Recent News | SecurePC LLC - Computer Repair, Maintenance and Security

Apple Recall Affects Some Macbook Pro Batteries

If you recently bought a 13-inch MacBook Pro (without a Touch Bar), you’ll want to head to Apple’s website. The company didn’t make a big announcement, but they’ve quietly introduced a battery replacement program that impacted what the company described as a “limited number” of laptops.

The company didn’t provide many details, but apparently, on certain machines an unknown component failure can cause the built-in battery to swell. There’s no danger of an explosion and no fire hazard associated with the failure, but the company is playing it safe and offering to replace the batteries on any affected laptop, free of charge.

According to details on Apple’s website, the laptops in question were manufactured between October 2016 and October 2017. If you visit the webpage, you can enter your machine’s serial number to see if your machine is affected, and thus eligible for the free replacement.

At this time, it’s unclear precisely how many machines this issue has impacted. But clearly, Apple wants to put this issue to rest as quickly as possible.

Battery swelling is a strange symptom, but surprisingly, this is not the first time Apple products have suffered from similar issues. Not long ago, Apple’s 42mm Smart Watches suffered a similar problem, prompting the company to issue a similar recall. The company also recently extended their warranty on first-gen Apple Watch models by two years, offering free battery replacements for up to three years after the date of purchase.

These recent moves have caused iPhone owners to cry foul. On the heels of the Apple “Throttling” drama last year, the company offered a discounted battery replacement program to help bring older iPhones with failing batteries back to full speed. While Apple’s $29 discounted battery price is a significant savings over the regular price of $79, some users argue that the batteries should have been free for these products as well.

Google Changing Name Of Android Wear Without Updates

Wearable computing devices from smart watches to glasses are struggling to find an audience, and Google’s Android Wear operating system hasn’t gotten much love in recent years. It has weakened as major players in the tech space have struggled to find a market for these products. On the face of it, these products would seem to be wildly popular, but still haven’t quite captured the imaginations of a critical mass of the consuming public.

Google’s recent announcement that it was rebranding Android Wear to “Wear OS,” is the most significant move we’ve seen in over a year. However, without significant updates, simply changing the name isn’t going to improve the OS’s visibility or viability.

The name change was driven by the fact that when the OS was first released, it appeared only on smart watches, but the company later added iPhone compatibility, which made the name less than perfectly applicable. In a blog post related to the rebranding effort, Google referred to Wear OS as “a wearables operating system for everyone.”

It’s hard to make a convincing argument that Google is all that interested in wearables. One needs only to compare the company’s handling of Wear OS with the way Apple handles wearable products and OS’s.

We had to wait two and a half years between the version 1.0 and version 2.0 of Wear OS. Android Wear was released more than 13 years ago, and since its release, the company hasn’t made any updates or announcements except for the recent blog post announcing its rebranding.

There are some signs that Google has long term plans for the floundering operating system, though. The company has been recruiting high-profile brands including Tommy Hilfiger, Michael Kors, Hugo Boss, Guess, Gc, Fossil and others to make and sell Android watches. It will be interesting to see what the company does in coming months.

Microsoft Ending Forum Support For Older Operating Systems

Big changes are coming from Microsoft starting in July (exact date unknown), and it has potentially dire implications if you’re using some of the company’s older technology.

Microsoft announced that in July, they’ll no longer provide forum-based support for a wide range of products and software, including:

Microsoft Band
Zune
Surface Pro
Surface Pro 2
Surface RT
Surface 2
Microsoft Security Essentials
Internet Explorer 10
Office 2010
Office 2013
Windows 7
Windows 8.1
Windows 8.1 RT

Although the company didn’t cite a specific reason for the change, it seems obvious that this is another move to push people into buying the latest and greatest of the company’s offerings. Unfortunately for them, the announcement has been met with more than a little hostility, and for good reason.

Consider that the company has pledged to continue to support Windows 7 until 2020, and Windows 8.1 (and variants) until 2023. Given that we’re still quite some distance from those EOL dates, closing an important avenue of support for a product the company is still ostensibly supporting seems a bit premature. Nonetheless, there’s no indication at this time that the company has plans to extend the forum support for any of these products beyond July.

In some instances, this won’t prove to be problematic. Few people still use Internet Explorer 10 as anything more than a curiosity, and Zune was never especially popular, so the loss of those forums isn’t likely to cause much backlash. However, in the case of Windows 7 and 8.1, not only has the company pledged support for years to come, but those products are still actively used by a significant minority around the world, and those users aren’t thrilled with the recent announcement.

In any case, given that the company is unlikely to change course, this is all the more reason to make upgrading a priority if you’re still using any of the products mentioned above.

Bank Employee Steals Info On Over A Million Customers

Atlanta-based SunTrust Bank is the 12^th largest bank in the US. They have a major problem, and so do roughly a million and a half of its customers. According to CEO William Rogers, an unidentified employee of the firm printed a vast amount of private customer information, including their names, addresses, phone numbers and account balance information.

Rogers stressed that social security numbers, account numbers, driver’s license numbers, user IDs, and passwords were not exposed. In a recent press release, he had the following to say:

“In conjunction with law enforcement, we discovered that a former employee while employed at SunTrust may have attempted to print information on approximately 1.5 million clients and share this information with a criminal third party.

We and third parties have done forensic analysis on these accounts and we have not identified significant fraudulent activity regarding the effect of the accounts.”

Even so, this is a blow to the company’s image, and the lost trust won’t be easily regained. It also underscores how vulnerable companies are to internal threats.

In response to the attack, SunTrust is offering ongoing IDnotify identity protection (offered through Experian) to all its current and new clients at no cost.

The company’s handling of the issue so far has been about as good as can be expected. The unfortunate reality is that there aren’t many good ways of stopping a rogue employee from making off with sensitive customer data or proprietary company information. Better auditing protocols and controls can help, but only to a certain extent. While those kinds of policies make it easier to detect when an internal theft has occurred, they do nothing to actually prevent them.

This puts management in a tricky spot. Employees have to be trusted with sensitive data in order to do their work, which also increases risk. There aren’t many good solutions here beyond better vetting of employees, but of course, that is by no means a magic bullet either.

New InvisiMole Malware Turns Your System Into A Video Camera

Another week, another new threat. This time, in the form of a new strain of malware that researchers are calling InvisiMole. The new threat was discovered by researchers at ESET, who found it on a number of hacked computers in Russia and the Ukraine.

While the researchers have yet to trace the software back to the group that developed it, based on the available evidence, the campaign appears to be tightly targeted and highly selective. Only a few dozen computers have been found to be infected, although all impacted systems are both high-profile and high-value.

As for the software itself, it’s a nasty piece of business capable of quietly taking control over an infected system’s video camera and capture audio. This allows them to both see and hear anything going on in the vicinity of the system. Essentially then, InvisiMole turns your computer into a compromised Amazon Echo.

Based on the sophisticated design of the software and the fact that the researchers have yet to be able to trace it back to the source, it’s believed that it has been developed by (or at least in partnership with) an unknown state actor. Although the current campaign is small and highly targeted, given its capabilities, InvisiMole could easily become a much more serious threat.

Even worse, it’s entirely possible that the original developers could lose control of the code, or that some other hacker group could reverse engineer it, causing it to spread far and wide.

Research into the software is still ongoing, and at this point ESET can’t say with certainty how the malicious payload is being delivered to target machines. Of course, at present, there is no antivirus software defense against it. Stay on your guard. You never know who might be watching.

Some Private Posts On Facebook May Have Been Exposed

<img class=”alignnone size-full wp-image-8011 alignleft” src=”https://www.securepc-wi.com/wp-content/uploads/2018/07/facebook-post-resized.jpg” alt=”” width=”300″ height=”225″ />Facebook is in hot water again. Recently, the company admitted that while testing a new feature on the site, they inadvertently made public the posts of more than fourteen million users. The incident occurred between May 18th and May 22nd and occurred when Facebook was testing a new “Featured Posts” enhancement.

The goal was that users could selectively make posts visible to everyone. Unfortunately, the error created a situation where any posts users in the test group made were automatically shared to everyone. The company found and corrected the mistake on May 27th, but during the intervening span of days, any posts those users made were set to global visibility. Facebook is currently in the process of contacting the impacted users and asking them to review any posts they made during the impact period.

Chief Privacy Officer Erin Egan had this to say: “To be clear, this bug did not impact anything people had posted before – and they could still choose their audience just as they always have. We’d like to apologize for this mistake.”

Unfortunately, this is not the first time in the recent past that Facebook has gotten into hot water over the mishandling of user data. Earlier this year, Facebook CEO Mark Zuckerberg had to testify before Congress when it came to light that the company acknowledged they had improperly shared private information pertaining to tens of millions of its users with Cambridge Analytica, which used the information in an attempt to influence the most recent presidential election.

Even if you’re not a member of the test group, if you use Facebook and made any posts between May 18th and May 27th when the company fixed the bug, it pays to review your posts just to make sure that their visibility has been properly set.

Are Lasers The Answer To Completely Wireless Computing And Charging?

Researchers at the University of Washington just might change the face of computers and computing forever. It may seem like the stuff of science fiction, but based on their research, the day may soon be coming when computing devices are completely un-tethered, requiring no wires for either power or recharging.

The team was able to successfully charge a smartphone from across a room using nothing more than lasers. Right now, their approach has an effective range of about forty feet. Devices are detected by way of acoustic “chirps” which occur below the threshold of human hearing. Once a target device is located, the laser charging system sends power to them using laser light, with no damage to the target device.

Right now, the power transfer is limited to just a couple of watts. However, the researchers don’t see any obstacles that would prevent scaling of the power transfer, meaning it could easily be modified to power PCs.

Wireless Power Transfer (WPT) is not a new idea. In fact, it’s in use today in such things as smartphones and electric toothbrushes. The problem, at least until now, has been a matter of range, which has been virtually nonexistent until the University’s game-changing experiments.

The big breakthrough wasn’t in sending power to a device via laser. Scientists have known that was possible for quite some time. The issue though, was that when lasers (or microwaves) were used to send power, they were invariably hazardous to humans in the area. In addition, they often fried the electronics they were attempting to power. The research team seems to have solved for both of those problems.

While the technology is still quite some distance from being commercially available, this is a huge leap forward. This could forever change the way we interact with our computing devices, and that change could come much sooner than anyone ever imagined.

New Malware Takes Screenshots and Steals Your Passwords

Recently, a new strain of malware called “SquirtDanger” has been found by researchers at Palo Alto Networks Unit 42, and it’s a particularly nasty one for a couple of reasons. First and foremost, the owner of the malware isn’t orchestrating campaigns himself, but rather, selling his product as a commodity on the Dark Web.

That has troubling implications because the malware is quite advanced, and since it’s being sold to a broad cross-section of hackers, odds are excellent that it will be used in numerous campaigns that could affect a number of industries.

As for the software itself, it gives the hackers who purchase it a vast array of tools. It communicates back to its controller every minute, giving the hackers who use the malware a tremendous amount of useable data.

Among other things, SquirtDanger can take live-action screen shots of an infected device, steal passwords, and send, receive, or delete files on the target system. It can also swipe directory information and drain the contents of cryptocurrency wallets, making it something of a “Jack-of-All-Trades” malware.

Also, there’s no single attack vector being used to infect machines with SquirtDanger. According to the research team, the most common means of infection is that the malware is disguised as a piece of legitimate software and installs when the poisoned executable file is run.

Researchers from Unit 42 had this to say on the matter: “Being infected with any type of malware represents significant danger to an individual or victim. However, because of the large list of capabilities this malware family includes, it would certainly be very bad for the victim.”

At latest count, the researchers have discovered 1,277 unique SquirtDanger samples in the wild, tied to 119 unique command and control servers that were widely geographically dispersed. Odds are, there are many more samples that have yet to be discovered. Be on your guard, it doesn’t appear that this threat will abate anytime soon.

The U.S. Is The Most At Risk Nation For Cyber Attacks

Being “number 1” isn’t always a good thing. Rapid7 has just published their third annual “National Exposure Index,” and unfortunately, the United States has the dubious honor of being the nation most at risk for a cyber attack on its core services. The group’s methodology for ranking national exposure comes down to tracking the number of exposed services and comparing this number to the nation’s total allocated IP address space.

Ranked in this way, the top four most vulnerable countries are:

The United States
China
South Korea
The UK

All told, these four nations control more than 61 million servers listed on at least one of the points surveyed by Rapid7.

Drilling down a bit more deeply, the report also contained this chilling fact:

“There are 13 million exposed endpoints associated with direct database access, half of which are associated with MySQL. Along with millions of exposed PostgreSQL, Oracle DB, Microsoft SQL Server, Redis, DB2, and MongoDB endpoints, this exposure presents significant risk of crucial data loss in a coordinated attack.”

Given that this year has already given us the largest DDOS attack in the history of the internet, Rapid7’s findings should not be taken lightly. The risks are very real, which is why the company is so strongly committed to the publication of their annual report.

As they put it:

“…national internet service providers in these countries can use these findings to understand the risks of internet exposure, and that they, along with policymakers and other technical leaders, are in an excellent position to make significant progress in securing the global internet.”

A lofty goal indeed. Unfortunately, although the data is illuminating, there are no quick or easy answers here, especially in the United States. Thus far, the U.S. has struggled to put together a cohesive digital security policy at the national level, which seems unlikely to change at least in the near future.