Random Acts of Technology

06
May
2020

How to Create a PR Disaster and Make People Hate You: The Frontier Airlines Story

Ars Technica reports about a recent decision by Frontier Airlines to make people pay to potentially avoid contracting COVID-19 or any other disease really. Frontier’s executive team decided, in their infinite wisdom, to charge people $89 for a guaranteed empty middle seat and at the same time force their PR people to try and explain how this is good for their customers (good luck with that). So while social distancing is mandated in many states, Frontier is going to charge you $89 to comply with that mandate. Rather than being thankful they have any passengers at all, they would rather try and force them to pay more in the hope that they can maintain their health both during and after their flight. Classy.

At a time where the nation and world need companies at their best and most socially responsible, Frontier has decided to head in the opposite direction. I appreciate them reminding me why I have not and will not ever fly their airline willingly. Why not go show them some love for their new policy on their Twitter feed.

05
May
2020

EventBot Android Malware and Why I Won’t Leave the iPhone

The Hacker News reports that there is a new Android based malware called “EventBot” that is making the rounds in rogue app stores and APK download sites that are not part of the official Google Play ecosystem. In reading The Hacker News article, this sounds pretty nasty but it begs the question, why are users of Android devices are so bent on using app stores and websites that they have no way of know are providing legitimate apps or not? It makes no sense to me.

  • Is it because they don’t know any better?
  • Is it because their phone manufacturer pushes some junk alternative app store to their customers?
  • Is it because they want to use apps they can’t in the Google Play store?
  • Is it because they want to feel rebellious?
  • Is it because they don’t want to be kept down by the “man?”

I have no idea, and I don’t know why these phone users expose themselves to these risks with such a valuable trove of information sitting on their device.

Full disclosure, I am an Apple iPhone user, and probably will be forever. It’s not because I love everything Apple and must have everything Apple. Clearly that isn’t the case given my professional background. It is a combination of economic factors, security factors, and usability factors.. I am bought into the Apple mobile device app ecosystem and it is too costly to leave.

Apple Strengths

There are some things that Apple does do better than the Android community can do, primarily because it is a closed ecosystem.

  1. They keep their users safer because bad actors have a much harder time getting truly malicious software past the app store guardians. Sure there are people that jail break their iPhones, but let’s face it, they are few and far between and most users don’t care to spend the time doing so only to void their Apple Care plan.
  2. I don’t care what kind of Snapdragon processor you have in your Android phone or many milliamp-hours your battery is rated for, they just cannot outlast and out perform an iPhone. You may be able to outperform an iPhone at certain tasks and drain your battery in an hour, or you may be able to make your battery last all day but not get any performance but you won’t be able to do both easily. I have yet to see an Android phone (you can throw any Samsung SXX model out there at this) hold up against any serious comparison to the iPhone processors and battery life combination. I attribute this to the closed Apple ecosystem as well. The software written for apple devices is always highly optimized for just that platform. There is no need to trade off compatibility for performance or battery life. Android’s open ecosystem approach just can’t do this effectively when you have hundreds or thousands of device models you have to play nicely with.
  3. The phones are reliable and they don’t crash*. I can’t count the number of times I have had Android OS phones just restart on me in the past or crash outright. Maybe it was a bad app, or maybe my specific manufacturer’s device model wasn’t tested with the app. Or maybe it was a combination of the app and some random launcher I am using on my Android phone that caused it. Needless to say, my iPhone 11 pro just doesn’t crash, at all. It reboots when I want it to or when it does an update.

*assuming you aren’t running a beta version of their iOS software or trying to us a really old device with a new iOS version. If you want to be bleeding edge or never buy new hardware, you are going to have issues on any platform.

Android Strengths

On the flip side, you can do some really cool things with Android devices that you can’t do with Apple devices.

  1. You can interact with your device at the hardware level and as long as you give an app permission to do it, they can do a whole lot. Want to record phone calls? No problem. Want to quickly and easily side load an app? No problem. Want to completely change how your phone keys work? No problem. Android is all about letting people do what they want when they want. For better or worse.
  2. You can make the phone look and feel exactly how you want. Don’t like that app launcher? Change it. Don’t like the app manager and user interface? Change it. Want the light to flash purple when you get a slack message? Go for it. Again, Android is all about the ability to make the phone do anything you want, regardless of the performance and security impacts it may have.
  3. You can find a model of phone with just the features you want at the price you want. There is no “Apple tax” when buying an Android device. Just pick the model from the thousands out there that fits your needs and budget.

What is Best For Me

The nerd in me loves these things about Android, but the practical user side of me does not. When I pick up my phone I want to know that it is going to work without any issues – every time. I don’t want to worry about a new app launcher eating up my battery and destroying the CPU usage. I don’t want to worry if that app I just downloaded has malware in it it. I don’t want to have to manage app permissions at such a granular level that I have to worry about every little thing it has access to in the OS.

At the end of the day, I just want a device that works. That means iPhone with iOS will consistently be more capable and secure for my use case. I am willing to live with the lack of customization in some respects in order to have a better overall user experience with performance and security. An experience that doesn’t require my constant attention to achieve. I have enough other things to worry about each day, my phone should not have to be one of them.

23
Mar
2020

Information Security in the Age of COVID-19

The Hacker News is running several interesting articles related to information security and COVID-19 as they relate to emerging threats. Specifically, the threats that a newly mobilized remote workforce faces when many of them have little on detecting threats outside of their normal work environment. While the article referenced specifically touts Cynet’s service offering, the guidance offered is applicable across the board.

Take for example, all of your new remote workers who are receiving all or some of their direction via personal communication channels whether they be phone, SMS, or email. How many of these staff are capable of discerning phishing messages on their personal devices? It is one thing when they have a corporate suite of products assisting them to make these judgement calls, but when they don’t have those can they still be trusted to determine who the bad actors are? In all likelihood the answer is going to be that remote workers are going to be less capable of protecting themselves without new training programs and time to become acclimated to their new reality. COVID-19, however, has made it so there is no time to do so in the face of mandates to have 100% of your workforce out of the office. Introducing new training for these workers about how to protect themselves in this chaotic time is going to be crucial not only for them but also for the well being of the organization as a whole. In addition to training, all information security teams should be looking at how to best to detect unauthorized data loss as well as unauthorized access into corporate networks. It also goes without saying that any remote access solutions should also be protected by two-factor authentication.

Be well, be safe, and secure your networks.

23
Jan
2020

Microsoft Exposes Elasticsearch Database to the World

Security Week reports that Microsoft has suffered a mishap with a handful of its Elasticsearch databases causing approximately 250 million customer support records to be exposed. While financial information for these clients was not exposed, it does appear that the data could be used for phishing attacks and tech support scams.

Of course the kicker is that Microsoft runs one of the largest cloud services on earth where users must take great pains to secure these systems that they setup. Now it turns out the company running these types of services can’t secure their own systems. While I know that these Elasticsearch databases were not really part of the Azure cloud service, it does beg the question that if Microsoft can’t secure their own systems, how can their clients ever hope to completely secure their own systems in the Azure cloud. If nothing else, this should serve as a reminder that no company, person, organization, etc. is immune to security lapses and great care should always be taken to secure both internal and cloud systems.

03
Dec
2019

VNC Client and Server Software Vulnerabilities Found

The Hacker News reports that dozens of new VNC client and server vulnerabilities have been found in the open source versions of the tools used by IT departments all over the world. If you are like me and think “VNC, who uses that any more?” then you should go check out a YouTube video by Tobias Mädel where he connects to open VNC servers all over the internet. Sure, the video is from 2015, but when you think about how quickly industrial plant management software and device firmware is updated you can bet money that there are still plenty of open VNC servers still running and accessible.

The moral of the story? Don’t expose critical systems and services (like RDP and VNC) over the internet unless it is absolutely essential. If it is essential, and you can’t put them behind a VPN, then you had better use a very strong and complex password to secure the access. Even with a VPN you should do that. Lastly, you need to makes sure you and any vendor you are purchasing software and devices from have a strong policy of pushing out updates anytime a vulnerability is found. You can’t afford to wait five years for an update when your chemical plan control system is left completely exposed on the internet through remote access software flaws.

18
Nov
2019

Minecraft Hour of Code 2019: For Everyone but Chromebook Users

Microsoft made an interesting decision this year to not support the hour of code event on Chromebooks. While sure, that seems like a non-event, most people don’t use Chromebooks… except for schools and students. As a parent of a student in a district that uses Chromebooks for their classroom work, this is disappointing to say the least. The whole point of the hour of code event is to get kids involved in coding and to learn. To do that the event has to be inclusive and support the platforms that students have access to. Chromebooks are incredibly common in education where schools need to provide a computing platform that is easy to manage and relatively inexpensive. To exclude a platform such as this is to make the hour of code an event exclusive to those who can afford more expensive platforms which violates the entire principle of the event.

You can be better than this Microsoft, time to make the hour of code accessible to all kids.

17
Nov
2019

Surprise! John Legere Won’t Be WeWork CEO

Engadget is reporting that John Legere, while once a possibility floated as the next WeWork CEO, is no longer in the running. Sure the convenient excuse for this is that Softbank is the majority owner in both WeWork and Sprint which T-Mobile is merging with so there is a conflict of interest. I get it, and it is a completely reasonable explanation for why Mr. Legere will not be the next WeWork CEO.

However, I would speculate that he also wants nothing to do with the dumpster fire that is WeWork currently. He would go from the savior of T-Mobile to the CEO of a company that is despised and mired in turmoil. I don’t care how much of a turnaround CEO you are, willfully walking into a company like WeWork right now is not the note you want your career to go out on. Much better to be the person who successfully merges and T-Mobile and Sprint than to be the one that goes down on the WeWork ship.

13
Nov
2019

The End is Nigh! Time to Ditch Windows 7 Now

ITWorld has a very interesting long running series of articles chronicling the slow but steady demise of Windows 7 and the slow but stead rise of Windows 10 in terms of market share. Come January 14th 2020, Windows 7 support will officially end (unless you want to keep paying Microsoft for security updates on a per PC basis) and you will no longer get all of those critical updates needed to keep your organization secure.

What amazes me about the whole process is the prediction by Net Applications that Windows 7 may retain 10+ percent market share well into 2022, long after support has ended and almost every known flaw will be easily exploitable. Don’t get me wrong, I know first hand how painful it can be to update and replace thousands of physical PCs to get rid of an old OS but as hard as that may be, it is well worth it. In my own experience, the reduction in vulnerabilities just from going to a fully patched version of Windows 7 to a fully patched version of Windows 10 will make a world of difference on your audit scorecards.

Please do you and your organization a favor and move to Windows 10 now. You will be happy you did and it will allow you to sleep better at night.

12
Nov
2019

Robotic Process Automation Goes Open Source

If you have had your eyes and ears open at all for the past year or so, you know the new hotness is Robotic Process Automation (RPA) in enterprise IT. Basically that is a really fancy name for a system that mimics a user’s actions on another system so that a person doesn’t have to do it. Truth be told, there have been scheduling and automation platforms around for a long time that have done a lot of what modern RPA solutions are doing. The biggest difference is that the focus is now more about interacting with a GUI versus just focusing on what could already be done through scripting like moving files around.

This week Robocorp and the Robot Framework have been starting to make a splash within the industry as the first organizations looking to take the RPA movement into the open source space and make it more accessible to organizations that don’t want to buy into a major commercial platform or that want to do something more custom with their current tool set.

As a user of commercial RPA technologies currently, the idea of an open source framework and a company looking to make that more accessible to the masses is very exciting. The cost of current RPA solutions is a significant barrier to entry for many smaller organizations and Robocorp has the chance to increase the user base for RPA significantly by making it more cost effective for these smaller organizations. Just knowing that this is coming in the future makes me want to spin up a virtual machine with the Robot Framework running to start playing around. Then when Robocorp has a product ready, I can be primed to pick up and start using their solution.

After all, as their site says:

If you can document it, you can automate it. Never send a human to do a machine’s job.

https://careers.robocorp.com/

That is music to my programming ears 🙂