Raymond Tec News for January 20, 2019
Intro
Welcome to the January 20th, 2019 episode of the Raymond Tec News podcast. Each week, I scour the web and curate the articles, tweets, and backchannel sources to provide you, the non-nerd, a concise tech news summary where I answer the question, “Why does this matter to me?”
I start off each episode with the depressing stuff; data breaches, privacy concerns, and security threats. But I like to instill a bit of joy around technology so I end with a series of stories that will restore your faith in our technological future, and, hopefully, humanity.
Let’s dive in.
Data Breaches

On December 8th the Oklahoma Department of Securities was notified of a breach that exposed three terabytes, or 3,000 gigabytes of information to the public. This information included personally identifiable information on more than 100,000 brokers, private emails, and security filings. Information on FBI investigations relating to securities were also exposed. Data on the exposed server spanned three decades, from 1986 to 2016. It appears the breach was due to an outdated and improperly configured server.
Memphis, Tennessee-based Sacred Heart Rehabilitation hospital began notifying patients this month that a hacker gained access to an employee’s email account in April of last year. Patient data was exposed in the breach. The investigation concluded in November. No word on why the hospital waited so long to notify patients of the breach.

Australian real estate network, First National, announced this week that it had misconfigured a server and exposed job applications which contained personally identifiable information of more than 6,000 people. First National is working with affected applicants to mitigate the effects.

Extortionists have stooped to a new low with ransomware attacks. Using ransomware identified as Cryptomix, attackers are locking people’s data and demanding payment be made to a charitable organization funding children’s cancer treatments. These lowlifes have gone the extra mile to take details from crowdfunding pages to add legitimacy to the claims. Security companies have had some success with decrypting the ransomed data once the affected machine is taken offline. Be wary of unusual links or files sent via email to avoid these kinds of attacks.
A bug plaguing Twitter since 2014 has exposed private tweets of some users of its Android platform. When users change their settings in the app, it can inadvertently disable the “Protect your Tweets” setting. If you’ve used Twitter on your Android device between November 3, 2014 and January 14, 2019 please go check your settings.

I recommend checking Hunt’s site, Have I Been Pwned dot com, that’s owned with the o replaced by a p. There you can search for your email address and any recycled passwords that you use.
If you’re still recycling passwords in 2019, it’s time to step up your cybersecurity game by using a password manager. I use LastPass. LastPass generates random passwords for every website I log in to, keeps track of them all, and works on my PC, phone, and tablet. Your LastPass vault unlocks with one strong password, and it’s the last one you’ll have to remember. On mobile devices you can also log in with facial recognition, fingerprint, or PIN. It’s the best thing you can do to ensure your online life stays secure. Don’t wait to be a victim of identity theft or fraud; sign up for LastPass today with my affiliate link at raytec.co slash LastPass, that’s r-a-y-t-e-c dot c-o slash l-a-s-t-p-a-s-s.
If I didn’t use it myself, I wouldn’t recommend it. There’s a disclosure about affiliate links at raytec.co slash affiliate.
Before we move onto privacy concerns, I wanted to revisit the SingHealth security breach I mentioned in last week’s podcast. Two employees have been fired, and five executives, including the CEO have been fined in connection with the data breach by Singapore’s government. Negligence and lack of training for non-IT staff were the main culprits in this breach, highlighting why it’s important for everyone to be aware of potential cybersecurity threats.
Security Threats
Moving on to our last dark topic for this episode: Security Threats.
For at least three months, several hacking groups have been illicitly accessing databases to steal payment card details from online stores. These attacks are like the MageCart attacks I talked about last week. Basically, the attackers insert code to skim details from forms you fill in on legitimate websites. There is no information about exactly what sites were exposed or how many people’s details have been compromised. The take away here is, avoid smaller sites for the time being, until website administrators have had time to patch these vulnerabilities.

Taking the previous article a step further, a French researcher has shown in an academic paper how it is possible for malicious websites to use browser extensions in both Google’s Chrome and Mozilla’s Firefox to steal bookmarks, browsing history, and user cookies. The latter is the most critical vulnerability because a user or session cookie, is what tells a website you are you while visiting. When it comes to browser extensions, don’t install them unless they’re recommended by a reputable source.

Two weeks ago, I reported on mobile vehicle charging stations that Volkswagen is developing together with French company, Schneider Electric. Here we are two weeks later, and security researchers have found vulnerabilities that may allow attackers to take control of them. They haven’t been rolled out in the US yet but are available in Europe. Thankfully, the weaknesses don’t extend beyond the charging stations themselves, allowing attackers to shutdown or lock up the charging stations so they can’t be used.

There’s a new trojan, known as Anubis, that steals your banking details found in two apps on the Google Play store. These apps are activated by the motion sensor in your device and trigger a pop up to get you to download an app disguised as a system update that records key strokes. The motion sensor component may have been designed to fool security researchers who test apps using a simulated phone on their computers. These simulators generally don’t report motion data, thereby keeping this attack hidden for longer. The two apps to avoid are BatterySaverMobi and Currency Converter. When you download a new app don’t give it access to data it doesn’t need. There’s no reason for either one of these apps to have access to your motion data.
This week brings two public service announcements from Microsoft. For those of you still using older PCs, with Windows 7, support for the operating system will be dropped on January 14th, 2020. So, you have one year to upgrade or switch operating systems.

While I was reading about these upcoming end-of-life cycle announcements, I stumbled across a solution for those of you who are on a PC budget. Blue Collar Linux is a new flavor of the free open source operating system developed to be used by average users, not superusers. The distribution is free, regularly updated, and designed to allow users to point, click, and go. Where most Linux distros require more advanced knowledge and feature a daunting maze of choices for even basic software. There’s also a lot of useful software bundled into it, including a Windows emulator that allows Windows programs to run under Linux. And since, these computers may be given to kids, the creator has included Parental Controls.
For the record, I haven’t tried it yet and I get no reimbursement for talking about it. There’s a link to the original article I can across in the show notes as well as a link to download the operating system.
Now we move on to the news that doesn’t fit neatly into other categories.
Privacy Concerns
Onto more news to keep you up at night: Privacy Concerns.
In a follow up to last week’s reports that Sprint, AT&T, and T-Mobile are selling location data, a House panel has requested an emergency briefing from the Federal Communications Commission to figure out why the agency hasn’t stopped this practice. Link with details in the show notes.

The Electronic Frontier Foundation has been hard at work planning its legal moves for the upcoming year. One such action is an expansion of privacy protections which will allow you to enforce violations of your privacy. Meaning, providing you the ability to sue companies who don’t adhere to privacy standards and allow your data to be exposed. Check out the show notes at raytec.co slash listen for more details.
This week’s viral meme is the 10-year challenge. People posting their earliest and most recent profile pictures side-by-side. It’s a fun way to see progress and change over the course of a decade or more. But what if it were more than that? Some security experts aren’t sure it’s just harmless fun. They speculate that it could be a machine learning exercise allowing machines to understand the human aging process and helping to recognize people even across decades of time.
These researchers cite examples of past memes gone wrong, such as #MyFirstConcertWas, as this can be a security question which would allow an attacker to gain access to other profiles or accounts. The 10-year challenge seems like harmless fun to me, but time will tell.

In a double whammy this week, Amazon and Google have both received demands to stop selling facial recognition technology to the US government. Amazon shareholders have demanded the company refrain from selling the technology unless guarantees are given that it does not cause or contribute to actual or potential violations of civil and human rights. Amazon’s Rekognition technology has been sold to law enforcement in at least two states and was pitched to Immigrations and Customs Enforcement.
The demand Google received were from the ACLU, EFF, and over 80 other organizations. The coalition is made up of racial justice, faith, civil, human, and immigrants’ rights organizations. The coalition also sent letters to Amazon and Microsoft with similar demands.

Results of a study from the Pew Charitable Trusts were released this week showing that 74 percent of people didn’t know Facebook keeps a list of their interests for ad targeting purposes. Participants were then asked to look at their own ad preferences page and almost 60 percent of participants said Facebook’s targeting was very or somewhat accurate. Facebook’s response to the study and subsequent article on The Verge spoke of wanting to provide more transparency and control but didn’t elaborate on how they would achieve this. More information on these ad preferences and Facebook’s privacy tools in the show notes.

More bad news for Facebook and your privacy. Subsidiary Instagram has been selling ads to companies that help Instagram users gain followers. Quote, “A TechCrunch investigation initially found 17 services selling fake followers or automated notification spam for luring in followers that were openly advertising on Instagram despite blatantly violating the network’s policies,” end quote. Basically, for a low price, these companies will help legitimate businesses gain followers. Some of these are real followers, some are fake accounts owned by the spam companies. It basically created a loop where Instagram was earning ad money from these companies illegitimately earning money from actual businesses or people who are trying to build a brand on Instagram.
The whole mess basically means that Instagram wasn’t acting in an honest and straightforward manner and diluting the value of their own platform. If you’re trying to be an Instagram influencer, know that you can’t buy followers. If you can’t get followers, you’re not making content people want to see.
The Democratic National Convention filed court documents on Thursday indicating that several email addresses were the target of spear phishing, potentially from Russian hackers, shortly after the mid-term elections in 2018. These documents also state that there is no indication that these attacks were successful. Where a phishing attack is a wide net cast to catch as many victims as possible, a spear phishing attack is tailored to the intended victim.
I’m going to end Privacy Concerns on a good note for a change. Two designers have been recognized this week for creating a privacy improving hack for your smart digital assistants. Bjorn Karmann and Tore Knudsen have developed a, for lack of a better term, hat that goes on top of your smart speaker. The high-tech haberdashery, known as Alias, plays white noise into the speaker preventing Alexa or Google Assistant from hearing you.
Now your digital assistant can’t eavesdrop on your conversations or mistakenly email your employees a transcript of rude things you’re saying about them. The smart hat has a fully customizable wake word that will turn it off. Once turned off Alexa or Google Assistant will hear you as it normally would.
Unfortunately, there’s no word on if or when a commercial version would be available.
‘Other’ News

While we’re on the topic of maps, Google Maps announced this week that it will display speed limits for its Android and iOS apps. It seems that they are also rolling out the ability to mark speed traps and speed cameras in certain locations. These features are already available in Google’s Waze app.
And, since we’re talking about Google Maps, a security researcher has discovered a collection of almost 20 Android apps that are just Google Maps with ads on top. These apps have been downloaded over 50 million times. Check the link in the show notes for the full list and uninstall these imposters ASAP.
Expect to see a slew of app updates coming to your Android phone over the next year and a half, as Google has announced this week that legacy support for 32-bit apps will be dropped in August of 2021. There’s not much for users to do except wait for updates, but I wanted to make you aware that the number of updates for mobile games and apps on Android may increase in coming months.

Apple’s release of iOS 12 in September brought a new feature that lets you password protect apps. The screen time feature, which is meant to report on, and limit overuse of your device actually gives you the ability to lock apps. While it’s really meant to block certain apps after they reach a daily usage limit, this feature can be manipulated to require a passcode every time it’s used, effectively password protecting the app. A detailed guide for how this is done is in the show notes.
There are a series of bizarre audio issues plaguing iPhone 7 and 7 Plus users that, if the device is out of warranty, may cost up to $180 to repair. There is also talk of a class action law suit related to this issue. Details on both the issues and the class action suit are in the show notes.
The Verge has revealed a new app by Dolby this week, codenamed 234, which purports to be an audio clean up tool for your phone. It will allow you to record and with a few simple swipes, clean up any type of audio you record. The author gives a fair review. Link in the show notes at raytec dot co slash listen.
Alphabet, Google’s parent company, has begun the process of spinning off a project called Loon into a separate business. Loon’s goal is to partner with global telephone companies to expand internet coverage to underserved areas.
Google Pay, Google’s touchless wallet app, has added 17 new banks this month already. Touchless payments are a secure method for paying for most transactions and are becoming widely accepted, but your bank must be on Google’s list of supported financial institutions before you can use your debit or credit card for a transaction. Their list is extensive and constantly growing.
A new survey has shown that Americans are confident in their government’s cybersecurity preparedness, but also pessimistic about potential cyber-attacks. Israel and Russia top the list of optimistic countries. But pessimism may be the smart way to go and keep populations vigilant. The full report is in the show notes.

Bird Rides was irked that the journalist would detail the completely legal process and tried to cite a section of the Digital Millennium Copyright Act as proof that he had broken the law. Unfortunately for them, that section of the law has exemptions for repair and modification of motorized land vehicles, like, I don’t know, electric scooters.
I doubt Bird will have much legal success since the journalist is a contributing member of the Electronic Frontier Foundation who has responded on his behalf. Besides that, Bird’s lawyers will likely have their hands full with new litigation from a disabilities rights group. Disability Rights California is suing Bird Rides and their competitor Lime due to clogged sidewalks that prevent safe passage for those with physical disabilities.
Moving on while I gloat, the South Australian government launched a new trial for an autonomous bus service in Adelaide. The six-month trial is a partnership between several organizations in Australia and the US to showcase how autonomous vehicles can improve public transit. The shuttle, known as Olli travels between two hubs, known as Matilda, from Mosley Square in Glenelg to Broadway and back using military-tested LIDAR, computer vision, and radar detection systems.

Rescued from bankruptcy in June 2017 by Chinese owned Key Safety Systems, airbag manufacturer, Takata, has produced more faulty airbags this time causing Tesla to issue a recall on 14,000 Model S vehicles in China. This comes at a time where Tesla has cut jobs, cut vehicle prices, and attempted to ramp up production to better compete with established auto manufacturers.
In positive news out of Facebook this week, their cybersecurity group has found and deleted 512 Facebook and Instagram accounts linked to two separate Russian disinformation groups. One group targeted disinformation at the Ukraine, and the other focused on Central and Eastern Europe, the Baltics, Central Asia, and the Caucasus.
Employees of the social media giant were busted this week leaving glowing reviews of Facebook’s Portal on Amazon. The company has stated that it will ask the employees to delete their reviews.
More negative news for Facebook this week comes from an article in a German newspaper. The article states the German Federal Cartel Office has been investigating Facebook’s privacy practices since at least 2015. The Agency will soon present the company with a list of changes it must make and deadline if it wants to continue operating within the country.
I’m going to call this next segment, Netflix corner, because news from the streaming giant has been hot and heavy this week. Once secretive about its viewership, Netflix now can’t stop sharing numbers. It started by announcing that over 45 million accounts viewed Bird Box in the first week. Next followed the announcement that 8.8 million new subscribers signed up globally in December and that Netflix now accounts for 10 percent of US TV screen time. Then, even with the influx of new paid subscribers, the streaming giant announced it would be raising prices on all streaming plans by a dollar or two over the next three months. Finally, despite new competition from Warner Brothers, Disney, and Comcast’s NBCUniversal, Netflix is continuing to expand original content offerings by rebooting cult classic true crime paranormal TV show, Unsolved Mysteries.
The fallout of this government shutdown continues to mount. One that has been overlooked by most of the media has been the Violence Against Women Act, or VAWA, which expired on December 21st. Since this bill is up for renewal, Wired author Gianmarco Raddi, suggests a simple, effective amendment to improve the safety of women everywhere: GPS tracking for domestic violence offenders. Pilot programs around the world have shown that GPS monitoring of domestic violence offenders reduced or even eliminated all repeat offenses. Whereas, as many as two-thirds of protection from abuse acts are violated. For full details and statistics, I recommend reading the article that I linked in the show notes.
I know this podcast is running a little long, so I’m going to share some headlines, but I want to encourage you to visit the show notes at raytec dot co slash listen to read the full stories. Coinstar machines are going to start offering Bitcoin as an additional payment option. Artificial intelligence is moving towards the courtroom to reduce bias from the gambler’s fallacy and during election cycles. Microsoft is splitting Cortana from the Windows 10 search box in the latest preview builds. Michigan has just become the third state in the Union to allow the use of digital license plates. A new study has revealed that the science behind screen time being bad for you is junk science, but screen time may not be good for you. The Verge has provided a handy how-to guide to get all your photos off Flickr now that the photo sharing site is adding limits to the number of files that can be shared. French startup Doctolib explains, in detail, how telemedicine appointments will work.
We’ve finally reached that light at the end of the tunnel. It’s time for the Good News.
The Good News
Verizon will be debuting its free call filtering service to starting in March of this year. The service will be available to both wireless and wired customers with compatible devices. Previously the spam and robocall killer cost $3 per month. This free service joins T-Mobile and AT&T which already offer similar services.

Fans of NPRs ‘Wait Wait Don’t Tell Me!’ can rejoice because it’s now a voice app for Amazon’s Alexa and Google’s Assistant. With regular weekly updates, you too can play your own home version of the fill-in-the-blank answer game using your Alexa.
Ford has confirmed during an investor conference call that its F-150 pickup truck will be available in a fully electric variant within the next five years. Details are scant as this is still far off but being the first to the table is almost always a good thing for businesses.
Two Australian organizations have teamed up to use technology to improve the lives and businesses of farmers. The Rural Intelligence Platform, as it is known, combines artificial intelligence, cloud-based geospatial technology, and machine learning to better inform farmers of how to improve productivity and crop yield.

This is exciting, although it’s still in the testing phase. Doctors and researchers at UC San Diego have successfully 3D printed replacement pieces of spinal cord that include living tissue which can be grafted into a severed spinal cord to restore movement in laboratory rats. This means that many different types of injuries will be able to be repaired in the future and may mean entire living organs can be grown in a laboratory to be transplanted into patients.
Engineers at open bionics, have developed the most affordable bionic arm to date. These arms are more than just prosthetics, they interact with the wearer’s muscles to allow those missing limbs to open doors, hold small objects, lift heavy things, and many other tasks. Named Hero Arm, these bionic arms are built with growth in mind, allowing children as young as 9 to have the arm and use it for longer before needing an upgrade. Being 3D printed, they are also available in a variety of colors.

In April of 2018, the government forced a website called Backpage to shut down. Backpage, claimed to be an ad site like Craigslist, flourished with ads for sex workers. Many of these workers were there against their will, victims of sex traffickers. On the surface, this website and others like it being shut down was a good thing, but there was an unintended consequence. It became much harder for those who fight against sex trafficking to locate the victims as they were scattered to backchannels across a much wider group of websites. This week, TechCrunch interviewed a Google Senior Software Engineer named Sam Ainsley who was one of the first to be embedded through Google.org’s new fellowship program.

That last piece was heavy, but the contributions technology can make to our society are immensely impactful. Hopefully your faith in technology and humanity have been at least partially restored.
That’s it for this week in tech news that matters to you. If you’ve enjoyed the podcast, please subscribe, rate, and review on iTunes, Google Play, Spotify, Stitcher Radio, or TuneIn. The more buttons you press on those sites, the easier it is for other people to find us. Also, be sure to follow us on Facebook and Twitter at Raymond Tec IT for tech news updates that matter to you.
Make sure you check the show notes, there are bonus links for further reading, including stories about how schools in the US store data on students, newly discovered IoT security flaws, where to watch the Super Bowl online for free, a video of Lego builders building a full-size Chevy pickup truck, and more. It’s easier than ever to get to the show notes, just go to raytec.co slash listen, that’s r-a-y-t-e-c dot c-o slash listen. There’s also links to each of the podcast apps I listed there as well as links to our social media.
Thanks for listening and have a great week!
