Archive for 2020

Epic Games Announces “#FreeFortnite Cup” With Non-Apple Devices As Prizes

Posted in Commentary with tags on August 21, 2020 by itnerd

I don’t know who runs Epic Games PR department, but this announcement of the “#FreeFortnite Cup” in my mind seems kind of weird.

Epic is inviting Fortnite players to join in a worldwide tournament this Sunday, in protest of Apple’s decision to remove Fortnite from the iOS App Store. The gaming company will offer up prizes like an in-game outfit and a physical “Free Fortnite” hat to hardware such as Alienware laptops, Samsung Galaxy Tab S7 tablets, OnePlus 8 phones, and Xbox One X and Nintendo Switch gaming systems.

For those of you keeping score at home, those are all devices that can still run Fotnite. Or in the case of the OnePlus 8 can sideload Fortnite.

This is important to Epic Games because iOS users will be effectively left behind when Chapter 2 – Season 4 launches on August 27. That’s due to the fact that Epic can’t push the update to iOS users. So if you bought one of those iPhones off eBay with Fortnite installed, you wasted your money. Android users on the other hand can in theory still sideload the update.

This is very weird. It’s as if Epic Games is scrambling to stay relevant somehow. Yes Apple has likely gone too far by targeting the Unreal Engine that Epic Games makes. But Epic Games has really tried to push its agenda here in ways that are questionable. And I have to wonder if this is going to blow up in their face at some point. We’ll have to see what happens.

A CANADIAN Support Document Has Been Found Referencing The Apple Card…. A Sign Of Things To Come?

Posted in Commentary with tags on August 21, 2020 by itnerd

The folks at iPhone In Canada posted an article on the Apple Card yesterday and whether it is coming to Canada or not. In that story they referenced a support document that is on Apple Canada site that details how to apply for the card. Here’s a picture of the document in case Apple nukes it:

You’ll note that I circled the URL bar. Here’s a closer look:

Okay… So this is coming from the Apple Canada website. Interesting. But this could simply be a mistake rather than a sign that the Apple Card is coming to Canada. After all, I was tracking a story about Apple Cash coming to Canada where I saw signs of it on my Apple Watch back in 2018. But that didn’t pan out. So I decided to try and debunk this. I decided to go to the UK Apple site as well as a few other geographies. I could not find this document on anything other than the US and Canadian websites.

That’s interesting.

Now this could be mistake by Apple as they have been known to make mistakes like this. And if Apple deletes it, then we’ll know that this is the case. But it is possible that iPhone In Canada is on to something. We’ll just have to watch this space to find out more.

BREAKING: Former Uber Exec Facing Charges In Relation To 2016 Data Breach

Posted in Commentary with tags on August 20, 2020 by itnerd

The news is breaking that the Justice Department has charged Uber’s former chief security officer with obstruction of justice over his handling of a 2016 data breach:

The criminal charges filed in U.S. District Court in San Francisco against Joe Sullivan, 52, are believed to be the first against an executive stemming from a company’s response to a security incident.

But the charges drew an important distinction between failing to protect Uber’s computer network and failing to tell the authorities about it. Prosecutors said that Mr. Sullivan committed two felonies when he didn’t disclose the 2016 incident to federal investigators who were already investigating a similar data breach that had occurred two years earlier.

“When a company like Uber gets hacked, we expect good corporate citizenship, we expect prompt disclosure to the employee and consumer victims in that hack. In this case, what we saw was the exact opposite of good corporate behavior,” said David Anderson, the U.S. attorney in San Francisco, in an interview.

You can read more about this incident here.

If this guy is convicted on both charges he could face up to eight years in prison. Not a trivial amount of jail time. This should be interesting to watch as maybe Uber’s bad behavior is coming back to haunt it.

The Canada Revenue Agency Site Is Back Online…. And I Believe Their New Security Measures Are A #Fail

Posted in Commentary with tags , on August 20, 2020 by itnerd

Today the online services related to the Canadian Revenue Agency are back online for the most part. They were taken down after they were pwned by hackers using a technique called credential stuffing. Now during a news conference the Canadian Government said that they were going to mitigate this. I’ve had a look at their mitigation strategy, and I am not impressed. But I am getting ahead of myself here. Let me explain what credential stuffing is using this Wikipedia article:

Credential stuffing is a type of cyberattack where stolen account credentials typically consisting of lists of usernames and/or email addresses and the corresponding passwords (often from a data breach) are used to gain unauthorized access to user accounts through large-scale automated login requests directed against a web application.

Since the attack is automated, you have to stop the automation from being effective. The way that the Canada Revenue Agency has chosen to do this is to use a CAPTCHA like system. In short, when you log in, you’ll be required to recognize shapes or objects. Something that humans excel at, but computers suck at. Which is why this is a way of stopping an automatic attack such as credential stuffing. Here’s what I saw when I logged into the Canada Revenue Agency:

In this case, I had to pick out all the buses on this screen. There were 9 pictures of which I only had to pick out the correct three pictures. I logged in a few times and I only had to pick out three pictures every time. Which seems kind of low to me.

Here’s my main problem with this. This is not the best way to stop this kind of attack. What the Canada Revenue Agency should be doing is using multi-factor authentication. In short, multi-factor authentication requires multiple factors to verify your identity. For example, a password and a code from an app installed on your smart phone. The reason why this is better is that CAPTCHA like systems can be defeated by machine learning attacks, cheap human labor, or services on the dark web that specialize in defeating CAPTCHA like systems. Multi-factor authentication systems on the other hand requires the attacker to have all the factors in hand, or to simulate them to make an attack successful. That’s possible to do, but is way harder to pull off. Especially if a system like Microsoft Authenticator or Google Authenticator is used. Another plus is that if you out of the blue get a request to authenticate a login, and you are not logging into anything, then you know that you are potentially being hacked. Think of it of being a canary in the coal mine.

Given that the Canada Revenue Agency has been hacked multiple times, they have to do much better to protect Canadians. And I do not believe that what they have done is enough to stop the next attack. Hopefully, they improve the security of their infrastructure over time.

One other thing. If you are a Canadian with a Canada Revenue agency account, I would strongly suggest that you log in and do the following:

  • Change your password to something that is at least 8 characters long, contains upper and lower case character, and has at least one numeric character in it. And it should not be something that is used in whole or in part on another website.
  • Make sure you have an email address entered so that if your personal information is changed, you will get an email alert. That will alert you to a possible hack. You can get more info on that here here.
  • Check your account to make sure that your personal information such as baking info and address info has not been changed.

Guest Post: ESET Describes How You Can Prepare And Protect your Digital Legacy

Posted in Commentary with tags on August 20, 2020 by itnerd

In today’s world, the Internet and digital applications is woven into every day life.

From our personal lives to our careers, our digital footprint has become a big piece of our identity. And while our online presence is important to us during life, it is often left for others to deal with after we pass away. 

“I, like many people, use the Internet as a daily part of life and in ways that cause my online and offline worlds to be entwined,” says Tony Anscombe, Chief Security Evangelist for ESET. “Recent events have provoked me into thinking about creating guidance while preparing my own digital world so that, if something unexpected happens to me, those that I leave behind will be less stressed when dealing with my digital legacy.”

The important elements of a digital footprint may include, but are not limited to; financial accounts, family photographs, music collections and playlists through to social media and email accounts. Some service providers may have a broad range of services: for example, Google could be providing email, photos and cloud storage, while Spotify may be storing your favorite playlists. Accessing the data or managing the online accounts could be important both short-term: to inform people about a situation, and long-term to ensure no important data needed by those you leave behind is lost.

The suggested actions below may not cover all services or accounts, but it should constitute a good starting point for making the preparations needed to ensure your data lives on, that loved ones can gain the access needed or your right to be forgotten is observed.

Assign a digital executor

Appoint a digital executor. It’s common practice to appoint an executor in a will, someone trusted who takes care of property, finances and assets and distributes them according to your wishes. Today’s world means you may also need a digital executor to take charge of and handle digital assets – deleting, converting, downloading and managing accounts and profiles. In the same way that you list important financial assets, you may wish to list digital assets and what your specific instructions are for each one, so that there is no confusion or disagreement among the people you leave behind.

Use a password manager

Using a password manager to create a single repository where account credentials are stored has the benefit of enabling extremely complex (and hence secure) passwords to be generated, since the need to remember them all is removed; all you need to remember is one single, very strong, password to unlock the password manager. It’s also a protection against keyloggers, as they cannot monitor something that is not being typed in. Some password managers include a variety of options including creating a family plan, a file vault providing each user a secure place to store important documents and information and a variety of options for password recovery should it be needed.

Alert service providers

Make sure your loved ones know what your wishes are regarding your social media.

·       Facebook — Facebook allows you to appoint a legacy contact; this gives the nominated person the ability to memorialize the account and post a final message. The legacy contact can also delete any unwanted tribute posts, remove tags, respond to friend requests, request account deletion and such like. Be cautious, though, for they can also see all posts you made even if marked as ‘Only Me’ in the privacy settings. The instructions to assign a legacy contact on Facebook can be found here. The other option is to request deletion of the account – note, though that once deleted, access can never be regained; the details to make a deletion request can be found here.

·       Instagram – Instagram does not allow you to appoint a legacy contact. The account can bememorialized or deleted with separate online forms needing to be completed and they include the need to provide proof of death, such as a death certificate. If the request is to delete the account, it needs to be made by an immediate family member who will need to provide proof of their relationship and their authority.

·       LinkedIn – LinkedIn provides the ability to remove an account by reporting it and providing documented evidence similar to that of Instagram.

This is a delicate topic, especially during a pandemic, and I hope it prompts you to consider taking some action to make a plan, appoint a digital executor, preselect legacy and inactivity contacts or discuss with the family lawyer,” says Anscombe. “While it may be an awkward topic, a discussion directly with family members, close friends or colleagues may prove to be the most effective course of action. The important thing is to do something rather than to do nothing.” 

For more tips, please visit welivesecurity.com

Another Reason To #DeleteFacebook…. They Are A “Major Threat” To Public Health

Posted in Commentary with tags on August 20, 2020 by itnerd

Anyone who has read my blog for any length of time knows that I am no fan of Facebook. We could likely sit here all day to talk about why Facebook is bad for humanity. But it’s pretty clear by now that the planet would be better off if they didn’t exist.

Here’s a new reason why Facebook shouldn’t exist. According to a new report, Facebook’s failure to halt the spread of coronavirus misinformation makes it a “major threat” to public health:

Research by activist group Avaaz found health misinformation relating to the pandemic was viewed 3.8bn times on the social media site in the last year. Just 16 per cent of all misinformation analysed in the study carried a warning label, with the remaining 84 per cent remaining online without a warning. Facebook has vowed to crack down on conspiracy theories and misleading content linked to Covid-19 amid concerns inaccurate information was spreading unchecked on the platform. A company spokesperson said the findings of the report did not “reflect the steps we’ve taken to keep it from spreading on our service.” Facebook said it had applied warning labels to 98m pieces of content and removed a further 7m between April and June. The site added that it had also directed more than 2bn people to resources from official health authorities.

When you take that and combine that with the fact that they have changed the direction of elections, amplify anti-semitism, amplify conspiracy theories, and they don’t handle user data in a responsible manner, it really shows that Facebook is not good for the world. Especially now that not there are life and death implications because of the pandemic.

The bottom line is simple. It’s beyond time to #DeleteFacebook. Now more than ever.

Assassin’s Creed Valhalla Encourages Canadians To Recognize Viking History

Posted in Commentary with tags on August 19, 2020 by itnerd

Did you know Vikings are part of Canadian history? Specifically, Leif Erikson? In celebration of the upcoming release of Assassin’s Creed Valhalla, we’re encouraging Canadians to dig deep on Viking history and learn more about Leif Erikson Day.

Assassin’s Creed Valhalla allows players to explore ninth-century England as a Viking; just as Leif Erikson did on land now known as Canada.

To help celebrate Canada’s Viking history, we need your help. Sign our petition and share it with your friends and family!

Every signature helps ensure that Leif Erikson and his crew are given the credit they deserve in Canada, taking us a step closer to having October 9th recognized as a national holiday from coast to coast in celebration of Canada’s early discovery.  

Will you joining the Vikings in ensuring that they are recognized in our country’s history?      

Element AI Helps Edelweiss Tokio Life Accelerate AI Transformation

Posted in Commentary with tags on August 19, 2020 by itnerd

Element AI, a global developer of artificial intelligence-powered (AI) solutions and products, today announced the Indian insurer Edelweiss Tokio Life Insurance, as its newest client. Launched in 2011, Edelweiss Tokio Life has quickly become an important player in India’s life insurance market as one of the most innovative insurers with a product offering that fits today’s customer expectations.

The Element AI team will work closely with Edelweiss Tokio Life to create an actionable roadmap for strategic AI deployment for the company, which will ultimately support a detailed AI transformation plan. This work will utilize unique learnings and insights from Element AI to establish technical feasibility and identify AI use cases.

Commenting on the development, Nilesh Parmar, Chief Operating Officer, Edelweiss Tokio Life Insurance said, “As an organisation, we are focused on building agility and scalability within our processes and systems. With a single-minded focus on delivering a seamless and superior customer experience, we want to empower ourselves with digital technologies like artificial intelligence that can help us better serve our customers. We are glad to have found a like-minded partner with Element AI to assist us in this transformation journey.”

Element AI helps organizations like Edelweiss Tokio Life accelerate AI adoption by:

  • Identifying how AI can help address the key challenges facing a business and finding the unique AI investments that balance creating value today with building capabilities for tomorrow
  • Assessing the potential of a company’s current data, technology and software infrastructure to deploy AI workflows and systems through a strategic lens
  • Empowering employees to work smarter with AI by building an organization’s literacy and trust to work with AI
  • Establishing a framework for trustworthy, explainable and responsible AI for now and the future

To learn more about Element AI for Insurance, visit: https://www.elementai.com/industries/insurance.

To learn more about Element AI Advisory and Enablement, visit: https://www.elementai.com/products/advisory-and-enablement.

Terranova Security Announces The Second Edition Of The Gone Phishing Tournament & The Phishing Global Benchmarking Report

Posted in Commentary with tags on August 19, 2020 by itnerd

Terranova Security has announced the 2020 edition of the Gone Phishing Tournament event, scheduled to take place in October to coincide with National Cyber Security Awareness Month. The inaugural 2019 event, along with the resulting Gone Phishing Tournament Benchmark Global Report, highlighted the need for organizations to implement a security awareness training program supported by consistent phishing simulations.

The Gone Phishing Tournament, co-sponsored by Microsoft, uses an email template from Attack simulation training, a new capability of Office 365 Advanced Threat Protection (ATP)releasing later this year. Attack simulation training is an intelligent social engineering risk management tool that uses context-aware simulations and hyper-targeted training to train employees, and measures behavior change all on an automated platform, simplifying the design and deployment of security awareness training.

Adding Microsoft as a sponsor for the 2020 Gone Phishing Tournament marks a new chapter in the ongoing partnership between the two organizations, one that centers around the comprehensive Terranova Security content catalog and the company’s commitment to a human-centric approach to security awareness. It’s also another example of how Terranova Security phishing content will bring the best in security awareness training to Microsoft customers. 

The 2020 Gone Phishing Tournament comes at a time where an accelerated transition to a remote workforce due to the COVID-19 has put an even greater emphasis on the importance of security awareness training for all employees.

The first edition of the Terranova Security Gone Phishing Tournament took place over five days in October 2019. The goal of the tournament was to allow organizations to discover how their click rate compared to those of organizations with similar characteristics including vertical or industry, size, and geographical location. 

Key Takeaways from the 2019 Gone Phishing Tournament

The Terranova Security 2019 Phishing Global Benchmark Report provided in-depth insight on the event’s results, including click rate statistics by vertical, organization size, geographical location, and level of security awareness and phishing simulation programs in place.

The resulting click rate benchmarking yielded tangible insights concerning employee cyber security and phishing awareness. Once organizations understand how susceptible their users are to phishing threats, they can take actionable steps that lower their click rate and secure their sensitive data. 

The 2019 Phishing Global Benchmark Report reinforces how important it is for organizations to use a combination of security awareness training and phishing simulations to decrease the click rate and reduce the likelihood of these attacks being successful. 

Even in organizations with comprehensive security awareness programs in place, employees are still clicking phishing emails. 11% of recipients clicked the phishing link and 2% of recipients submitted their credentials on the phishing website.

Other key findings from the 2019 report include:

  • In organizations with no security awareness programs in place, 13% of users clicked the phishing link.
  • In organizations with only a security awareness program in place (but no phishing simulations), 29% of users submitted their credentials after clicking a phishing link.
  • In organizations with both security awareness and phishing simulations, the credential submission rate is 47% lower.

Register now and reserve your free phishing simulation as part of the 2020 Gone Phishing Tournament.

OnwardMobility Announces Agreements With BlackBerry & Foxconn Subsidiary FIH Mobile To Bring BlackBerry 5G Smartphones To Market

Posted in Commentary with tags on August 19, 2020 by itnerd

OnwardMobility today announced agreements with BlackBerry and FIH Mobile Limited, a subsidiary of Foxconn Technology Group, to deliver a new 5G BlackBerry Android smartphone with physical keyboard, in the first half of 2021 in North America and Europe. Under the terms of the agreement, BlackBerry grants OnwardMobility the right to develop, engineer, and bring to market a BlackBerry 5G mobile device. Working closely with OnwardMobility, BlackBerry and FIH Mobile will ensure world-class design and manufacturing of these devices.

With the increasing number of employees working remotely with critical data and applications, coupled with the constant threat of cyberattacks, there is an absolute need for a secure, feature-rich 5G-ready phone that enhances productivity. Employees are demanding better workplace technology experiences, and organizations are facing increasingly complex challenges in selecting, deploying, securing and managing devices to meet expectations and maximize employee productivity. 

OnwardMobility will conduct product planning and market development for BlackBerry smartphones in North America and FIH Mobile will design and manufacture the BlackBerry devices under strict guidelines to ensure component, device and supply chain integrity. 

Interested in learning more about OnwardMobility? Please visit: onwardmobility.com

UPDATE: Here is a video statement by OnwardMobility CEO Peter Franklin: