Apple’s iCloud Private Relay Facilitating A Multi-Million Dollar Scam Says Ad Tech Firm

Posted in Commentary with tags on November 28, 2022 by itnerd

Well, Apple isn’t having a good time. After this and this came to light, a report from Gizmodo has Apple under new scrutiny over the iCloud Private Relay feature and how it facilitates a massive scam:

As you read this, there’s an army of bots pretending to be Apple users surfing the web and looking at ads, according to new research shared exclusively with Gizmodo. The ad fraud scheme is weaponizing a privacy feature called Private Relay, coopting a vast swath of traffic to show ads to robots and costing advertisers tens of millions of dollars in the process, researchers’ tests found. Apple has promised that the tool has “built-in fraud detection” and that advertising platforms can trust it, but the researchers say the fraud has only gotten worse in the months since they first reported it to the company.

The new report finds that criminals are exploiting Apple’s Private Relay tool, a feature available on on Apple devices for users who subscribe to iCloud+. Turn it on, and Private Relay will hide your web browsing and assign you a dummy IP address to help stop companies from tracking you. Pixalate, the ad tech firm that authored the study, released Tuesday, says the problem will cost US advertisers an estimated $65 million in 2022 alone. The study finds that 90% of web traffic that looks like it’s coming from Private Relay is actually fraudulent.

That’s not a good look for Apple. Here’s why:

“Apple says you can trust that connections through Private Relay are secure and free of fraud, so scammers are just presenting their traffic as coming from Apple,” said Amit Shetty, vice president of product at Pixalate. “It seems like they’re just hoping people are going to put the traffic on ‘allow lists’ because it’s considered to be safe.”

And:

Apple promised in several public statements that apps, websites, and ad tech companies can trust that iCPR addresses represent real people.The company says Private Relay has “built-in fraud protection,” and it’s “designed to ensure only valid Apple devices and accounts in good standing are allowed to use the service.” Apple goes even further, proclaiming that “Websites that use IP addresses to enforce fraud prevention and anti-abuse measures can trust that connections through Private Relay have been validated at the account and device level by Apple.”

Apple has been silent about this and their other issues. However as these sort of issues continue to come to light, Apple will have less ability to pretend that they don’t exist and they will have to say something. Because their use of the “reality distortion field” isn’t working. Especially when Apple markets itself as the privacy and security company.

China Seems To Be Using Porn To Cover Up News About Protests In Chinese Cities

Posted in Commentary with tags on November 28, 2022 by itnerd

The title sounds weird. But hang with me. It will make sense in the end. There have been protests in a variety of Chinese cities over China’s strict COVID lockdown protocols. And this seems to have made the government nervous enough to use a novel tactic to make sure that news about these protests don’t get out. Via TechCrunch:

Search any major Chinese city on Twitter, and you will see a cascade of spam tweets showing porn, escort services, and gambling content that are published every few seconds, making it impossible to get any legitimate results.

There has been a “significant uptick” in these tweets over the last three days, according to a China-focused data analyst. The surge in such bot content coincides with an unprecedented wave of protests that have swept across major Chinese cities and universities over the weekend.

The demonstrations are largely a result of China’s zero-tolerance approach toward COVID-19, a rare show of defiance amongst the people. The country’s stringent COVID restrictions have led to prolonged lockdowns across the country, obstructing life, business, and manufacturing activities.

I have to admit that I did not have “China uses porn to cover up protests” on my BINGO card. That is very novel. Now according to the article Twitter is aware of this. And as this morning I was not able to reproduce this while last night I was. Thus there’s apparently someone left at Twitter who can take care of an issue like this. But now that China has done something like this, you can expect others to try the same thing. And then we’ll see how serious Elon Musk is about fighting bots on Twitter.

Elon Musk Is Whiny And Anti-Semetic… Let Me Explain

Posted in Commentary with tags on November 28, 2022 by itnerd

It seems that Elon Musk is hit two new lows when it comes to his behaviour. Let’s start with the fact that advertisers are running from advertising on Twitter in huge numbers. And according to this article, this has really ticked Elon off;

Elon Musk called up the chief executives of companies that pulled advertising spending from Twitter to complain, the Financial Times reported

A number of leading media buyers and advertising agencies say that almost all the major brands they act for have stopped ad spending on Twitter, the report said. 

Musk took it upon himself to personally call CEOs to chastise them, one industry figure told the FT, but his actions have backfired, the newspaper reported. 

Of course his actions have backfired. Calling up CEO’s to whine about them pulling adds is not an effective business development strategy. And this is another reason why you’re seeing less ads on Twitter:

Four industry figures told the Financial Times that in recent weeks agencies have not little communication with Twitter’s ads business team because so few staff were left following mass layoffs. 

Twitter’s ad systems have become bug-ridden, according to some media buyers, making it nearly impossible to launch campaigns. 

“It is quite unique. The turmoil, the damage, nothing of this magnitude has happened before. Never,” a big four advertising agency executive told the FT.

I have been using this phrase since the Twitter gong shows with Elon Musk being the ringmaster began. He’s turned Twitter into a train wreck next to a dumpster fire via his actions and his behaviour. Speaking of his behaviour, a reader pointed me towards an article in The Jerusalem Post that shows that Elon is playing the anti-semitic card when confronted with criticism. You be the judge:

Elon Musk called Jewish American retired US Army officer Lt.-Col. Alexander Vindman both a “puppet & puppeteer” on Monday in response to Vindman sharing a copypasta (copied and pasted text shared on the Internet) suggesting that Musk is “erratic” and too powerful now that he owns Twitter.

“Vindman is both puppet & puppeteer. Question is who pulls his strings … ?” Musk tweeted.

Musk’s tweet was in response to another one by Tablet magazine Chief Technology Officer Noah Blum mocking the copypasta, which said that it’s “Kinda weird that @elonmusk gets to decide how like a half-billion people communicate. Way too much power for one erratic individual to wield, don’t you think?”

Here’s the problem with that Tweet by Elon:

Musk’s tweet – deliberately or not – evoked an antisemitic trope that Jews are puppeteers who secretly wield power over various institutions or that they are puppets of the Israeli government.

An anti-semitic Tweet like this is massively problematic for Elon. It reinforces that he’s a racist, which is something that I said in this article from a week ago when he mocked Black Twitter. And I am pretty sure this will put Elon on a collision course with Apple and Google as it is becoming clear that Elon not only can’t or won’t moderate hate speech on Twitter, but his own behaviour is amplifying said hate speech. Which means that Apple and Google will have to make a choice as to if the Twitter app should be on their respective app stores. That’s on top of the fact that this is likely to send more advertisers to the exits because nobody wants to do business with a racist.

By the way, I checked his Twitter feed and the Tweets are still there. Read into that what you will.

Elon really needs to rethink how he acts and behaves as his current behaviour isn’t helping him in the slightest.

A Follow Up To My Recommendation For ASUS ZenWiFi XT8 Users To Not Install Firmware 3.0.0.4.388.21099

Posted in Commentary with tags on November 27, 2022 by itnerd

You might remember that a few weeks ago I put out a public service announcement for owners of The ASUS ZenWiFi XT8 to not install firmware 3.0.0.4.388.21099 as it was incredibly unstable. In fact, it was so unstable that I recommended rolling back to the previous firmware and provided instructions on how to do so. Earlier this week, ASUS released an updated firmware which is listed as version 3.0.0.4.388.21617 that claims to optimize memory usage and improve stability among other things. You can read the release notes here. Since I suggested to people that they shouldn’t try the previous firmware, I decided to try this firmware. Now first, let me describe how to update the firmware as for whatever reason, if you don’t follow this method you will have issues. More on the issues that you will have in a minute. But here’s my process:

  • Log into the router using a computer and a web browser
  • Backup the configuration using these instructions
  • Update the firmware using method 1 from these instructions.
  • After updating do a factory reset of the router using these instructions
  • Using a computer and a web browser, connect to the router and using the advanced options in the setup wizard, upload the backup of the configuration that you saved in the first step.

The reason why I recommend going this route is that for whatever reason, ASUS routers do not cleanly update the firmware. And that leads to all sorts of weird issues that are hard to track down. In my case, it breaks HomeKit unless I go through the steps above. Going this route avoids all of that.

Now I have been testing this firmware for a few days, and so far it has been stable for me. And it has been stable for others based on reports from places like SNB Forums. Thus I am cautiously optimistic that you should be okay to update your ZenWiFi XT8 to this firmware. Though I would wait another week or maybe two to see if any issues appear by monitoring the thread in SNB Forums just to be safe.

If you have any feedback about this firmware, please share them in the comments below. And if I notice anything that is a deal breaker, I will will post an update.

Elon Musk’s Wants To Generate 50% Of His Revenue From Twitter Blue… But It’s Not Going To Happen

Posted in Commentary with tags on November 27, 2022 by itnerd

Elon Musk sees advertisers as a problem when it comes to him running Twitter. Thus he wants to reduce his reliance on advertisers In fact, this is his ideal revenue split:

Musk has said he wants subscriptions to account for 50% of Twitter’s total revenue, according to a message by a VP on an internal company slack.

The message, which was shared on Twitter by Platformer’s Casey Newton, said Musk thought the subscription aim “could help with conversations” and “pay by credit card could help with bots.

There’s two big problems. The fact that advertisers are fleeing the platform isn’t helping this as it reduces the revenue that he has coming into Twitter’s bank account while he makes this transition. And second, there’s the fact that it is very unlikely that Twitter Blue isn’t likely to catch on:

However, a survey from The Harris Poll, a global market research and consulting firm, found half of frequent US Twitter users said they would ditch the platform if it came with a monthly subscription fee.

The firm polled 2,063 US adults, 1,212 of which were Twitter users, from October 20 to October 28, the week Musk took over the company.

Pinar Yildirim, a professor of marketing and economics at The Wharton School, told Insider introducing a subscription model to Twitter could even drive users away from the platform. Yildirim said many users were waiting to see if Twitter becomes subscription-based.

“Worries about subscription changes have caused some users, either of higher status like some celebrities or ordinary users, to express a desire to potentially explore other platforms,” she said. 

“If in the end, the revenue model becomes such that everyone on Twitter has to pay a price,” she said, “that’s going to result clearly in a movement of users who may find it too expensive to simply be on Twitter.”

Well, that’s a problem. Then there’s the fact that the loans that Musk took require a $1 billion interest payment. But…:

If Musk wants to generate enough revenue to pay the $1 billion in interest owed on Twitter’s debt each year, it would need to add about 10 million more paying customers, according to social media expert Matt Navarra

I cannot honestly see how Musk squares this circle. With companies not advertising on Twitter, because they don’t need Twitter and Twitter needs them, there’s zero chance that Twitter Blue will make up the difference, Twitter is screwed and so is Musk. But I will guess that we will see this coming Friday as that is when Twitter Blue launches.

My Apple Watch Band Collection – The 2022 “Ultra” Edition

Posted in Products with tags on November 26, 2022 by itnerd

Since getting the Apple Watch Ultra I have done a bit of a revamp of my watch band collection to match the vibe of the Ultra. And I’ve now got longer term storage for my bands:

I found this case on Etsy. It says that it is designed for Apple Watch bands, but I think it’s more of a generic case that they advertise as an Apple Watch case. It’s made of leather and it holds my complete collection just fine.

Now that things are starting to get back to normal, I will be travelling again. And when I do, the Twelve South TimePorter will go into my bag. The big plus to the TimePorter is that you can put an Apple Watch charger in it along with a slim battery pack to allow you to charge on the go. You can even fold it up to a 45 degree angle to use it as a display stand which is a great use case for a hotel room.

Now let’s talk about the bands. But before I do, let me answer a question that I get asked a lot. Which is can you use older Apple Watch bands. The answer is yes if the bands in question are for 42mm, 44mm or 45mm Apple Watches. And there’s a bit of a catch:

As you can see here, the lugs for the bands do not fit flush with the Apple Watch Ultra. This only happens on one side and is only noticeable if you are looking for it. I thought I would point that out because the bands specifically designed for the Ultra don’t do that. Another thing to point out is that I note that some third party bands are tighter than normal to get on and off the Ultra. I am guessing that the cause for that is that Apple slightly tightened up the tolerance for the lugs on the lugs. Likely to make sure that they didn’t pull out of the watch if you were doing something “extreme” with the Ultra.

Speaking of bands for the Ultra, let’s start with the band it came with:

I got the Alpine Loop as I didn’t like the Trail Loop nor did I like the Ocean Band. Once it’s on you, it will not come off because of the titanium hook on the band. I wear this occasionally as it is very comfortable. Typically when I am doing something athletic. It does dry quickly if you sweat a lot.

I have a pair of sport loops. One is the Nike Sport Loop that has reflective thread, and the other one is the Canada Sport Loop that Apple did for the Tokyo Olympics. Much like the Alpine loop, I use them for things like workouts and anytime I need a band that will be comfortable and dry quickly.

I also have an Apple Black Unity Braided Solo Loop which I also wear for workouts. It’s pretty comfortable but I have noticed that it fits slightly on the loose side. I am not sure why that is as this is a bigger watch and the opposite should be true. But it’s not a dealbreaker for me.

The UAG Active Watch Strap is one of my go to bands for workouts it will stay on my wrist no matter what I do, but it will feel comfortable the entire time that I wear it. After all, if my wife was able to use this band to do an extreme trail running race and have the watch stay on her wrist, anything that I do should be a non-issue. It also matches the vibe of the Apple Watch as it is big and bulky.

I have a couple of Apple Sport Bands lying around from previous Apple Watches. Thus I put them into the rotation in case I need a band that could be used for going out or for athletic activities.

The Nike Sport Band from Apple as of late is my go to watch band I am doing something athletic like hiking or working out in the gym. One big plus is that it also fits my Road ID for Apple Watch which gives me a bit of extra safety should I feel the need to use it when I am out for a ride on my bike or doing a hike solo. Because it is made of rubber and has holes in it, it stays dry on your wrist.

The UAG Nato Strap is a band that I really like as it adds a bit of style to the Apple Watch Ultra. During our last road trip to PEI in 2019, it was the only band that I wore as I could hike or cycle with it in the day, and go out to dinner with it at night. And it’s machine washable as well. It also fits my Road ID for Apple Watch which gives me a bit of extra safety when I ride my bike for example. Plus it is super comfortable.

UAG also makes a Leather Watch band as well which I find to be very comfortable and stylish. Plus it includes a snap that locks everything into place so that there’s no way the watch will come off your wrist. It is starting to show some wear but I am fine with that as it adds some character.

The Watch Strap Company Link Bracelet has the look and feel of the Apple Link Bracelet without the Apple price. It’s a very premium feeling product and goes great with everything from suits or business causal clothing. I have had the black one for years, but I recently added the silver one to my collection as it almost matches the casing of the Apple Watch Ultra.

I also have The Watch Strap Company Mesh Loop (The Watch Strap Company’s term for the Milanese Loop) in my collection. It uses stainless steel that is very soft and comfortable to wear. And it is very premium feeling and durable. Again, the black one I have had for years, but I got the silver one to match the Apple Watch Ultra.

That’s my Apple Watch band collection. One thing that I have to say to those who have Apple Watches and want to have good quality upscale bands is that you should skip the really cheap bands on Amazon. Those ones from personal experience don’t have good quality materials and typically will not last all that long. Bands from companies like Apple, The Watch Strap Company, and Urban Armor Gear are examples of good quality watch bands that should be part of your collection.

What Apple Watch bands do you use? I’d be interested in hearing from women with Apple Watches as seeing as I have put forward a collection for men. Thus I figure that many women would be interested in what women use. But male users should join in on the conversation as well by leaving a comment and sharing their thoughts.

Elon Musk Suggests That He Would Make A Competitor To Apple And Google’s Phones If He’s Booted From Their App Stores

Posted in Commentary with tags on November 26, 2022 by itnerd

Okay. This whole Twitter thing since Elon Musk took over has been a crazy ride since he took over. But it’s now gotten really crazy. Because one of the potential side effects of giving anti-vaxxers, Neo-nazis, white supremacists, anti-LGBTQ activists, anti-Muslim bigots among other low life scumbags of the universe who don’t deserve a platform, amnesty on Twitter is that it may put him in the crosshairs of Apple and Google who have rules that would require the punting of the Twitter app from their respective app stores. If you want an example of that, look at Parler who was Thanos snapped out of the App Store and Play Store. I am guessing that this is a real possibility that Musk has thought of because he said this on Twitter last night:

Okay……

I have to look at this from both sides. So ignoring the fact that, this could simply be an empty threat, or that the odds are high that Apple and Google would destroy any sort of “Tesla Phone” or “Twitter Phone” in terms of sales, and that the development of this phone could easily become the same sort of train wreck next to a dumpster fire that we’re seeing at Twitter, consider this. If he threw the same people who are responsible for the in car entertainment system at Tesla, and recycle some of the silicon from that system, it isn’t actually that far fetched an idea. In fact this is completely doable from a hardware standpoint. His challenge will be the software. Google isn’t going to hand over a copy of Android to him, and Apple isn’t going to hand over a copy of iOS to him. So he will either have to do what Huawei did which is use the open source version of Android, or make his own OS. That’s a tall order either way. On top of that he needs an app ecosystem to give people a reason to buy this phone. That’s a tall order as well as you’re not going to want to jump to this phone if you can’t use the apps that you already have. And getting developers on board to make those apps will be a challenge.

Now how much market share that this phone would get would still be an open question. And more importantly, would it grab enough market share to scare Apple and Google? Personally, I am dubious that Apple and Google would be the least concerned about this Tweet from Elon. Or put another way, I seriously doubt that Tim Cook and Sundar Pichai are going to lose a moment’s worth of sleep over this Tweet. But I would suggest that this is something that is at least worth watching if he does get punted from their respective app stores.

All Of VW’s Brands Have Halted Ads On Twitter…. And They Are Saying Why They Are Doing That In Public

Posted in Commentary with tags on November 25, 2022 by itnerd

Elon Musk wants to wean Twitter off of advertising by brands. That’s why he’s pushing Twitter Blue so hard. The thing is that until Twitter Blue can generate the revenue stream that advertising generates, he needs advertisers. There’s no way around that. So it doesn’t help that Volkswagen who’s brands include, Audi, Porsche, Skoda, Lamborghini, Bentley, and Ducati have paused their advertising on Twitter. What makes this even more interesting is that they are actually speaking about why they did this:

A spokesperson for Volkswagen said all the brands had followed the advice, while Audi had opted to halt organic activities, such as direct posts, and only respond to questions from clients on the website.

WirtschaftsWoche had previously reported that Audi had halted all activities on the social media platform, citing company sources.

“We are monitoring the situation closely and will decide on the next steps depending on developments,” an Audi spokesperson added in an emailed statement to Reuters.

Audi has not tweeted since Nov. 1 after previously tweeting almost every day. Elon Musk took ownership of Twitter in late October.

Well, that’s not good if you are Elon as VW is a global brand which means that their advertising spend on Twitter must have been big. Thus that’s a lot of income that Twitter is not getting. And you have to wonder if VW going public with this will spur other companies to not only pull their ads, but to say why in public. If that happens, one has to wonder how Elon will react to that. Not well I would imagine. But we will have to see.

July’s Report Of A Twitter Data Breach Was WAY WORSE Than Previously Thought

Posted in Commentary with tags on November 25, 2022 by itnerd

Remember back in July there was a data breach on Twitter where the information on 5.4 million users was up for sale on the dark web? Well as bad as that was, we now have news that it was actually worse than that. 9to5mac is reporting the following:

We’ve been shown evidence that the same security vulnerability was exploited by multiple bad actors, and the hacked data has been offered for sale on the dark web by several sources.

It had previously been thought that only one hacker gained access to the data, and Twitter’s belated admission reinforced this impression …

And:

There were suggestions on Twitter yesterday that the same personal data had been accessed by multiple bad actors, not just one. 9to5Mac has now seen evidence that this is indeed the case. We were shown a dataset which contained the same information in a different format, with a security researcher stating that it was “definitely a different threat actor.” The source told us that this was just one of a number of files they have seen.

That’s really, really, extremely bad. And reading this report makes one wonder how this is going to get any better under Elon Musk? Because it is pretty clear that Twitter’s security was bad before he took over. So given all that has gone on, how much worse can it be with him in charge? While Twitter doesn’t have a PR department anymore, the company needs to provide some answers on this. And they need to do so now with enough detail to reassure Twitter users that they can have confidence in the company. But I am pretty sure that this is not going to happen.

UPDATE: I have commentary from Brian Johnson, Chief Security Officer at Armorblox:

“Breaches that expose email addresses and phone numbers are almost always followed up by targeted phishing and SMiShing campaigns. Given that Twitter has also been in the news a lot recently, attackers might exploit our cognitive biases like recency bias to send out fake password reset emails or SMSes to Twitter users to steal their credentials. Stolen passwords now allow them to try these passwords out laterally across other sites because many users use the same password across different providers. We recommend that users set up multi-factor authentication on all their personal and work accounts, and more specifically, watch out for suspicious emails that appear to be coming from Twitter. This includes verifying the sender email addresses, and any links that are included in the email to make sure that they are indeed related to Twitter.”

UPDATE #2: Chad McDonald, Chief of Staff and Chief Information Security Officer of Radiant Logic:

“In the latest episode of the Twitter saga, news of the significant data breach resulting in the security expert who reported it being suspended is a huge cause for concern. Security practitioners have often looked to Twitter in the past for updates from colleagues and influencers alike on the latest bugs, vulnerabilities and threat groups. Given the changes that have been brewing at Twitter these last few weeks, it would be incredibly damaging for them to not only be once again responsible for massive amounts of users being breached but that they are also making efforts to cover it up. Twitter must act, quickly, to get a serious handle on how much of their users’ information was leaked and what they plan to remedy the situation.” 

Nine out of 10 Canadian Organizations Were Breached At least Once in the Past Year: Trend Micro

Posted in Commentary with tags on November 25, 2022 by itnerd

Trend Micro Incorporated today announced that 90% of Canadian organizations have had customer records compromised at least once over the past 12 months as they struggle to profile and defend an expanding attack surface. 

The findings come from Trend Micro’s semi-annual Cyber Risk Index (CRI) report, compiled by the Ponemon Institute from interviews with over 4,100 organizations across North America, Europe, Latin/South America, and Asia-Pacific, of which 470 are Canadian.

The CRI calculates the gap between organizational preparedness and the likelihood of being attacked, with -10 representing the highest level of risk. The Canadian CRI index moved from + 0.16 in 2H 2021 to image002.png0.30 in 1H 2022, indicating a surging level of risk over the past six months. 

This trend is also reflected elsewhere in the data: the number of Canadian organizations experiencing a “successful” cyber-attack increased from 83% to 93% over the same period. Unsurprisingly, the number now expected to be compromised over the coming year has also increased from 74% to 86%.

Some of the top preparedness risks highlighted by the index report are related to attack surface discovery capabilities. It is often challenging for security professionals to identify the physical location of business-critical data assets and applications.

From the business perspective, the biggest concern is the misalignment between CISOs and business executives. Based on the scores given by the respondents, “My organization’s IT security objectives are aligned with business objectives” only has a score of 4.35 out of 10.

Overall, Canadian respondents rated the following as the top cyber threats in 1H 2022:

1)      Advanced malware

2)      Cryptomining

3)      Watering hole attacks

4)      Botnets 

5)      Business Email Compromise (BEC)

By addressing the shortage of cybersecurity professionals and improving security processes and technology, organizations will significantly reduce their vulnerability to attacks.

To read a full copy of the latest Cyber Risk Index, please visit: www.trendmicro.com/cyberrisk