred, it’s gone. Others ask you to send a check or pay for your supposed winnings with a credit card. The reason: they use your bank account numbers to withdraw funds without your approval, or your credit card numbers to run up charges.

7. The bank notification

An email claiming some type of deposit or withdrawal. Give the bank a call to be safe.

8. Playing the victim

emails make you out to be the bad guyThese emails make you out to be the bad guy and claim you hurt them in some way. Ignore.

9. The security check

A very common phishing scam where a company just wants you to “verify your account.” Companies almost never ask you to do this via email.

What To Do Instead of Clicking Links

In the case of your bank or other institution, just go to the website yourself and log in. Type in the address manually in the browser or click your bookmark. That way you can see if there’s something that needs taken care of without the risk of ending up on a phishing site.

In the case of your friend’s email, chances are that they copied/pasted the link into the message. That means you can see the full address. You can just copy/paste the address into the browser yourself without clicking anything. Of course, before doing that make sure you recognize the website and that it’s not misspelled.

Proofpoint’s bottom line is that unless you explicitly know and trust it, avoid it. That’s all there is to it. Make this a habit and you can avoid one of the biggest mistakes in internet safety.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , , , , , , , ,
| April 2, 2016
Comments Off on 9 Techs That Could Replace Your Passwords

9 Techs That Could Replace Your Passwords

9 Techs That Could Replace Your PasswordsFollowers of the Bach Seat know that passwords suck. I have covered alternatives to the password as far back as 2010 and here and here. Now the Business Insider lists nine crazy alternatives to passwords. The article describes efforts around the globe to develop new gadgets and technology that can save you from the headache of memorizing (and inevitably forgetting) passwords.

BiometricsThe article calls out several ways to replace passwords to authenticate a user. Users can be authenticated based on a physical trait or biometrics. Biometrics is the measurement and statistical analysis of people’s physical and behavioral characteristics. Biometrics can offer one of the independent credentials required for multifactor authentication (MFA). MFA combines two or more independent credentials. What the user knows (password). What the user has (security token) and what the user is (biometric verification).

How to replace passwords

Selfies – This might be the password of choice for the Facebook (FB) generation. Companies like Amazon (AMZN) and Mastercard (MA) are already considering selfies. The technology would ask users to snap pictures of their faces on a smartphone before making a transaction. Mastercard’s technology would need a user to blink before their face is scanned. This is a safeguard to prevent hackers from simply placing a picture of someone else in front of the camera.

SelfiesEdible pills – Swallowing pills might be one of the few things more annoying than memorizing passwords. But some researchers think it’s the future. After mixing with stomach acids the pill would emit a unique, low power signal that connects with your PC. Google (GOOG) VP of Advanced Technology and Projects Regina Dugan described such a system a few years ago. According to Ms. Dugan, a person could safely ingest 30 pills every day for the rest of their lives.

Your gait – Going for a stroll might not sound like the most convenient way to log on to your computer. But the way you walk has some unique traits that could serve as a means of authentication. A wearable device, like a bracelet or anklet, could record your physical activity and use that information as a password the next time you need to log on. One study reportedly analyzed the foot pressure patterns and achieved a 99.6 percent accuracy rate. rb- I covered the now-defunct Alohar Mobile attempt to turn how you stroll into a password here.

Your earYour ear cavity – Has anyone ever told you your ear canal is one of a kind? NEC does. They are developing special earbuds, that bounce a sound into your ear’s cavity. They then use the reverberations as a signature to identify you. NEC hopes to have these available within a few years. Another study was able to achieve a 99.6% accuracy rate identifying individuals by analyzing how light reflects off the curves of the ears. rb- Back in 2014 I covered the Descartes Biometrics app that used the shape of your ear as a password.

Your backside – The shape and contours of your posterior are special. So special that some researchers in Japan have explored whether a seat mat could be used to identify you. The experimental mat is packed with special sensors that measure pressure distribution. The mat could be integrated into cars, to prevent unauthorized sitters from driving off with the vehicle.

TattoosTattoos – Google’s Regina Dugan showed off a sticker-like wearable tattoo on her arm a few years ago that she said could be used to unlock a phone or computer. The tattoo, which was only an experimental prototype, was made of flexible circuits and sensors, and could be worn for up to a week, she explained. No word on whether you can get the password tattoo in the design of a fire-breathing dragon.

Your Jewelry – Wearable gadgets like the Fitbit and Apple Watch can already track your sleep and the steps you take. The next step is to track the pattern of your pulse or heart rate, as the Nymi band does, and use that information to identify you. rb- I covered the Nymi earlier and we have seen that the iWatch and other wearables are not secure so how can they log you?

Your voiceYour voice – Nothing is easier than saying a few words, and even the best impersonator can’t perfectly mimic another person’s voice. That’s why one big bank in Britain recently set up technology to identify customers on the phone or online by the sound of their voice. And yes, the system will still work if you have a cold.

Implants – This one is only for hardcore security geeks. Believe it or not, some people have already experimented with embedding a small RFID chip under their skin. The chip emits a radio signal that can theoretically be used to do everything from unlocking the door to an office and starting a car, to logging on to email.

rb-

The biggest problem with biometrics is getting people to use them. How many do you know would be willing to swallow a pill to log in to each of their websites? It is a voluntary decision to swallow pills to log in to Facebook, Instagram, or Google. What if your employer requires you to swallow pills to enter the building, login to Windows, your email, ERP, CRM, HR. What are the implications for privacy? Healthcare? Plumbing?

I wrote about the problems of adapting an eye-based biometric system back in 2012.

The end-user will be the fundamental roadblock to any eye-based biometrics. Traditionally, anything related to eye recognition has received strong resistance, because it is just human nature to be squeamish about having our eyes scanned.

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , ,
| March 23, 2016
Comments Off on Fake Fingerprints Can Open Your Phone

Fake Fingerprints Can Open Your Phone

– Updated 03-30-2016 – The Business Insider proves that you can use Play-Doh to fool the fingerprint sensor in your Phone.

—

Fake Fingerprints Open GalaxyI have pointed out a number of times that biometrics will not be the complete final solution for passwords. Biometrics is the measurement and statistical analysis of people’s physical and behavioral characteristics. The technology is mainly used for identification and access control. The basic premise of biometric authentication is that everyone is unique. An individual can be identified by his or her intrinsic physical or behavioral traits.

Fake Fingerprints Can Open Your PhoneThere is a huge issue with biometrics.  You can’t change your intrinsic physical or behavioral traits if they get stolen or hacked. Well, now there is more proof that biometrics can be hacked without cutting off a finger.

Hack mobile phone authentication

Two smarty Sparty’s from Michigan State University’s biometrics group has figured out a way to hack mobile phone fingerprint authentication. According to Help Net Security, the MSU researchers can hack your secure phone by using just a scanner, a color inkjet printer, a special type of paper, and ink.

AgIC silver conductive ink cartridgesTurns out that the attack is easy to execute. The first step is to scan the target’s fingerprint image at 300 dpi or higher resolution. Then, the image is mirrored and the original or binarized fingerprint image is printed on the glossy side of an AgIC special paper. The printer uses AgIC silver conductive ink cartridges (along with normal black ink).

Magical conductive ink

CrunchBase explains that advances in material science have made it possible to manufacture almost magical conductive ink. AgIC silver conductive ink has tiny silver particles and can be purchased online. The ink is printed by standard Brother printers. The ink dries in a few seconds and conductivity emerges instantly when the traces are drawn on special photo inkjet printing paper also available online.

spoofed fingerprintAll in all, an attacker can have a spoofed fingerprint that would allow him to access a phone protected with fingerprint authentication in less than 15 minutes, and the cost of all the tools he needs to do this does not surpass $500.

Researchers Kai Cao and Anil Jain successfully managed to fool the fingerprint sensors on the Samsung (005930) Galaxy S6 and Huawei (002502) Hornor 7 phones.

They posted a demo of the attack on YouTube:

 

The attack is an improvement over Germany’s Chaos Computer Club’s attack against Apple (AAPL) Touch ID on iPhone 5S by lifting a fingerprint of the genuine user of a glass surface and then making a spoof fingerprint. More details about the Michigan State researchers’ work can be found here (PDF).

Only a matter of time

Starbucks app hackedThe Sparty researchers note that not all mobile phones can be hacked using this method. But their experiment is proof of the urgent need for anti-spoofing techniques for fingerprint recognition systems, especially for mobile devices which are being increasingly used as a part of two-factor authentication for site access and payment processing like Apple Pay, Google (GOOG) Pay, or Samsung Pay.

The researchers warn that it is only a matter of time before hackers develop improved hacking strategies not just for fingerprints, but other biometric traits that are being adopted for mobile phones (e.g., face, iris, and voice).

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , , , ,
| March 18, 2016
Comments Off on Michigan Leader in SPAM

Michigan Leader in SPAM

Michigan Leader in SPAMIn a surprise finding, the New Jersey based anit-malware company Comodo’s Threat Research Labs found that Michigan is one of the leading sources of unsolicited e-mail on the Internet. Unsolicited bulk email is also known as “SPAM.” SPAM is usually considered junk e-mail. The Great Lake state ranked third behind California and New York in spewing out the most SPAM.

MichiganThe Comodo researchers examined all the emails Comodo filtered for customers in the second half of 2015, specifically looking at SPAM. In doing their research, they conducted an IP address analysis of the millions of pieces of email SPAM that came into the Threat Research Labs from their customers.

Through this analysis, researchers have been able to break down SPAM by state and find where it originated from. IP addresses from California (24.37%) and New York (22.36%) sent nearly half of the spam Comodo filtered, while Utah (19.42%), Michigan (10.79%), and New Jersey (3.68%) IP addresses rounded out the top five states.

Comodo State SPAM Map

Fatih Orhan, Director of Technology and lead at the Comodo Threat Research Labs said:

California and New York were not really surprising in terms of the top two states because of population and technology innovation taking place in those geographies — but finding Utah and Michigan in the top five was somewhat shocking

rb-

I have followed the battle against SPAM since 2009. Here are some tips to help protect yourself from SPAM

  • Keep your Junk E-mail Filter updated

Updates are available at Downloads on Office Online. Under Office Update, click Check for Updates.

  • Block images in HTML messages that spammers use as Web beacons

By default, Outlook is set to block automatic picture downloads. To verify your settings are, on the Tools menu, click Options. Click the Security tab, and then click Change Automatic Download Settings. Verify that the Don’t download pictures or other content automatically in HTML e-mail check box is selected.

  • Watch out for checkboxes that are already selected

When you buy things online, companies sometimes add a check box (already selected!) to indicate that it is fine to sell or give your e-mail address to other businesses. Clear the check box so that your e-mail address won’t be shared.

  • DO NOT sign up for commercial mailing lists.
  • DO NOT reply to email or unsubscribe from a mailing list that you did not explicitly sign up for.
  • Configure your email client to send and receive emails in Plain Text or Rich Text Format.

For Microsoft Outlook go to: Tools > Options… and click the Mail Format Tab. Change your Message format to Text Click OK.

Lest we forget, this is the same Comodo that was responsible for releasing 9 fraudulent certificates onto the Internet which, Sophos says impacted the trusted root authority on all default Windows and OS X installations, as well as high-profile websites like:
• mail.google.com
• www.google.com
• login.yahoo.com (3 certificates)
• login.skype.com
• addons.mozilla.org

Sophos states that this breach allowed an attacker to easily masquerade a malicious website as one of the above with the HTTPS authentication succeeding.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , ,
« Older Entries   Recent Entries »