go to sections menu

The Technology blog and podcast

This is for the technology blog and podcast Commentary, articles, and podcasts

header picture for Ingegno theme

You are here: July 2020

Go to Homepage [0], contents or to navigation menu

sections menu

fine menu sezioni pagina

The Security Box, podcast 2 for July 22, 2020

The RSS feed has this podcast and the recent released tech podcast. Enjoy!

Welcome to the security box, podcast 2. On this podcast, Twitter takes center stage as it suffered a very interesting security problem they need to solve. People have said it was a big time breach, but as you’ll soon find out, unless you read the tech blog, there is more to the breach. Yes, accounts got breached, but we know there is other info. Articles are listed here for you to review. Besides that, find out about a big time breach article which was a two year look at many different breaches within a two year period. Also, find out about a piece of malware making a huge return on how it can’t! be trackable now a days and what the threat actors are up to.

Depending on time, not everything may be covered. If you see the rundown and you want things covered we didn’t get to, please let us know!

The links to news items are in no particular order, we provide them in the order I put them in. Of course, please contact me through the contact the dj’s page on the mix or through the tech blog itself.

Thanks so much for listening to the program, and we’ll be back with you next time!

In a future podcast, let us talk about the CFAA and whether you think its been effective. Even still, lets possibly talk about Coppa. Have any topics you want discussed security wise? Have terms you don’t understand? The box wants to hear from you!

Comments (0)

Technology podcast 348: VAC, Chinese Software, and your operating systems

The podcast will be available through our RSS feed and will be available through Mixcloud as well. Below, please find the show notes.

Welcome to podcast 348 of the technology blog and podcast series. I’ve decided to change it up a little bit with a different spin on the security aspect, as well as talking about a piece of software that I’ve once used before, but yet, need it again. The setup was quite easy, and I pretty much did it on my own. Then, what do you get when you have to think about the security of your software you use to do your work? What about the type of computer you use such as Windows, Mac or Lynux? Full thoughts and links to items follow.

  • Virtual Audio Cable is a piece of software that acts like a mixer. We’ve talked about it once before, and I believe we’ve demoed it. Its back as I talk about the Security Box and how I’m putting people on air.
  • What do you think about when you think of the Mac? Its not known for viruses, trojans, and worms. However, with this latest development, I begin to wonder if the Mac will start receiving more problems like Windows has for many years. In this article entitled Updates on ThiefQuest, the Quickly-Evolving macOS Malware from Trend Micro, really makes you think. Its got lots of images for those who are sighted,, so you might want to check it out as I talk about it and other operating systems in general.
  • Finally, what do you think about if you were told to install something that you had no idea had a back door? In this article Chinese banks require clients to use tax programs laced with backdoors, report says posted on Cyberscoop, I talk about it and how I’d handle that. I never saw the day that software would be laced with malware and a bit of social engineering would have you install it just to get your work done.

The program is 1 hour and 8 minutes long, and I hope you’ll enjoy the program as much as I have putting it together for you. Thanks so much for listening!

Comments (0)

The latest on twitter: Monday , 7/20 18:00 PT

I was asked about any updates on the twitter situation. While its still in the investigation phase, I’m a little bit concerned, however, we really don’t know what went on so I’m not going to pass judgement.

Here’s the latest from Twitter Support and I thought I’d pass it along.

Twitter Support, We’re sharing a blog post that collects the latest on our investigation. It reiterates what we’ve already shared here, and includes a few new findings. https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html 2 days ago, Twitter Web App

Twitter Support, As of now, we know that they accessed tools only available to our internal support teams to target 130 Twitter accounts. For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets. 2 days ago, Twitter Web App

Twitter Support, We are continuing our forensic review of all of the accounts to confirm all actions that may have been taken. 2 days ago, Twitter Web App

Twitter Support, For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool. We are reaching out directly to any account owner where we know this to be true. 2 days ago, Twitter Web App

Twitter Support, Our investigation and cooperation with law enforcement continues, and we remain committed to sharing any updates here. More to come via @TwitterSupport as our investigation continues. 2 days ago, Twitter Web App

Twitter Support, We hope that our openness and transparency throughout this process, and the steps and work we will take to safeguard against other attacks in the future, will be the start of making this right. 2 days ago, Twitter Web App

Twitter Support, There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts. 2 days ago, Twitter Web App

Here’s a link to that blog post and I hope we continue to learn more.

To add my own thoughts, I don’t think that this was a deliberate act of Twitter. I’m sure someone made a mistake, and the mistakes can give people a falst sense of security if a major breach takes place. Ongoing training was the big point I took from the blog post which I urge everyone to read. The investigation is still ongoing, and I’m sure we’ll learn more. The blog post has a lot of what is quoted from twitter, so please read the entire post. Thanks so much for reading the blog.

There are no news articles at press time from my sources with anything new. The link to Twitter’s blog came directly from Twitter directly.

Comments (0)

Macs being immune for malware? Think again

Yesterday, I read a blog post about malware that really started out by ransomware among other things for the Mac. In an upcoming tech podcast, besides talking about this a little bit, I put it out there about all types of operating systems.

We know that Windows has been a problem for years, but what about Lynux or the Mac? I know that a lot of it has to do with how one uses the machine in question but what if a mistake happens?

In this Trend Micro blog post Updates on ThiefQuest, the Quickly-Evolving macOS Malware you’ll learn what this malware has done, what its doing now, and for the sighted, images as well. Thanks so much for reading and participating on the blog and make it a great day!

Comments (0)

Phishing emails from lastpass wannabees

I love the fact that Lastpass is being transparent. Here is some news and my thoughts on this, with a link to their blog posted yesterday.

Yesterday, Lastpass blogged about the fact that actors are impersonating them in an attempt to get people to turn over their lastpass master password. The master password allows one to authenticate with the platform to gain access to the passwords and other information that may be in one’s account. In the blog post PHISHING ALERT | FRAUDULENT EMAILS REQUESTING MASTER PASSWORD UPDATE Lauren Christopherson talks about what is happening, and has some bullet points on what people using the service should do to make sure they’re using Lastpass corectly. Please take a look at this if you’re a lastpass user. If you use another manager, you should look at this and see if your mannager has any solutions to keep yourself safe in case you happen to make a mistake and open your account to someone else.

Comments (0)

The Childrens online privacy Protection act is here, not following the law by Tik Tok

Tiktok is apparently in trouble after South Korea decided to fine them in their version of the United States Law.

COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites
or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. (“COPPA”) from the FTC July 19, 2020)

Each country has differing laws, the United States indicates that it is under the age of 13, but other countries may be different.

I recently looked this up once before when I really started questioning whether I was following law as a United States citizen running the non-profit MENVI whereby MENVI is bridging the gap between the blind and music education. We assist children, parents, older adults, and educators to find a ground to stand on when it comes to getting the help they need when educating and learning as a blind person.

We did not cover COPPA in the light of MENVI, but mainly was a research project which was covered on the podcast itself. Searching for COPPA on the blog, indicated a dice world post where it entails, but was more of an opinion piece.

Back to the topic at hand, let’s talk about Tiktok. I am unsure if it is accessible or not, but according to the top paragraph, it is siniliar to Youtube whereby it is a video sharing platform. My question is why children are using the service? Children should be learning in education, not dabbling in applications that could yield consequences if the right person were to find them through the service and have them do things through a chat facility if this service has it.

“We hold ourselves to very high standards on data privacy, and work to continuously improve and strengthen our standards,” a TikTok spokesperson said.

Really? Are you saying that this was a mistake? That is definitely nice to hear that it was a mistake. South Korea is suing them at a 3 percent of revenue for the year. Tiktok is not notifying people what they collect to boot.

After my investigation, it turned out that an attorney advised we create a page in which every member must review before they fill out an application to join MENVI. Wikipedia indicates that Coppa was enacted by the 105th congress effected April 21, 2000. This makes this law 20 years old this year. This is not to be confused with the defunked child online protection act which you can read more about on your time.

According to the FTC link above which links to the text, it is a 1998 law, but I believe it may not have been completely passed until 2000, but I am welcome to be corrected if someone with more knowledge of this would like to come forward.

Back to the article that sparked this discussion, this service knowingly hosted content published by under age children. Under age children is defined by the specific law of the country and may differ from 13 to 14, its advised to look at your law in your country where possible. To play it safe, 13 is the minimum age that MENVI will collect information for its metwork before we start questioning whether its legit based on the parent/child section of our application.

Tiktok later announced that it was leaving Hong Kong, part of China. If you’d like to read more about the latest on TikTok, and whether it is a good idea to use their service, I invite you to read the article. Since I’ve not used this service, I have no idea how it works, but it concerns me that it is a Chinese based company where China can tell companys what to do there including turning off the Internet.

From the BBC, please read: TikTok fined for mishandling child data in South Korea for all of the details and links to other things as well. Have fun with this one!

Comments (0)

What is the CFAA and why has it been a problem?

I have not really blogged much of anything coming out of Internet Cases, a blog that covers the Internet, Law, and more. A recent article I found talks about a case that the CFAA was involved in.

What is the CFAA?

The CFAA is better known as the Computer Fraud and Abuse Act. According to Wikipedia, this law was created in 1984 and its goal was to charge people who have unauthorized access or if I understand it correctly, attempt it. According to Wikipedia, this law has gone under many different revisions, and it even touches on the Demand Progress founder and his untimely death as he was to be charged under this act for meerly downloading things from a library.

In recent news coming from Internet Cases however, we also talk about something called Click Fraud. Click fraud is where advertisers are paying money for impressions for visitors that don’t even exist, if I am understanding this whole thing correctly. According to the article title, Click fraud can be a violation of the CFAA, and that could make it interesting because there is no hacking involved by simulating a click, is there?

Click fraud is a problem in online advertising and in situations where companies and advertisers use publishers to promote their content. A federal court
in Delaware recently addressed this problem. 

Plaintiff job search engine sued one of its former “publishing partners” and its owners. Defendants sent out email messages with links to job search results.
Plaintiff paid defendants on a “pay-per-click” basis – a certain amount each time someone clicked on one of the links.

This is how pay per click normally works, under agreements that are made by the parties involved. However, Evan Brown, the author of Internet Cases goes on to discuss how the click fraud works.

Eventually plaintiff noted that “conversions” were low from defendants’ activities. That means there were a lot of clicks on links but not many actual
job applicants. Plaintiff began to suspect defendants were artificially inflating the number of clicks – that is, committing click fraud. The contract
between plaintiff and defendants prohibited this conduct.

After investigating, plaintiff learned one of its employees was allegedly working with defendants to engage in the click fraud scheme. Plaintiff sued defendants,
asserting a number of claims, including one under the federal Computer Fraud and Abuse Act, 18 USC 1030 (“CFAA”).

This makes this very interesting, because in my opinion, clicking something isn’t necessarily a crime. It can be dangerous, but just the meer fact of doing it isn’t a crime. That is how you use a computer.

Here’s what got me interested in this article and the whole CFAA discussion.

The CFAA imposes liability when a plaintiff pleads and proves that a defendant:

• has accessed a protected computer (defined in the statute);
• did so without authorization or by exceeding such authorization as was granted;
• has done so knowingly and with intent to defraud; and
• as a result has furthered the intended fraud and obtained anything of value.

For complete details on this whole case on why the CFAA is involved, please read Click fraud might violate CFAA from Internet Cases and the excellent writing of Evan Brown.

Further Reading

What do you think, dear reader? What do you think of the law? If it needs to be changed, how do we change it? Your thoughts are welcome. Thanks Evan for putting out a great piece of work we should talk about.

Updated 19 July 14:21 PT with fixes to the formatting and shortly before that with some spelling corrections.

Comments (0)

New to the Internet? Trackers are tracking you

I saw this article that asks a very simple question. In today’s Internet, web sites know more about you today than every one else does it seems. The article: Are you being tracked by websites you visit? brings up some very basic things that new users or users not familiar with this type of thing can benefit from. What do you think, dear reader? I’m not going to go through the article, but thought it might benefit people who come across the blog.

Comments (0)

Account Takeover Attacks Cause Chaos at Twitter Headquarters

We know that the primary problem with Twitter was account tools and their use to take over many types of high profile accounts. In an article that Phishlabs posted yesterday, Stacy Shelley brings up yet other aspects of things that we can consider, and these are the experts of Phishing themselves we’re dealing with here.

Security Now! indicated that it was a possible payoff, and this is linked here in Phishlab’s article. In some text of the article, it states:

Tuesday’s Twitter hack is a high profile demonstration of threat actors targeting and using social media accounts as part of their scams. Security leaders
should expect questions about it. Various corporate stakeholders including senior executives and board members will want to know the risk this incident
poses. They will also need to know what, if any, additional steps are being taken to mitigate the risk. 
 
When a social media platform is compromised in this way, accounts can be taken over regardless of how social media users authenticate and protect their
accounts. Enterprises can mitigate the risk by focusing on detection and response.

I always look at my twitter anyhow, and I know the new Braille2000 account is only ran by me. For more from Phishlabs, check out the article: Account Takeover Attacks Cause Chaos @ Twitter and I hope you enjoy this revelation.

There is more to this article including bullet points. Feel free to check it out.

Comments (0)

Contemplating the latest Twitter news from yesterday and today, you still be the judge

I’ve read two articles this morning, and I decided to give it some thought. Both articles are quite good and I had planned to link them accordingingly in a blog post, but what to really say about then i’m still trying to figure out.

The first Mark Nunnikhoven’s article Twitter Hacked in Bitcoin Scam brings up some very interesting points that should be made.

Are Apple, Elon Musk, Barrack Obama, Uber, Joe Biden, and a host of others participating in a very transparent bitcoin scheme?

No. Of course, not. The question was whether or not individual accounts were compromised or if something deeper was going on.

There are headings to various types of things that Mark gives.

  • User Account Protections
  • Rumours SwirlRumours Swirl
  • Occam’s Razor
  • Internal Screenshot

    • Social Engineering

  • Malicious Insider

    • Support Risks and

  • Support Risks

Under each of these headings, Mark goes in to details of what he thinks is going on based on the knowledge we have. The one I keep thinking about which is why I didn’t blog about this this morning was the Malicious Insider aspect of this whole thing. Who might have done this? Was it an accident where an email was sent, or was it possibly done by another means like Skype, Facetime, Hangouts, Twitter itself, Facebook or Linked In? We honestly don’t know this, but we know that social engineering was also a part, and that could be done as we discussed on the first podcast of the box when we discussed Phishing by a myriad of ways. I’m just putting this to thoughts, and I’m going to let you read the articles and let you decide how to take the information.

The next article I have comes from Cyberscoop. We know that approximately 130 different accounts have been potentially compromised by this attack. The article is entitled: Around 130 Twitter accounts targeted in bitcoin scam hack, company says and is written by Jeff Stone. The article links to various other things so its going to be hard to quote anything. good, intellegent thoughts. Thanks for reading and enjoy your afternoon!

There is no news BTW from twitter within the last day so investigating is still ongoing.

What I want people to do is read this and absorb what these excellent articles are saying, and feel free to comment here with your

Comments (0)

Its time for apple news, IOS and Mac updates in this post

I was perusing Apple Vis while I was waking up this morning and there are two articles that may be of interest in their blog in regards to IOS and Mac. I read the IOS one already and this is version 13.6 which has support for a very interesting feature on virtual key capability on the iphone. Apple Releases iOS 13.6 and iPadOS 13.6; Bringing Additional Options for Software Update Downloads, New Features to the News and Health Apps, and More is the article from these guys. There are update improvements introduced in this version as well as more things to track in health.

The IOS update also has some news updates, but perusing the Mac post entitled Apple Releases macOS 10.15.6, watchOS 6.2.8, and tvOS 13.4.8 a lot of the features including thee new car key is introduced in their version as well.

Please make sure you read all of the details on the option that best interests you.

Comments (0)

This week in Security news, news ending July 17, 2020

In the news department for thi week, Trend Micro does have the apparent Hack of twitter. We still need to learn more, although we do know internal tools were involved. Besides that, the Distributed denial of service attacks for hire will be fueling a new wave of attacks, the worm battle for Internet of Things territory, info on Tax Scams since Tax day was pushed to this month due to the Pandemic, Corona Vaccine info being potentially stolen by Russia which should be no surprise to some, and more. Are you interested in anything particular for a technology or security box podcast? Please contact me through my tech at menvi dot org address and I’ll be sure to take a look. If you can provide a link to the story, that would even be better. Thanks so much for reading.

Oh yes, I almost forgot. How can you send me anything if I don’t provide you the article? >This Week in Security News: Trend Micro Research Discovers Cybercriminal Turf War on Routers and a Massive Twitter Breach Compromises Some of the World’s is that article, and thanks again for reading and participating!

Comments (0)

Technology podcast 347: Braille Transcription, Twitter, and Blue Leaks

On this podcast, a few segments, a little different than the security box.

Welcome to the technology blog and podcast, this is podcast 347 of the series. On this podcast, a longer segment on the Blue Leaks issue which I take you the article. Here is the blog post that is linked in the first Security Box which was issued yesterday. Next, Twitter apparently got hacked, or did they? We’ve been publishing blog posts as we learn more with my thoughts, and we’ll be covering this on the Security Box next week. Finally, i have a braille transcription update as I deal with assignment 19. We’ll definitely have more news coming out of the twitter camp. What a mess.

Go to the RSS to pick your copy up of the podcast.

Comments (0)

The Security Box, podcast 1 reissue

I found an error in the show notes but I’ll just reissue the show notes. I apologize for any inconvenience this causes you.

The security box can be found on the RSS feed for you to download and listen to.

Welcome to the security box, podcast 1. While we’re playing a wide variety of music, the music will not be part of the notations. We’re only going to link to things talked about as part of the show itself. The show will be part of the Tech podcast series, but hosted through the independent channel of the suite of servers. I hope that you’ll be enlightened by the discussion, and I encourage discussion. If listening through the podcast itself, contact me through my tech address used through the tech podcast. Mix listeners can contact me through the contact the DJ’s page of the mix. Thanks for listening!

There may be other things I reference that is not going to be specifically linked here. You can visit the tech blog to read anything of interest, as well as searching out stories for future inclusion. There are sources that I don’t have because of the amount I already have to read. As the podcast grows, we may not have so many items, but we’ll see over time. I hope you’ve enjoyed the program listening live, or the podcast if you listen that way. See you next time!

Comments (0)

More Twitter news, … its not what we first thought

Hello everyone, welcome back to the technology blog and podcast’s blog. We’ve got some more twitter news, and its not what we think it is. While there was a hack, it wasn’t a hack in the sense of the term. It was more of the Social Engeneering type of hack, where tools that can bypass two-factor authentication didn’t help them.

Krebs on Security is one source that recently published an article detailing what had happened. Twit’s Security Now Host, Steve Gibson was on a twit show on July 16, 2020 and he talked about how these tools which are administrative tools can bypass two–factor authentication. Krebs article indicate that they can sell fully valid email twitter accounts between 2 and 3 grand a piece. Steve Gibson inicates that it may be possible that an employee may have been paid off to help the intruders.

Who’s Behind Wednesday’s Epic Twitter Hack? is the article that is written by Brian Krebs. Steve tweeted Hackers Convinced Twitter Employee to Help Them Hijack Accounts which apparently has screen shots of the internal tools that Twitter uses to maintain their service. This comes from Motherboard Vice, and I’ve not yet read this article as of yet so can’t comment further.

I’m sure that this story is still developing and news will continue to come out on this and we’ll be here to bring as much of it as possible to you. Thanks for reading and make it a great day!

Comments (0)

Joker malware apps, 17,000 in three years still a problem

We’ve covered the joker malware I believe, and irecently read an article from the Hacker News about it. This malware steals everything from SMS (text messaging) to phone call data. It also has the invasive habit of subscribing people to premium services.

This is why we continually talk about checking your transaction history on a regular basis so that you can spot something you don’t recognize. The details on how this gets in to Android devices is very messy, and I’m not about to try and hash this out in my own blog post as there are many different things it does now.

If you want to read the entire details of this latest invasion in to what this group is up to, Joker Malware Apps Once Again Bypass Google’s Security to Spread via Play Store is the article. This is going to get really interesting. I am not looking forward to this. If you’re an Android user, better watch out and make sure yu’re protected as best as possible.

Comments (0)

Microsoft takes control of criminal domains

In another article ran through last week’s security news, we have learned that Microsoft has taken over key domains in cyberactors infrustructure that seem to now lure users to unwittingly give up their accounts to the actors after being lured through Phishing to a direct Microsoft page. The technical details are quite complex, and the Security Week article Microsoft Files Lawsuit to Seize Fake Domains Used in COVID-19-Themed BEC Attacks explains it well.

Basically, Microsoft has been tracking this since December 2019 but the actors have changed their tactics after the Corona Virus (covid-19) became the talk of 2020. Please read the article linked here. It is well worth the read.

Comments (0)

There are 15 billion credentials, and the number may be growing in the dark web

According to last week in security, there was an article talking about 15 billion creds on the dark web with 10,000 breaches in a 2 year period. We’ve really got a problem when we, the consumer, choose not to change our password after a major breach. Its OK, because we honestly think that the passwords we choose are pretty secure.

I know that I have used similar passwords on some sites that I feel that don’t really have anything that a threat actor may want. The honnest truth is that credential stuffing as its called is a big problem. They want to lock you out of your account, even if it doesn’t really mean anything.

The problem that people like Troy Hunt continue to see is the lack of simple but not very unique passwords by people still today. Troy Hunt owns the web site that asks the question, Have I been powned? All you have to do on this site is enter an email address you’ve used, and he can tell you if it has been in a recent data breach. No passwords are ever shared, and he may have information about the particular breach.

Threat actors  gain access to these credentials in a number of ways—among them phishing, credential-stealing malware and credit-card skimmers–and it’s
never been easier for them to lift this type of sensitive data from user accounts, said Rick Holland, CISO and vice president of strategy at Digital Shadows,
in a press statement.

This tech blog post: Target’s Nightmare Goes On: Encrypted PIN Data Stolen – NYTimes.com is just one linking to what Target had to go through just after their big time breach.

There is a ton of articles and commentary on this blog going back to 2013 if not earlier about this problem, although Target did not have a password problem, their situation is different. What about some of the other breaches you may find through this blog or any other articles you find? What might they tell you?

The article goes on to state that criminal marketplaces have tools for as little as $4 a piece, while bank and credit card data goes for $70 or more because of how valuable it is. Want to read this enlightening story? Threat Post: 15 Billion Credentials Currently Up for Grabs on Hacker Forums is where you’ll need to go, and read all of the juicy details on this emerging problem which I feel is only going to get worse. I wish it really didn’t get worse, but I imagine it will.

Comments (0)

This week in Security News, news ending July 12, 2020

Hello folks, I’ve been behind in weekly blog posts for security news. This blog post has everything from cloud security, to tackling Phishing attacks, and even an article about 15 billion credentials available on the dark web. 100 thoudsand breaches over a two year period is only the beginning of this ongoing problem that hasn’t slowed down at all. Who knows, i may cover some of these on the blog and even on the podcast series. You never know.

To top things off, we’ve even got new Merai updates which I’ve seenbut haven’t gotten a chance to read.

Want to see any of the news? Want to bring something up to the tech podcast or even the new security box podcast? Please let me know and check out the blog: This Week in Security News: 15 Billion Credentials Currently Up for Grabs on Hacker Forums and New Mirai Variant Expands Arsenal for all of the very interesting details. Make it a great day!

Comments (0)

We’ve got an update on the potential Twitter Hack: still a developing story

Earlier this afternoon, Cyberscoop indicated in their blog post that multiple different accounts including the running democratic president among others were targeted to send out crypto mining messages through those accounts. This is still developing, I want to see the post mortum report or something official from Twitter on how this happened.

Cyberscoop asked the question whether these accounts had two factor authentication turned on and if that had any effect in the apparent compromise. For details on this continuing developing story, check out this afternoon’s update from Cyberscoop: Scammers hijack Twitter accounts of Joe Biden, Bill Gates and others to promote cryptocurrency and we’ll see what new news we learn as the days continue. Thanks so much for reading!

Comments (0)

« Newer Posts — Older Posts »

go to sections menu

navigation menu

go to sections menu