New Orleans Technology Services IT Support Cloud Hosting Disaster Management Community Contact APR 22 0 9 TIPS TO BE PRODUCTIVE WHEN WORKING AT HOME By SiteAdministrator | IT Blog, news | No Comments Right now, many companies are suggesting—even requiring—that more employees work from home. Working from home can be a lonely enterprise in this era of social distancing, but it doesn’t have to be. For those who are not used to working at home or who don’t have an organized work station, distractions can disrupt your productivity. After all, you’re in your personal space, not your usual professional environment. Laundry needs to be done, dishes washed and the house cleaned. Plus, maybe you want to see The View since you’re always at the office when it’s on, or there’s a good movie on Netflix you’ve been longing to watch. Your pooch needs to go for a walk or you want to snuggle with him. And your spouse keeps yelling questions from another room, causing you to keep losing your train of thought. Or on the flip side, maybe since being at home 24/7, you find yourself toiling overtime on the job long after you usually would have called it quits at the office. On top of it all, cabin fever could be sneaking up on you. Productivity Tips For Working At Home If you’re not used to working at home, it can take some getting used to new challenges that you might not have at the office. It’s important to have a defined schedule and stick to it. Avoid sleeping in or lingering over breakfast, and get to work just as if you’re driving across town to your office, although you might be walking into the next room. You might think blasting Lady Gaga’s latest hit is the most productive way for you to work. Or loud noises could be the worst thing for you to stay focused and get work done. Everybody is different. Some people work better in clutter while others can’t concentrate unless their workspace is tidy. Regardless of your personal style, here are some tips to facilitate adjusting to your new situation during the coronavirus outbreak: Confine your workspace to a specific area in your home so your job doesn’t intrude into the lives of other household members and you can concentrate. Have a space that you designate as your workstation instead of checking emails, voicemails or texting in front of the TV or spreading work out on the kitchen table. Make your space a stress-free zone of quiet and solitude where you can concentrate. If you don’t have a separate room, find an area with minimum traffic flow or a corner of a room off from the main area. Block the neighbor’s barking mutt, excess noise from household members or ambient traffic with noise-canceling headphones or earbuds. Studies show that a delicate blend of soft music combined with soothing nature sounds—such as waterfalls, raindrops, a rushing brook or ocean waves—activates the calming part of your brain, helps you concentrate and lowers heart rate and blood pressure Go to the same designated place on a regular basis so your mind doesn’t wander, you can focus and increase your productivity. Establish water-tight psychological boundaries so you’re not constantly reminded of temptations around you (there’s chocolate cake in the fridge) or unfinished personal tasks—such as doing laundry, vacuuming or organizing your spice rack—that otherwise could compromise your productivity. And complete these personal activities outside of work hours as you normally would. Set water-tight physical boundaries around your designated workspace that is off-limits for housemates. Treat it as if it’s five miles across town, and ask house members to consider it as such (e.g. no interruptions from another room when you’re engrossed in a project unless an emergency). If possible, only go to your designated space when you need to work. Stick to a regular schedule, and keep your workspace at arm’s-length after hours. Try to maintain the same hours you log in at the office so you don’t get swallowed up by the workload. After a reasonable day’s work, put away your electronic devices and work tools just as you would store carpentry tools after building shelves or baking ingredients after making a cake. Keeping work reminders out of sight keeps them out of mind and helps you relax and recharge your batteries. Discourage personal intrusions. If you’re a teacher or doctor, friends don’t just stop by the office to chat, hang-out or interrupt your work. But sometimes well-intended friends, family members and neighbors think working at home is different. Interruptions and drop-ins can cause you to lose your focus, procrastinate or get behind on a deadline. It’s important to prevent intrusions into your workspace by informing others that although the location of your job has changed, it is no different from any other profession requiring privacy and concentration. Notify others that during at-home work hours you’re unavailable and cannot be interrupted. And let them know the after-hours when you’re available to connect. Employ your video communications perhaps more than you normally would, now that you’re more isol ated. Make sure you have your company’s telecommuting devices—such as Zoom—hooked up and ready to go so you can stay connected with team members or office mates and you’re available for video calls and teleconferencing. If you start to feel lonely, consider setting up a support group of friends and colleagues who are also working at home by satellite. Make plans to meet on a regular basis and share creative ways you’ve adjusted to the new situation. Avoid cabin fever. Now that you’re spending a disproportionate amount of time at home, get outside as much as possible with gardening or walking around the block. Mounting research shows that spending time in nature lowers stress, helps you relax and clears your mind. After work hours, enjoy other areas of your home: watching a good movie, reading a book, or cooking a fun meal. And lead as much of a full social life as possible such as having non-symptomatic friends over for dinner. The new normal is not to limit social devices but to take advantage of them. Use Facetime, Facebook or Skype with friends and family members so you feel connected to the people in your life that you care about. Keep your attitude in check. Above all, be creative and don’t let your confined circumstances dwarf your tranquility, happiness or productivity. Your greatest power is your perspective. It can victimize you or empower you. When you look for the upside in a downside situation and figure out what you can control and what you can’t, it’s easier to accept whatever is beyond your control. Your best ally is to find the opportunity in the difficulty during an uncontrollable situation instead of the difficulty in the opportunity. Take advantage of this restrictive time to clear the clutter out of your basement, pull weeds in the garden or get caught up on fun hobbies you’ve neglected for a while. OCT 21 0 A DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACK IS AN ATTEMPT TO MAKE AN ONLINE SERVICE UNAVAILABLE BY OVERWHELMING IT WITH TRAFFIC FROM MULTIPLE SOURCES. THEY TARGET A WIDE VARIETY OF IMPORTANT RESOURCES, FROM BANKS TO NEWS WEBSITES, AND PRESENT A MAJOR CHALLENGE TO MAKING SURE PEOPLE CAN PUBLISH AND ACCESS IMPORTANT INFORMATION. SEP 01 0 CHECK IF YOUR DATA HAS BEEN COMPROMISED VIA DATA BREACH By Happy Blogger | IT Blog | No Comments WHAT IS A “BREACH” AND WHERE HAS THE DATA COME FROM? A “breach” is an incident where data is inadvertently exposed in a vulnerable system, usually due to insufficient access controls or security weaknesses in the software. The website https://haveibeenpwned.com/ aggregates breaches and enables people to assess where their personal data has been exposed. ARE USER PASSWORDS STORED IN THIS SITE? When email addresses from a data breach are loaded into the site, no corresponding passwords are loaded with them. Separately to the pwned address search feature, the Pwned Passwords service allows you to check if an individual password has previously been seen in a data breach. No password is stored next to any personally identifiable data (such as an email address) and every password is SHA-1 hashed (read why SHA-1 was chosen in the Pwned Passwords launch blog post.) CAN I SEND USERS THEIR EXPOSED PASSWORDS? No. Any ability to send passwords to people puts both them and myself at greater risk. This topic is discussed at length in the blog post on all the reasons I don’t make passwords available via this service. IS A LIST OF EVERYONE’S EMAIL ADDRESS OR USERNAME AVAILABLE? The public search facility cannot return anything other than the results for a single user-provided email address or username at a time. Multiple breached accounts can be retrieved by the domain search feature but only after successfully verifying that the person performing the search is authorised to access assets on the domain. WHAT ABOUT BREACHES WHERE PASSWORDS AREN’T LEAKED? Occasionally, a breach will be added to the system which doesn’t include credentials for an online service. This may occur when data about individuals is leaked and it may not include a username and password. However this data still has a privacy impact; it is data that those impacted would not reasonably expect to be publicly released and as such they have a vested interest in having the ability to be notified of this. HOW IS A BREACH VERIFIED AS LEGITIMATE? There are often “breaches” announced by attackers which in turn are exposed as hoaxes. There is a balance between making data searchable early and performing sufficient due diligence to establish the legitimacy of the breach. The following activities are usually performed in order to validate breach legitimacy: Has the impacted service publicly acknowledged the breach? Does the data in the breach turn up in a Google search (i.e. it’s just copied from another source)? Is the structure of the data consistent with what you’d expect to see in a breach? Have the attackers provided sufficient evidence to demonstrate the attack vector? Do the attackers have a track record of either reliably releasing breaches or falsifying them? WHAT IS A “PASTE” AND WHY INCLUDE IT ON THIS SITE? A “paste” is information that has been “pasted” to a publicly facing website designed to share content such as Pastebin. These services are favoured by hackers due to the ease of anonymously sharing information and they’re frequently the first place a breach appears. HIBP searches through pastes that are broadcast by the @dumpmon Twitter account and reported as having emails that are a potential indicator of a breach. Finding an email address in a paste does not immediately mean it has been disclosed as the result of a breach. Review the paste and determine if your account has been compromised then take appropriate action such as changing passwords. MY EMAIL WAS REPORTED AS APPEARING IN A PASTE BUT THE PASTE NOW CAN’T BE FOUND Pastes are often transient; they appear briefly and are then removed. HIBP usually indexes a new paste within 40 seconds of it appearing and stores the email addresses that appeared in the paste along with some meta data such as the date, title and author (if they exist). The paste itself is not stored and cannot be displayed if it no longer exists at the source. MY EMAIL WAS NOT FOUND — DOES THAT MEAN I HAVEN’T BEEN PWNED? Whilst HIBP is kept up to date with as much data as possible, it contains but a small subset of all the records that have been breached over the years. Many breaches never result in the public release of data and indeed many breaches even go entirely undetected. “Absence of evidence is not evidence of absence” or in other words, just because your email address wasn’t found here doesn’t mean that is hasn’t been compromised in another breach. HOW DOES HIBP HANDLE “PLUS ALIASING” IN EMAIL ADDRESSES? Some people choose to create accounts using a pattern known as “plus aliasing” in their email addresses. This allows them to express their email address with an additional piece of data in the alias, usually reflecting the site they’ve signed up to such as test+netflix@example.com or test+amazon@example.com. There is presently a UserVoice suggestion requesting support of this pattern in HIBP. However, as explained in that suggestion, usage of plus aliasing is extremely rare, appearing in approximately only 0.03% of addresses loaded into HIBP. Vote for the suggestion and follow its progress if this feature is important to you. HOW IS THE DATA STORED? The breached accounts sit in Windows Azure table storage which contains nothing more than the email address or username and a list of sites it appeared in breaches on. If you’re interested in the details, it’s all described in Working with 154 million records on Azure Table Storage – the story of Have I Been Pwned IS ANYTHING LOGGED WHEN PEOPLE SEARCH FOR AN ACCOUNT? Nothing is explicitly logged by the website. The only logging of any kind is via Google Analytics, Application Insights performance monitoring and any diagnostic data implicitly collected if an exception occurs in the system. WHY DO I SEE MY USERNAME AS BREACHED ON A SERVICE I NEVER SIGNED UP TO? When you search for a username that is not an email address, you may see that name appear against breaches of sites you never signed up to. Usually this is simply due to someone else electing to use the same username as you usually do. Even when your username appears very unique, the simple fact that there are several billion internet users worldwide means there’s a strong probability that most usernames have been used by other individuals at one time or another. WHY DO I SEE MY EMAIL ADDRESS AS BREACHED ON A SERVICE I NEVER SIGNED UP TO? When you search for an email address, you may see that address appear against breaches of sites you don’t recall ever signing up to. There are many possible reasons for this including your data having been acquired by another service, the service rebranding itself as something else or someone else signing you up. For a more comprehensive overview, see Why am I in a data breach for a site I never signed up to? CAN I RECEIVE NOTIFICATIONS FOR AN EMAIL ADDRESS I DON’T HAVE ACCESS TO? No. For privacy reasons, all notifications are sent to the address being monitored so you can’t monitor someone else’s address nor can you monitor an address you no longer have access to. You can always perform an on-demand search of an address, but sensitive breaches will not be returned. DOES THE NOTIFICATION SERVICE STORE EMAIL ADDRESSES? Yes, it has to in order to track who to contact should they be caught up in a subsequent data breach. Only the email address, the date they subscribed on and a random token for verification is stored. WHAT EMAIL ADDRESS ARE NOTIFICATIONS SENT FROM? All emails sent by HIBP come from noreply@haveibeenpwned.com. If you’re expecting an email (for example, the verification email sent when signing up for notifications) and it doesn’t arrive, try white-listing that address. 99.x% of the time email doesn’t arrive in someone’s inbox, it’s due to the destination mail server bouncing it. HOW DO I KNOW THE SITE ISN’T JUST HARVESTING SEARCHED EMAIL ADDRESSES? You don’t, but it’s not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you’re concerned about the intent or security, don’t use it. IS IT POSSIBLE TO “DEEP LINK” DIRECTLY TO THE SEARCH FOR AN ACCOUNT? Sure, you can construct a link so that the search for a particular account happens automatically when it’s loaded, just pass the name after the “account” path. Here’s an example: https://haveibeenpwned.com/account/test@example.com HOW CAN I SUBMIT A DATA BREACH? If you’ve come across a data breach which you’d like to submit, get in touch with me. Check out what’s currently loaded into HIBP on the pwned websites page first if you’re not sure whether the breach is already in the system. WHAT IS A “SENSITIVE BREACH”? HIBP enables you to discover if your account was exposed in most of the data breaches by directly searching the system. However, certain breaches are particularly sensitive in that someone’s presence in the breach may adversely impact them if others are able to find that they were a member of the site. These breaches are classed as “sensitive” and may not be publicly searched. A sensitive data breach can only be searched by the verified owner of the email address being searched for. This is done via the notification system which involves sending a verification email to the address with a unique link. When that link is followed, the owner of the address will see all data breaches and pastes they appear in, including the sensitive ones. There are presently 25 sensitive breaches in the system including Adult Friend Finder, Adult-FanFiction.Org, Ashley Madison, Beautiful People, Bestialitysextaboo, Brazzers, CrimeAgency vBulletin Hacks, Fling, Florida Virtual School, Freedom Hosting II, Fridae, Fur Affinity, HongFire, HTH Studios, Mate1.com, Muslim Match, NapsGear, Naughty America, Non Nude Girls, Rosebutt Board and 5 more. WHAT IS A “RETIRED BREACH”? After a security incident which results in the disclosure of account data, the breach may be loaded into HIBP where it then sends notifications to impacted subscribers and becomes searchable. In very rare circumstances, that breach may later be permanently remove from HIBP where it is then classed as a “retired breach”. A retired breach is typically one where the data does not appear in other locations on the web, that is it’s not being traded or redistributed. Deleting it from HIBP provides those impacted with assurance that their data can no longer be found in any remaining locations. For more background, read Have I Been Pwned, opting out, VTech and general privacy things. There is presently 1 retired breach in the system which is VTech. WHAT IS AN “UNVERIFIED” BREACH? Some breaches may be flagged as “unverified”. In these cases, whilst there is legitimate data within the alleged breach, it may not have been possible to establish legitimacy beyond reasonable doubt. Unverified breaches are still included in the system because regardless of their legitimacy, they still contain personal information about individuals who want to understand their exposure on the web. Further background on unverified breaches can be found in the blog post titled Introducing unverified breaches to Have I Been Pwned. WHAT IS A “FABRICATED” BREACH? Some breaches may be flagged as “fabricated”. In these cases, it is highly unlikely that the breach contains legitimate data sourced from the alleged site but it may still be sold or traded under the auspices of legitimacy. Often these incidents are comprised of data aggregated from other locations (or may be entirely fabricated), yet still contain actual email addresses unbeknownst to the account holder. Fabricated breaches are still included in the system because regardless of their legitimacy, they still contain personal information about individuals who want to understand their exposure on the web. Further background on unverified breaches can be found in the blog post titled Introducing “fabricated” breaches to Have I Been Pwned. WHAT IS A “SPAM LIST”? Occasionally, large volumes of personal data are found being utilised for the purposes of sending targeted spam. This often includes many of the same attributes frequently found in data breaches such as names, addresses, phones numbers and dates of birth. The lists are often aggregated from multiple sources, frequently by eliciting personal information from people with the promise of a monetary reward . Whilst the data may not have been sourced from a breached system, the personal nature of the information and the fact that it’s redistributed in this fashion unbeknownst to the owners warrants inclusion here. Read more about spam lists in HIBP . WHAT DOES IT MEAN IF MY PASSWORD IS IN PWNED PASSWORDS? If a password is found in the Pwned Passwords service, it means it has previously appeared in a data breach. HIBP does not store any information about who the password belonged to, only that it has previously been exposed publicly and how many times it has been seen. A Pwned Password should no longer be used as its exposure puts it at higher risk of being used to login to accounts using the now-exposed secret. IT’S A BIT LIGHT ON DETAIL HERE, WHERE CAN I GET MORE INFO? The design and build of this project has been extensively documented on troyhunt.com under the Have I Been Pwned tag. These blog posts explain much of the reasoning behind the various features and how they’ve been implemented on Microsoft’s Windows Azure cloud platform. JUL 01 0 DON’T GET HOOKED BY A PHISHING SCAM By SiteAdministrator | IT Blog, Security | No Comments Email, texts, and other forms of digital communication are an integral part of your daily life. Cybercriminals know this and are lurking on nearly every platform, counting on you to fall for phishing scams hook, line, and sinker. Phishing is when scammers masquerade as reputable companies or individuals and use phone calls, email, direct message, or text message to lure you into sharing your sensitive personal information, like usernames, passwords, and bank account or credit card details. They might also use email attachments to secretly invade your computer via software or malware and steal confidential information directly. As technology becomes more advanced, so do phishing attacks — both in their level of sophistication and in number. According to the Anti-Phishing Working Group, an international coalition focused on fighting cyber crime, the number of phishing schemes discovered during the first quarter of 2018 increased 46 percent over the fourth quarter of 2017. Many businesses, from e-commerce retailers to financial institutions to email providers, use the latest technology to fight back against fraudsters. You can be part of the battle as well — by using low-tech surveillance to sniff out the scam. To protect yourself against a phishing attack, always be on the lookout these red flags in any messages you receive: A sense of urgency An unknown sender Request for action An unsolicited offer NOW IT’S TIME TO TEST YOUR KNOWLEDGE. Can you catch a phisher in the act? Take a look at the following potential red flags. Which ones sound (or smell) phishy? The answers are revealed at the end. 1. You receive an email with the subject line, “Banking Alert: Need to Transfer Funds Immediately or Be Subject to Fee.” And the message itself is written in the same alarmist tone. 2. The sender’s name is the top executive of your bank and their email address is YourCEO@mycommunitybank.com. 3. Someone calls with the offer to increase your credit limit. To receive the boost, you’re asked to provide your account number. 4. An email informs you that an unauthorized person tried to access your account and you must click on the included link to reset your password. 5. An email from an ecommerce site you frequent about a problem with your payment has numerous misspellings. 6. Your bank sends you a text asking you to confirm your checking account number. 7. A financial planner emails from the company where your 401(k) is invested, but there’s no contact information or email signature. 8. A text informs you that your account has been suspended and to reinstate it, you must reply with your account login credentials. 9. You receive an email from someone you don’t know requesting you to download an attachment. 10. An email from an online payment service informs you of a discrepancy with your account. To rectify the situation, you need to click the included link and login to your account. 11. A bank sends you an email informing you of an inheritance from a deceased relative and that you must contact them to claim it. 12. A message invites you to download a shared document from Dropbox or to view one on Google Docs. If you answered “phishy” to each one of these, you’re correct. We’re not out to trick you, so we wanted to provide you clear examples of what you might experience when being targeted by a phishing scam. Curious to know more about each scam? Here’s a bit more about how these schemes work, how to spot the warning signs and ways that you can maintain your privacy. 1. Scammers bet that a sense of urgency and alarmist tone will cause you to freak out and do what’s asked of you immediately. 2. An email or voice message has more credibility when someone in a powerful position sends it. That’s why fraudsters imitate authoritative figures. The wonky email address, however, is a dead giveaway. 3. If a legit financial institution is offering you a credit limit increase, they have access to your account. You don’t need to provide them the details. 4. You should always be wary when asked to click on a link in an email. To determine whether a URL is real or fake, hover over the link with your mouse. If the URL differs from what you know it to be or what appears in the email — any slight misspelling or tiny change matters — don’t click. 5. Businesses always put their best foot forward. So bad grammar and misspellings are dead giveaways that an email is fake. 6. Think about it: Your bank created your account number. It never needs you to confirm it. 7. Legitimate businesses always provide contact information, so a lack of details should make you suspicious. 8. Reputable businesses never suspend customer accounts out of the blue or ask customers to share their login credentials. 9. Scammers use attachments to transfer dangerous viruses and malware to your computer. Malware can unknowingly spy on you or steal your passwords. To keep your personal information private, only open attachments you are expecting — even if they’re sent by someone you know. 10. It’s unlikely that a legitimate payment service or financial institution is going to ask you to click a link to login. Before clicking, test any link by hovering your mouse over it. If it looks strange, don’t click. Or type the address directly into a new window and look for its secure certificate. 11. This one is pretty easy to see through. If a family member has died, you’re probably going to know about it already. (Why would your bank know before you?) 12. Sharing documents via an external storage or cloud system is more common than ever, making it an appealing target for scammers. If you frequently use one of these storage systems, protect your account with two-step verification. Phishing poses a significant threat to your personal information and knowing how to ID a phishing attack is often the best defense. After all, if you fail to take the bait, the phisher will swim on. NOV 14 0 YOUR PHONE IS LISTENING AND IT’S NOT PARANOIA By Happy Blogger | IT Blog | No Comments FROM VICE NEWS: HERE’S HOW I GOT TO BOTTOM OF THE ADS-COINCIDING-WITH-CONVERSATIONS MYSTERY. All images by the author A couple years ago, something strange happened. A friend and I were sitting at a bar, iPhones in pockets, discussing our recent trips in Japan and how we’d like to go back. The very next day, we both received pop-up ads on Facebook about cheap return flights to Tokyo. It seemed like just a spooky coincidence, but then everyone seems to have a story about their smartphone listening to them. So is this just paranoia, or are our smartphones actually listening? According to Dr. Peter Henway—The senior security consultant for cybersecurity firm Asterix, and former lecturer and researcher at Edith Cowan University—the short answer is yes, but perhaps in a way that’s not as diabolical as it sounds. For your smartphone to actually pay attention and record your conversation, there needs to be a trigger, such as when you say “hey Siri” or “okay Google.” In the absence of these triggers, any data you provide is only processed within your own phone. This might not seem a cause for alarm, but any third party applications you have on your phone—like Facebook for example—still have access to this “non-triggered” data. And whether or not they use this data is really up to them. Whispering some sweet nothings to my phone “From time to time, snippets of audio do go back to [other apps like Facebook’s] servers but there’s no official understanding what the triggers for that are,” explains Peter. “Whether it’s timing or location-based or usage of certain functions, [apps] are certainly pulling those microphone permissions and using those periodically. All the internals of the applications send this data in encrypted form, so it’s very difficult to define the exact trigger.” He goes on to explain that apps like Facebook or Instagram could have thousands of triggers. An ordinary conversation with a friend about needing a new pair of jeans could be enough to activate it. Although, the key word here is “could,” because although the technology is there, companies like Facebook vehemently deny listening to our conversations. “Seeing Google are open about it, I would personally assume the other companies are doing the same.” Peter tells me. “Really, there’s no reason they wouldn’t be. It makes good sense from a marketing standpoint, and their end-use agreements and the law both allow it, so I would assume they’re doing it, but there’s no way to be sure.” With this in mind, I decided to try an experiment. Twice a day for five days, I tried saying a bunch of phrases that could theoretically be used as triggers. Phrases like I’m thinking about going back to uni and I need some cheap shirts for work. Then I carefully monitored the sponsored posts on Facebook for any changes. I’d never seen this ad for “quality clothing” until I told my phone I needed shirts The changes came literally overnight. Suddenly I was being told mid-semester courses at various universities, and how certain brands were offering cheap clothing. A private conversation with a friend about how I’d run out of data led to an ad about cheap 20 GB data plans. And although they were all good deals, the whole thing was eye-opening and utterly terrifying. Peter told me that although no data is guaranteed to be safe for perpetuity, he assured me that in 2018 no company is selling their data directly to advertisers. But as we all know, advertisers don’t need our data for us to see their ads. “Rather than saying here’s a list of people who followed your demographic, they say Why don’t you give me some money, and I’ll make that demographic or those who are interested in this will see it. If they let that information out into the wild, they’ll lose that exclusive access to it, so they’re going to try to keep it as secret as possible. Peter went on to say that just because tech companies value our data, it doesn’t keep it safe from governmental agencies. As most tech companies are based in the US, the NSA or perhaps the CIA can potentially have your information disclosed to them, whether it’s legal in your home country or not. So yes, our phones are listening to us and anything we say around our phones could potentially be used against us. But, according to Peter at least, it’s not something most people should be scared of. Because unless you’re a journalist, a lawyer, or have some kind of role with sensitive information, the access of your data is only really going to advertisers. If you’re like everyone else, living a really normal life, and talking to your friends about flying to Japan, then it’s really not that different to advertisers looking at your browsing history. “It’s just an extension from what advertising used to be on television,” says Peter. Only instead of prime time audiences, they’re now tracking web-browsing habits. It’s not ideal, but I don’t think it poses an immediate threat to most people.” Follow Sam on Twitter Still freaked out about all this? Check out our series Internet Hygiene for information on protecting yourself online. This article originally appeared on VICE AU. OCT 25 0 WE LEFT THE INTERNET VULNERABLE TO HACKERS. NOW WE’RE PAYING THE PRICE. By Happy Blogger | IT Blog, news, Security | No Comments On the day (perhaps not long from now) when the entire internet crashes, no one will be able to say that we didn’t see it coming. The denial-of-service attack on the morning of Oct. 21—which shut down Twitter, Spotify, Netflix, and a dozen other websites—offers a preview, in miniature and against relatively trivial targets, of how the day of doom might unfold. Fred Kaplan Fred Kaplan Fred Kaplan is the author of Dark Territory: The Secret History of Cyber War. In the attack, someone (identity as yet unknown) flooded Dyn DNS—a New Hampshire–based firm that operates as the internet’s switchboard—with so many online messages that its circuits overloaded, shutting down not only its own services but those of the other sites as well, at least for several hours. The weapons amassed for this attack were, literally, toys—baby monitors, music servers, web cameras, and other home devices that connect to one another, automatically sending and receiving data through the internet. Hence the name of this emerging network—the Internet of Things. The saboteur had hacked into hundreds of thousands of these devices and infected them with malware, so that, at a designated moment, all them sent messages to the real target—in this case, Dyn DNS—and shut it down. The malware was simple: a program called Mirai, which, in the words of an alert sent out by the Department of Homeland Security, “uses a short list of 62 common default usernames and passwords to scan for vulnerable devices.” Get Slate in your inbox. This is what few consumers have understood about the Internet of Things: All of these nifty devices are computers with, in some cases, quite powerful data processors. And, like all computers, their operating systems are preprogrammed with usernames and passwords. The default usernames and passwords tend to be obvious: 12345, username, password—more than covered by the 62 words on Mirai’s scan-list. However, unlike most computers, the Internet of Things devices are on all the time, and there’s no user interface for even tech-savvy consumers to monitor the machines’ activities. As one Silicon Valley technologist (who requested anonymity because he works for a firm that makes some of these devices) put it, “My TiVo needs an internet link only to download TV guide metadata every fortnight, but as far as I know it’s also working overtime serving viruses or DNS attacks.” The technologist went on: “Who’s to know what’s running on your interlinked Nest thermostat or your refrigerator? Borderline impossible. And all that stuff is interconnected to websites and accounts with credit cards and other attractive targets for hackers. Given the radical increase in traffic that these devices generate, it will get easier to hide malicious streams of network traffic in the noise.” There are now about 10 billion IoT devices in the world. (The estimates range from 6.4 billion to 17.6 billion, depending how the term is defined.) Some estimate that, by 2020, the figure will climb to 50 billion. That’s a lot of bots that a hacker can enslave for an attack. Back in 1996, Matt Devost, Brian Houghton, and Neal Pollard wrote an eerily prescient paper called “Information Terrorism: Can You Trust Your Toaster?” They foresaw an era when household appliances would all be wired to the internet. Life would be more convenient, time would be saved—and everything you own would be vulnerable to hacking. Devost, who went on to run Red Team operations in NATO war games and is now managing director of Accenture Security, says that, if anything, he understated the threat. He saw the phenomenon—and people today continue to see the Internet of Things—as posing “microthreats”: hackers messing with our personal stuff, turning our lives upside down, possibly even killing us. See, for instance, the experiment, just last year, when a former National Security Agency employee named Charlie Miller hacked into the onboard networks of a Jeep Cherokee and commandeered its steering wheel, accelerator, brakes—everything in the vehicle. But in their paper of 20 years ago, Devost and his co-authors did not foresee “macrothreats”: hackers aggregating “smart” devices to mess with society. “Imagine it’s one of those mid-August days,” Devost said, “100 degrees with roaming brown-outs. What if a hacker ordered the IoT devices in a few large commercial buildings to turn up their air conditioners to max level? He could do real damage to the power grid.” And even this scenario is minor compared to the sort of attack presaged in last week’s incident—a hacker enslaving hundreds of thousands (or even millions or billions) of IoT devices to launch a massive denial-of-services attack that shut down, say, a whole city’s power generators or some other facility in the nation’s critical infrastructure. That phrase “critical infrastructure” came into vogue in the late 1990s—to refer to power grids, banking and finance, oil and gas, transportation, water, emergency services, and other sectors on which a modern society depends—when a presidentially appointed panel, known as the Marsh Commission, discovered that all of those sectors were vulnerable to hackers. Over the previous decade, the private corporations controlling these sectors all started to realize the enormous savings involved in hooking up their control systems to this new thing called the internet. Money transfers, energy flows, train switches, dam controls—they could all be monitored and managed swiftly, automatically, efficiently. No one considered the possibility that bad guys could hack into those networks and route the money, energy, trains, or water for criminal or destructive purposes. The dangers should have been clear even then. As far back as 1967, at the very dawn of the internet, when its military precursor known as the ARPANET was about to roll out, a man named Willis Ware—head of the Rand Corporation’s computer science department and member of the NSA’s scientific advisory board—wrote a paper warning of its implications. Once you put information on a network—once you make it accessible online from multiple, unsecure locations—you create inherent vulnerabilities, Ware concluded. You won’t be able to keep secrets anymore. When I was researching my book Dark Territory: The Secret History of Cyber War, I asked Stephen Lukasik, the person running the ARPANET program at the Pentagon’s Advanced Research Projects Agency, whether he’d read Ware’s paper. Sure, Lukasik told me. He told me that he took the paper to his team members, who also read it and begged him not to saddle them with a security requirement. It would be like telling the Wright brothers that their first plane at Kitty Hawk had to fly 50 miles while carrying 20 passengers. Let’s do this step by step, they said. It had been hard enough to get the system to work. Besides, the Russians wouldn’t be able to build something like this for decades. It did take decades—about three decades—but, by then, vast systems and networks had sprouted up in the United States and much of the world with no provision for security. This was the bitten apple in the digital Garden of Eden. The sin was built into the system from its conception. Corrections could have been made, security provisions could have been built in, once the utilities started hooking up the nation’s critical infrastructure to the internet—or, if they’d known of the risks, they might have decided not to get wired in the first place. And now, with the Internet of Things, we’ve begun to extend the mistake into our homes, into the stuff of our everyday lives. Some remedies have been taken even since this past Friday. The Chinese firm Hangzhou Xiongmai Technology Co., Ltd., which makes components for some of the surveillance cameras hacked in last week’s denial-of-service attack, announced that it was recalling products from the United States. Dahua Technology, another Chinese company, offered firmware updates on its websites for customers who had bought its cameras and video recorders. But these are small measures, not likely to have much effect even on these specific products, much less those made in the past several years or in the years to come. In the late 1990s, when the utilities’ vulnerabilities first came to light, Richard Clarke, then the White House counterterrorism chief, proposed imposing mandatory cybersecurity requirements on all industries connected to critical infrastructure. The companies lobbied against his plan, as did President Bill Clinton’s economic advisers, who warned that the measures would cripple these companies’ competitiveness in the global market. Clarke also suggested putting the government and critical-infrastructure industries on a parallel internet, which would be wired to certain agencies that could detect intrusions. This plan was leaked and denounced as “Orwellian.” “If we could go back 30 years, we would probably do things differently,” Matt Devost reflected. We shouldn’t wait till it’s too late, he added, to put some limits on the Internet of Things. For instance, he suggested, the United States should impose regulations requiring all IoT devices to come with locks, so that consumers can’t activate them without first changing the default password—and maybe requiring the new password to be sufficiently long and complex to make it resist simple password-scanning malware, like Mirai. When companies started putting power grids on the internet, the net itself was new and the art of hacking hadn’t spread. Maybe a few hundred people in the world knew how to exploit its vulnerabilities; now a few million do. It’s important to understand that much more is at stake than a brief shutdown of Twitter. As Bruce Schneier, a prominent cybersecurity analyst, put it in a blog post that he published in September, a month before this recent attack, “Someone is learning how to take down the Internet.” He noted that several attacks of precisely this sort—but smaller, the kind of incidents that specialists see but that elude mainstream notice—have been occurring in the past couple years. This probably isn’t the work of criminals or mischievous researchers; they wouldn’t be interested in the targets or capable of mounting attacks of such scope. Rather, Scheier wrote, the whole trend “feels like a nation’s military cyber-command trying to calibrate its weaponry in the case of cyberwar. It reminds me of the U.S.’s Cold War program of flying high-altitude planes over the Soviet Union to force their air-defense systems to turn on,” so the U.S. Air Force could map the capabilities of Soviet radars and figure out how to elude them. Is that what’s happening now? Is some nation-state figuring out how many IoT devices it takes to shut down larger chunks of the internet, and thus our society, as a whole? It sounds like paranoid science fiction from the 1960s, but the writers of that stuff were trying to scan the future as an extension of what was happening at the time, and in this case, they might have been on target. OCT 24 1 ARTIFICIAL INTELLIGENCE PART OF THE NEW G SUITE (GOOGLE APPS) By Happy Blogger | Google, IT Blog | No Comments Artificial intelligence is central to Google’s cloud productivity apps, recently rebranded as G Suite. Likewise, Microsoft is infusing Office 365 with AI. Google has something of a penchant for changing the names of its products, and the latest one to be given a new moniker is Google Apps for Work. From now on – or until the next name change, at least – the collection of cloud-based productivity applications which includes Gmail, Docs, Drive, Calendar and Hangouts will be known as G Suite. What Is in a G Suite Name According to Kelly Campbell, senior director of G Suite marketing, Google Cloud, the new name is intended to reflect Google Apps for Work’s mission: “to help people everywhere work and innovate together, so businesses can move faster and go bigger.” The “G” part obviously refers to Google, while the “Suite” part emphasizes the fact that the apps are designed to work together (like Lotus SmartSuite, the venerable group of productivity applications that IBM discontinued in 2013). There’s also a pun on c-suite, the term that refers to a large company’s top executives. So the name encompasses Google, integration between applications and large companies, and that’s the real message Google is trying to get across with the rebranding, said TJ Keitt, a senior analyst at Forrester Research. “Google wants people to look at its product as a suite rather than a loose assemblage of disparate apps. And it wants to pivot from selling consumer technology to enterprises and draw attention to applications that have been developed specifically for the enterprise market.” G Suite Has AI Inside At the heart of this pivot to the enterprise market is the infusion of a healthy dose of Google’s artificial intelligence (AI) technology into the various components of G Suite, explained Prabhakar Raghavan, Google Cloud’s vice president, Apps, in a blog post. Airwatch Support for Office 365 Download Now “A year ago, Smart Reply launched, offering auto-generated replies for emails that only need a quick response. Now, more than 10 percent of all replies on mobile are sent using Smart Reply. The reception has been so strong that we’re continuing to apply machine intelligence across our suite to solve customer problems,” Raghavan wrote. Related Articles Another example of this is Quick Access in Drive on Android, a feature which selects what it thinks are the most relevant files to the work you are doing so they are easily accessible when Drive is opened. It chooses files based on interactions with colleagues, recurring meetings and other activity in Drive. “Machine intelligence helps Drive understand the rhythm of your workday and offers the files you need before you even ask,” said Raghavan. “Our customer research shows that Quick Access saves about 50 percent of the time an employee would usually spend finding a file.” Yet another example is the intelligence that has been implanted into Google Calendar to help find a time when multiple invitees to a meeting are free and to suggest rooms based on previous room bookings. G Suite vs. Microsoft Office 365 One question mark over G Suite’s acceptance as an enterprise product is its ability to appeal to enterprises in which usage of Microsoft productivity tools is nearly ubiquitous. Most people have trained or grown up with Microsoft’s Office products, and in the cloud its Office 365 service is a direct competitor to G Suite. Microsoft has also been adding AI into its productivity suite – in the form of Office Graph and Delve, for example. And IBM, the other significant player in the enterprise cloud productivity app game, can include Watson’s AI in its offerings. “The question really comes down to this: Which parts of the market do Google and Microsoft compete evenly in, and where does Microsoft have a big advantage?” Keitt said. “In big organizations, Microsoft has an advantage because it is more flexible. Microsoft has on-premise offerings and single-tenancy offerings, but Google insists on multi-tenancy so it makes it hard for some companies to adopt it. But in the smaller enterprise market Google can compete.” While Keitt is doubtful that Google would ever move toward a dedicated hosting model to boost its appeal to larger enterprises, the company has made some concessions, he pointed out. “They have, for example, disaggregated their services so that you can have Google Drive separately, but they won’t stray too far unless there is a specific market opportunity like the U.S. federal sector,” he said. Given that Google is unwilling to compete head-on with Microsoft in the large enterprise space, it is worth considering why it bothers getting involved in the enterprise market at all. Can it possibly be worthwhile to run an offering like G Suite? “Everything that Google does which is not advertising is miniscule,” Keitt said. “It’s about business diversification. They see something that could disrupt their advertising revenue and they get involved.” But he also believes that Google is involved in business apps — and many other activities — simply because of the nature of the beast. “Google is an engineering business so it tinkers with things, and it happened to discover an opportunity. Now it is hard to extract itself from it because it has made federal deals; extracting itself from those would be damaging.” In fact G-Suite is aligned with Goggle’s founding principle of making information more accessible to people and usable to them, Keitt said. “Every business it gets involved in is about information: mapping, email, content distribution … So the proposition to business is how to make it easier to locate expertise and information in the organization, and Google can do this using its apps and its AI technology.” Paul Rubens has been covering enterprise technology for over 20 years. In that time he has written for leading UK and international publications including The Economist, The Times, Financial Times, the BBC, Computing and ServerWatch. MAR 23 0 RUSSIAN ANTIVIRUS FIRM KASPERSKY UPSET OVER REPORTS OF KGB TIES By Happy Blogger | news, Security | No Comments Eugene Kaspersky, head of Russia-based security software supplier Kaspersky Lab, is fighting allegations that his company has “close ties” to Russian spies. Last week, Bloomberg Business published an article accusing Kaspersky Lab of excluding Russia from reports examining electronic espionage by the United States, Israel, and the United Kingdom. Bloomberg traced an alleged change in focus at the anti-virus shop back to 2012, when high-level managers began exiting the company and being replaced by what the news service claimed were “people with closer ties to Russia’s military or intelligence services.” “Some of these people actively aid criminal investigations by the FSB, the KGB’s successor, using data from some of the 400 million customers who rely on Kaspersky Lab’s software,” Bloomberg said, citing current and former employees who went unnamed in the article. “This closeness starts at the top,” Bloomberg continued. “Unless [CEO] Kaspersky is traveling, he rarely missed a weekly banya (sauna) night with a group of about five to 10 that usually includes Russian intelligence officials.” While the chief did not deny the social gatherings, he did assert that they are not conspiratorial, and that the presence of spies was purely coincidental. Kaspersky (pictured) spoke out late last week, writing in a blog entry that Bloomberg’s piece is nothing more than sensationalism. “Exploiting paranoia is always a great tool for increasing readership,” he said, adding that, “It’s been a long time since I read an article so inaccurate from the get-go—literally from the title and the article’s subheading.” As security expert Graham Cluley pointed out, Bloomberg’s story was published just two days after Kaspersky revealed more details about the long-running “Crouching Yeti” attacks, which target a number of countries—but not Russia. The nation’s absence may seem odd, Cluley said, until you read that, according to Kaspersky, the authors of Crouching Yeti were likely Russian speakers. “Clearly Bloomberg missed that piece of information,” Cluley said. Investigating state-sponsored attacks can be awkward for any company: Silicon Valley-based FireEye CEO Dave DeWalt told The Wall Street Journal that he would think twice before publicizing a hacking campaign by government-backed Americans. Kaspersky has indeed probed attacks attributed to Russian cyber-spies, including Red October, CloudAtlas, CosmicDuke, and Epic Turla. “I must have said this a million times, but we do not care who’s behind the cyber-campaigns we expose,” Kaspersky wrote in his blog. “There is cyber-evil and we fight it. If a customer comes and shows us a problem we investigate it. And once we take the genie out of the bottle, there’s no way we can put it back.” //RELATED ARTICLES China Drops Symantec, Kaspersky as Approved Antivirus Vendors He continued to pick apart the Bloomberg article line-by-line, responding to a number of allegations and attempting to set the record straight. Meanwhile, Kaspersky alluded to dealing with mistrust as a Russian company when he tweeted last week that the company’s next research conference will provide better accommodations. “It’s very hard for a company with Russian roots to become successful in the U.S., European, and other markets. Nobody trusts us—by default,” Kaspersky said. “Our only strategy is to be 100 percent transparent and honest. It took years to explain who we are. Many people attempted to find ‘dirt’ on us—and failed. Because we’ve nothing to hide.” MAR 09 0 APPLE SALES NEWS By SiteAdministrator | Apple, news | No Comments U.S. Sales SHIPPING APRIL 10 MacBook on Apple.com THE NEW MACBOOK At just 2 pounds and 13.1 mm thin, the new MacBook is Apple’s thinnest and lightest notebook. It features a stunning 12-inch Retina display, new Apple-designed keyboard, all-new Force Touch trackpad, fifth-generation Intel Core M processors, fast PCIe-based flash storage, and all-day battery life. And it’s available in three gorgeous metal finishes—Gold, Space Gray, and Silver. The new MacBook is designed for a wireless world and is the ideal notebook for customers looking for the complete Mac experience in Apple’s most portable notebook ever. NOW AVAILABLE Mac on Apple.com UPDATES TO MAC NOTEBOOKS 13-inch MacBook Pro with Retina display The 13-inch MacBook Pro with Retina display now features the all-new Force Touch trackpad, fifth-generation Intel Core processors, next-generation Intel Iris Graphics 6100, and ultrafast PCIe-based flash storage. It’s the ideal notebook for enthusiasts and professionals looking for fast performance in an incredibly compact and light design. MacBook Air The MacBook Air line now features fifth-generation Intel Core processors, next-generation Intel HD Graphics 6000, and a Thunderbolt 2 port. And with all-day battery life, MacBook Air will go with you and stay with you the entire day. AVAILABLE APRIL 24 Apple Watch on Apple.com APPLE WATCH – COMING IN APRIL Apple Watch will be available on Friday, April 24 to customers in Australia, Canada, China, France, Germany, Hong Kong, Japan, the UK, and the U.S. On Friday, April 10, Apple Watch will be available for pre-order through the Apple Online Store. And Apple Retail Stores and select department store shop-in-shops will begin offering customers the chance to preview their choice of Apple Watch and try it on. For more details, see the press release. ResearchKit on Apple.com RESEARCHKIT INTRODUCED Apple has created ResearchKit, an open source software framework designed for medical and health research to help doctors and scientists gather data more frequently and more accurately from participants using iPhone apps. Several world-class research institutions have already developed apps with ResearchKit for studies on asthma, breast cancer, cardiovascular disease, diabetes, and Parkinson’s disease. These apps are available on the App Store in the U.S. today, and will be available in more countries in the future. ResearchKit will be released in April. See the press release and website for more details. AVAILABLE APRIL 2015 (U.S. ONLY) Apple TV on Apple.com HBO NOW ON APPLE TV, IPAD, AND IPHONE With HBO NOW, Apple customers have an incredible new way to watch many of their favorite HBO programs. They can subscribe to HBO right from an Apple TV or iOS device—no cable or satellite subscription required—and get instant access to every episode of every season of HBO’s award-winning original shows and Hollywood blockbusters. HBO NOW will be available for just $14.99 a month with no long-term contract or commitment. Customers can sign up on Apple TV, iPad, iPhone, or iPod touch, and get the first month for free. MAR 09 0 RECYCLE YOUR OLD COMPUTER OR DISPLAY WITH SIMS ZERO-LANDFILL POLICY. By SiteAdministrator | New Orleans, news | No Comments If all you want is to dispose of your unwanted equipment — regardless of brand — we can help you do that. Just drop off your old computer or display at our office and we will ship your old electronics to Sims Recycling Solutions…for free. We’ll make sure that your product is safely recycled at one of Sims Recycling Solutions domestic processing facilities where a zero-landfill policy and proven sustainability give you peace of mind in knowing that your electronics will be managed responsibly. Sims Recycling Solutions responsibly recycles computers and displays from any manufacturer. Next Entries » RECENT BLOG ENTRIES 9 Tips To Be Productive When Working At Home Live DDoS Attack Data Map Check if your data has been compromised via data breach Don’t Get Hooked by a Phishing Scam Your Phone Is Listening and it’s Not Paranoia BLOG CATEGORIES Apple Apps ATT Droid facebook Google iPhone IT Blog Microsoft New Orleans news Security SEO Uncategorized Verizon BLOG ARCHIVES Blog Archives Select Month April 2020 October 2019 September 2019 July 2019 November 2018 October 2016 March 2015 February 2015 September 2014 July 2014 January 2014 December 2013 November 2013 October 2013 September 2013 July 2013 June 2013 May 2013 April 2013 March 2013 January 2013 December 2012 November 2012 October 2012 July 2012 June 2012 April 2012 March 2012 February 2012 January 2012 November 2011 October 2011 August 2011 July 2011 June 2011 May 2011 April 2011 March 2011 February 2011 January 2011 December 2010 November 2010 RECENT POSTS 9 Tips To Be Productive When Working At Home April 22, 2020 Live DDoS Attack Data Map October 21, 2019 CONTACT Phone: (504) 407-1436 Hours: Mon-Fri. 9:00 a.m. – 5:00 p.m. OUR PARTNERS IT SUPPORT Small Office IT Support Midsize/Large Office IT Support Enterprise IT Support Apple Support CLOUD HOSTING Google Apps for Work Office 365 & Hosted Exchange Hosted Cloud Backups Server Hosting Website Hosting DISASTER MANAGEMENT Data Recovery Disaster Prevention COMMUNITY IT Blog Employment Apple Store for Business