Is Apple Trolling Us With The New HomePod?

Posted in Commentary with tags on January 19, 2023 by itnerd

I have to admit that I am not getting what Apple is up to here.

Apple released a new HomePod at $299 USD yesterday. And it has the following features:

  • From the press images, it looks almost exactly like the original HomePod.
  • It comes in white and “Midnight” which I guess is the new black in the Apple reality distortion field. Either way, those are the same colour choices as the original HomePod.
  • It comes with the S7 chip from the Apple Watch Series 7 which replaces the A8 chip that came with the original HomePod. And is a step up from the S5 chip from the HomePod mini. That should make this new HomePod faster, but having used the HomePod mini for 2 years, I can’t say that they are slow.
  • This HomePod can apparently sense temperature and humidity. But fun fact: The same sensors are on the HomePod mini but Apple didn’t activate them. Though that will change next week with a software update.
  • There’s a U1 chip to hand off audio from an iPhone. But fun fact: The HomePod mini has this too.
  • It has a four-inch high-excursion woofer, five tweeters, and four microphones. But fun fact: The original HomePod had two more tweeters and two more microphones. So you can argue that this is a bit of a downgrade.
  • It has a bigger screen at the top versus the original HomePod to bring it in line with the design language of the HomePod mini.
  • It has Thread and Matter support, just like the HomePod mini.
  • It can recognize sounds like smoke and CO2 alarms and send push notifications to your phone to let you know that it heard something. But that’s coming to the HomePod mini and this HomePod in a future software update.
  • It can adjust the audio to fit the room that you’re in. But fun fact: The HomePod mini does this already.
  • Just like every other version of the HomePod, only people within Apple’s walled garden can use the HomePod. Or put another way, your friends on Android will have to bring their own speakers to your home if they want to play music from their phones and tablets.

The thing is based on the above, why should anyone buy one? No really. That’s a serious question. Let me explain.

For starters, it’s at the same price that Apple discontinued the original HomePod at. And as I mentioned earlier, you can argue that while they gave you a faster processor and brought it in line with from a feature perspective with the HomePod mini, you’re getting less in the audio department. Though to be fair, that’s going to have to be tested by tech YouTubers and we will find out quickly if having two less microphones and two less tweeters makes a difference in the real world. And what doesn’t help is that the HomePod mini is so good at $99 USD that I see zero reason to buy or recommend a HomePod at $299. Honestly, my review of the HomePod mini from 2020 was glowing. And this new HomePod would have to utterly destroy the HomePod mini to make me want to replace any of the four HomePod minis that I own with a HomePod. And the fact that a lot of the features that Apple highlighted the HomePod mini either does already, or will be doing soon really cements the fact that I feel like Apple is trolling us here. It’s as if they said this over at Apple Park when they were planning this product:

“The original HomePod failed because it was too expensive. So let’s add some stuff from the HomePod mini, take away some stuff to increase our profit margins where we think nobody will notice it, and release it at the same price that the original HomePod was reduced to before it tanked. What could go wrong?”

If Apple has some brilliant plan behind this HomePod, I’m currently not seeing it. Though, part of me wonders if this is the first step in a larger plan by Apple to take over the home by using the HomePod as a beach head to do so. And all of this will eventually make sense in a couple of years when there’s a full line of HomePod products as well as other products that work with HomePod. I hope that’s the case because in the here and now, it seems that Apple is just releasing this new HomePod in hopes that they are going to strike gold after the first one crashed and burned in such a spectacular manner. I guess we’ll see in the next couple of years what the plan is, or isn’t from Apple.

1 Comment »

EnGenius Announces ECW270 Outdoor Access Point

Posted in Commentary with tags on January 19, 2023 by itnerd

EnGenius expands its enterprise Cloud solution with the rugged ECW270, a top-of-the-line outdoor access point (AP). With an IP68 rating, one of the highest outdoor ratings available, it protects from extreme dust, torrential rain, and even immersion under high pressure. 

This industrial-grade Cloud Managed AP boasts Wi-Fi 6 (802.11ax) technology and a 4×4 antenna designed for superior wireless communication even in harsh outdoor environments. It can provide network coverage to many simultaneous client connections, which is perfect for business parks, apartment complexes, senior living, airports, school campuses, and outdoor venues.  

The ECW270’s high-powered radios provide the ability to mesh the access point at greater distances and blanket larger areas with Wi-Fi minimizing expensive cable runs. IT professionals can use the existing 2.4 GHz (5 dBi) and 5 GHz (7 dBi) detachable antennas to flood an area with Wi-Fi or swap out the antennas for more demanding environments with specific requirements. 

The ECW270 AP can use its primary Ethernet port, which supports 2.5 GigE PoE++, to easily be mounted and attached to light poles, sides of buildings, and exposed ceilings or racks in warehouses up to 300 ft away from the power source. The AP also provides a secondary 1 GigE PoE+ PSE port to pass internet data and power to a surveillance camera or other power-sourcing device.

Key Features and Benefits:

  • High-rated, IP68-rated waterproof & dustproof housing withstands extreme environments 
  • Detachable four (4) 7 dBi 5 GHz & four (4) 5 dBi 2.4 GHz, Omni 360° N-type antennas 
  • Supports up to 2,400 Mbps in 5-GHz band & 1,200 Mbps in 2.4-GHz band 
  • Dual-band 802.11ax with scanning radio for an improved wireless experience
  • 2.5 GigE PoE++ compatible port for easy placement in outdoor spaces 
  • 1 GigE port with PSE (802.3af/at) to power up IP cameras or other compliant devices 
  • High-powered radios to increase meshing distances on either 2.4 GHz or 5 GHz 
  • Built-in surge and ESD (electro-static discharge) protection 
  • Wide outdoor operation ranges from -4°F ~ +149°F (-20°C ~ +65°C)

The ECW270 is managed on the EnGenius Cloud, and a single or an unlimited number of these ruggedized APs can be easily installed, configured, and monitored at scale. APs can be quickly scanned, registered, pre- & auto-configured, and remotely monitored and troubleshot. The cloud solution allows IT professionals to dive into AP specifics like device status, throughput and connectivity performance, wireless statistics, and connected wireless device status.

The ECW270 AP is now shipping and EnGenius is offering it at an unmatched value of $999 MSRP through its authorized partner channel. For more information, visit https://www.engeniustech.com/engenius-products/ecw270-wi-fi-6-4×4-outdoor-access-point/

Leave a comment »

New Phishing Attacks Pose As Updated HR Policy Announcements In The New Year

Posted in Commentary with tags on January 19, 2023 by itnerd

Crane Hassold, Director of Threat Intelligence at Abnormal Security, is seeing bad actors exploit the transition to the new year by sending out phishing campaigns containing themes of updated human resources (HR) policy announcements to steal employee credentials.

Abnormal Security has looked at campaigns incorporating these themes, and has published a report discussing why the content of these phishing attacks could result in a higher success rate, and providing recommendations about how organizations can better protect themselves from similar attacks.

  1. The first link-based attack imitated a company HR email that announced the release of a new employee handbook, which included a link to a phishing page meant to steal an employee’s name and email credentials.
  2. The second payload-based phishing attack posed as an announcement from the company HR team about updates to the company’s benefits package and requested the recipient review a supposed updated handbook, which opened a phishing page to steal account credentials.

You can read the full report here.

Leave a comment »

New Email Phishing Attack: Hackers Hide Malware in Blank SVG Image via DocuSign HTML Attachment

Posted in Commentary with tags on January 19, 2023 by itnerd

Researchers at Avanan, A Check Point Company, have revealed its latest research analyzing how hackers hide malicious content inside “blank images,” creating automatic redirects that bypass anti-malware checks. 

  • This technique adds a layer of sophistication to malicious HTML attachments with the <meta> tag, obfuscating the URL to evade link analysis and redirect to a compromised domain. 
  • This email campaign starts with what appears to be a document from DocuSign, requesting the user to review and sign the document. 
  • The document provides an HTM attachment containing an empty SVG image; clicking on the image within the document automatically redirects visitors to a malicious URL.

Jeremy Fuchs, Cybersecurity Researcher/Analyst at Avanan had this comment:

“Hackers can target practically anyone with this technique. Like most attacks, the idea is to use it to get something from the end-user. Any user with access to credentials or money is a viable target. HTM attachments aren’t new, nor are using Base64 trickery. What is new and unique is using an empty image with active content inside–a javascript image–which redirects to a malicious URL. It’s essentially using a dangerous image, with active content inside that traditional services like VirusTotal don’t detect.” 

You can read the full report here. It also has defence strategies in the report that you will find useful as well.

Leave a comment »

ChatGPT Is Good At Many Things…. Including Creating Malware

Posted in Commentary with tags on January 19, 2023 by itnerd

By now you have heard of ChatGPT by OpenAI. It has a lot of abilities including the ability to learn, come up with great ideas, and apparently it can create malware too:

ChatGPT took the world by storm being released less than two months ago, it has become prominent and is used everywhere, for a wide variety of tasks – from automation tasks to the recomposition of 18th century classical music. Its impressive features offer fast and intuitive code examples, which are incredibly beneficial for anyone in the software business. However, we find that its ability to write sophisticated malware that holds no malicious code is also quite advanced, and in this post, we will walk through how one might harness ChatGPT power for better or for worse.

And:

ChatGPT could easily be used to create polymorphic malware. This malware’s advanced capabilities can easily evade security products and make mitigation cumbersome with very little effort or investment by the adversary. 

That’s not reassuring to say the least. And Christopher Prewitt, CTO of Inversion6 has this to say:

“ChatGPT is going to be a significant impact to everyone’s lives very quickly and is proving to be of substantial impact. The security community has immediately taken note and its alleged that attackers have already been using this technology to create phishing emails and script kiddies taking advantage of this to improve their tactics and tooling. Security researchers have been testing the bounds of this technology to stretch its capabilities from creating malware to analyze and translate code.”

The take home message is that we’re likely in for a very scary and bumpy ride given the capabilities of ChatGPT. Hopefully there are checks and balances to stop it from becoming the terrifying SkyNet from the Terminator movies.

UPDATE: I have additional commentary from Jack Nichelson, CISO of Inversion6:

The use of AI-assisted coding has the potential to revolutionize the way we develop software, but it also poses new risks to cybersecurity. It is important for organizations to understand the potential for malicious use of AI models and take proactive steps to mitigate these risks. This includes investing in security research and development, proper security configuration and regular testing, and implementing monitoring systems to detect and prevent malicious use.

It is important to note that the emergence of AI-assisted coding is a new reality that we must learn to adapt to and be proactive in securing against potential threats. The ability reduce or even automate the development process using AI is a double-edged sword, and it’s important for organizations to stay ahead of the curve by investing in security research and development.

In this scenario, the researchers were able to bypass content filters by simply asking the question more authoritatively, which suggests that the security of the system was not properly configured. This highlights the importance of proper security configuration and regular testing to ensure that systems are protected against potential threats.

It is also important to note that ChatGPT is not the only AI language model with the potential to be used for malicious purposes, other models like GPT-3 also have the same potential. Therefore, it is important for organizations to stay informed about the latest advancements in AI and its potential risks.

Furthermore, it is important to understand that the possibilities offered by AI are vast, and that we must continue to invest in research and development to stay ahead of potential threats. As the saying goes, “the future is already here, it’s just not evenly distributed”, and it is important for organizations to stay ahead of the curve by investing in security research and development to mitigate the potential risks of AI-assisted coding.

Leave a comment »

SAP Labs Canada Appoints New Chief Operating Officer

Posted in Commentary with tags on January 18, 2023 by itnerd

SAP Labs Canada has announced the appointment of Christine Vukusic as its new Chief Operating Officer (COO). Christine will be operating, managing, and executing the strategic vision and mission of SAP Labs Canada by developing and implementing the operational plan for the organization and promote SAP’s award-winning company culture.

Labs Canada is one of seven SAP Global Research Hubs, which represent SAP’s most significant R&D locations, in terms of size and delivery of best-in-class solutions across the many SAP product portfolios. Based in Vancouver, Christine brings her over 15-year tenure with SAP to this new role. In her previous role, her passion for innovation with internal processes was her focus, as the manager of the SAP Language Experience North America team. Here she led a multi-functional team of developers, project managers, and language quality engineers providing industry-leading translation technology and processes across SAP. She joined SAP with a decade of tech industry expertise in growing teams and businesses.

The SAP Labs Canada team has been a big supporter of creating innovative outlets for its employees such as its sustainability and green technology expertise, the d-Shop technology makerspace, volunteer programs to support students and girls in STEM, and its valuable Internship Program. With the breadth and depth of her years of experience, Christine is ready for new challenges, inspiring ideas, and aims to showcase Labs Canada operations as an innovative gold standard.

Christine is known for always being one to step up to help SAP be stronger together. She has consistently been an advocate for diversity, inclusion, and employee engagement. This includes her role as a member of the Vancouver ELT, being co-chair of the Vancouver Business Women’s Network, sponsor for SAP Canada’s Green team and a steering member of SAP’s Indigenous Inclusion Initiative.

Leave a comment »

Nissan Took Six Months To Notify People Of A Data Breach

Posted in Commentary with tags on January 18, 2023 by itnerd

If you go to The Office Of The Maine Attorney General, and look at this data breach notification, you’ll quickly see the following:

Nissan North America has a data breach last June. Almost 18000 people were affected by this breach which was. caused by “Inadvertent disclosure, Insider wrongdoing” which means either someone on the inside screwed up or someone on the inside did something nefarious. The breach wasn’t discovered until the end of September, but Nissan North America didn’t let the public know until December.

That sounds pretty bad. But I will get back to that in a second.

Here’s what Nissan said:

The impacted third-party service provider provides software development services to Nissan. Nissan provided certain information to this service provider for processing during the testing of the software.

On June 21, 2022, Nissan received notice that certain data it provided for software testing had inadvertently been exposed by the third-party service provider. During our investigation, on September 26, 2022, we determined that this incident likely resulted in unauthorized access or acquisition of our data, including some personal information belonging to Nissan customers. Specifically, the data embedded within the code during software testing was unintentionally and temporarily stored in a cloud-based public repository.

And here’s the information that is now out there:

The information that was potentially accessed or acquired during the time that it was temporarily available on a public repository included your name, date of birth, and NMAC account number. This information did not include your Social Security number or credit card information.

Again, that sounds pretty bad. And I have to admit that my initial reaction was to say “WTF? Six months to notify people?” But here’s an alternate view of this from Ani Chaudhuri, CEO, Dasera:

Though Nissan allegedly took six months to disclose the data breach to the affected parties, it is clear that they took the incident very seriously and moved quickly to contain the damage and protect the affected individuals. We should work to appreciate the transparency and honesty with which they communicated the incident to the public, as any form of a data breach is extremely hard on a company due to potential damage to reputation, revenue, culture, etc. 

One of the key takeaways from this incident is that data breaches can happen to any company, regardless of size or industry. It is important for companies not to be afraid to disclose data breaches publicly, as it raises awareness and helps other organizations learn from the incident. By being open and transparent, Nissan has set an example for other companies to follow.

Moving forward, companies like Nissan can prevent data breaches with a robust data governance and security strategy by providing a framework for managing and protecting sensitive information. Some ways data governance can help prevent data breaches include:

  • Establishing clear policies and procedures for data management: Data governance policies and procedures can set standards for how data is collected, stored, and shared within the organization. By having clear guidelines in place, the organization can reduce the risk of accidental data breaches caused by employees not following proper protocols.
  • Identifying sensitive data: Data governance can help identify sensitive data by classifying data based on its level of sensitivity, and then implementing appropriate controls to protect that data. By identifying sensitive data, Nissan can take the necessary steps to protect it from breaches.
  • Implementing access controls: Data governance can help implement access controls to ensure that only authorized personnel have access to sensitive data. By implementing access controls, Nissan can ensure that vendor employees only have access to the data they need to perform their duties, reducing the risk of breaches caused by unauthorized access.
  • Regularly monitoring and auditing data: Data governance can help implement regular monitoring and auditing of data to detect any anomalies or suspicious activities that could indicate a data breach. By regularly monitoring and auditing data, Nissan can detect a data breach early on and take action to contain the damage and protect the affected individuals.
  • Conducting vendor risk assessment: Data governance can help implement a vendor risk assessment program that allows the organization to assess the security risk of their vendors and make sure that their vendors are meeting the company’s security standards. This can help Nissan to identify potential vulnerabilities and take steps to mitigate them before a data breach occurs.

Overall, a mature data governance and security strategy can help companies like Nissan prevent data breaches by providing a framework for managing and protecting sensitive information, and by identifying and mitigating risk.

While all of that is true, I do wish that the public knew of this sooner. Because the faster the public knows that something like this happens, the more able the public are able to take precautions from threat actors who would use this information for nefarious reasons.

Leave a comment »

DNV Discloses Ransomware Attack That Affected Ships At Sea

Posted in Commentary with tags on January 18, 2023 by itnerd

DNV, a maritime software supplier, has disclosed that it is the victim of a ransomware attack that has affected about 1,000 vessels. The ransomware attack took place on the evening of January 7th. In response to the incident, the company has shut down the IT servers connected to the ShipManager system operated by the company. At this time, the company has yet to disclose the strain of ransomware that infected its systems.

Dr. Darren Williams, CEO and Founder, BlackFog, has offered perspectives on this news:

     “Although the strain of ransomware used in this attack is still to be officially declared, the first major concern that comes to mind in relation to the attack at Maritime DNV is it adds yet another critical infrastructure victim to the list. With a global war at play and the DNV holding a global market share of 21% of the solutions and services of any maritime vessel, suppliers such as the DNV are ideal victims for attackers due to the large-scale disruption they can potentially cause.

As we wait for more details on the DNV attack, we can be confident that data exfiltration and extortion were a motive for the currently unknown attackers. With 89% of all publicly disclosed attacks in 2022 exfiltrating data, it’s evident that bad actors have moved on from encryption well and truly. The escalation and severity of the attacks we are seeing on a regular basis clearly demonstrate that older technologies relied on by organizations are insufficient when it comes to preventing ransomware. 

In any case, once access to a system is gained by attackers, it is only a matter of time before ransomware is deployed. In addition to reporting the incident to the authorities and shutting its IT servers down, as the Norwegian supplier has done, organizations must refuse to pay the ransom where possible, and focus on preventing data exfiltration to put a stop to ransomware and extortion. Fortunately, third-generation cybersecurity tools have been specially designed to do this. Organizations adding this technology to their cybersecurity stack in 2023 will stay out of the ransomware headlines while attackers move on to less protected companies.”

This shows the effects of a ransomware attack can be downstream in nature. Which makes stopping ransomware attacks of paramount importance.

Leave a comment »

Radiant Logic Announces 4th Consecutive Year of Profitable 20%+ Revenue Growth and 95%+ Customer Retention Rate

Posted in Commentary with tags on January 18, 2023 by itnerd

Radiant Logic, the enterprise Identity Data Fabric company,  delivers a 4th straight year of profitable growth and an expanding customer base despite economic uncertainty. In 2022, Radiant Logic delivered 20%+ revenue and EBITDA growth on the strength of the RadiantOne platform’s ability to harness identity data to unlock meaningful business value for enterprise organizations. Radiant Logic also maintained its world-class customer retention rate of 95%+ and further invested in the success of its customers with the appointment of its first Chief Customer Officer, Dieter Schuller, a 22-year Radiant Logic veteran. 

According to Gartner, “IAM leaders must start with a strategy for managing identity data. Identity data drives your IAM engine.[i]” The past year saw a growing recognition of identity data management as an important discipline with cybersecurity and an essential component of the identity fabric architecture. As IAM maturity models demand a composable, unified operating model, the role of accurate and available identity data becomes a prerequisite. 

Radiant Logic’s Intelligent Identity Data Platform continues to act as the cornerstone in many of the world’s most complex identity infrastructures. The company had some notable customer deployments in 2022, including providing the identity data foundation at Defense Information System Agency (DISA), and enabling the Naval Identity Service in the Department of Navy. 

Radiant Logic also recently released the commissioned Total Economic Impact™ study conducted by Forrester Consulting, which demonstrated an ROI of 239% and an 80% increase in efficiency, among other quantified benefits. By deploying RadiantOne to address these challenges, a composite customer achieved a 239% ROI on the initial investment (totaling $20.3M over three years), with technical debt reduced by $9.2M, operational efficiency improved by 80% by year three and risk of a data breach reduced by 25% by year three.

Leave a comment »

DH2i Marks 2022 As Another Year of Record Product Innovation, Strategic Partnership Development and Industry Acclaim

Posted in Commentary on January 18, 2023 by itnerd

DH2i®, the world’s leading provider of always-secure and always-on IT infrastructure solutions, today announced that 2022 marked another year of record product innovation, strategic partnership development and industry acclaim. Building on an already enviable track-record of delivering the most advanced and real-world proven smart high availability (HA) clustering and software-defined perimeter (SDP) solutions for Windows, Linux and containers, DH2i announced the following last year:

Product Innovation:

Strategic Partnerships:

Awards and Accolades:

Leave a comment »

« Older Entries
Newer Entries »