MASSIVE Time Warner Managed Security breach – 4,897 corporate accounts

If you have a Time Warner Managed Security account (corporate level) your MSS credentials may have been leaked online in a recent hack by grey-hat group TeamPoison.

Head over to http://siph0n.in/exploits.php?id=4535 to see a list of all 4,897 company logins and passwords that have been posted.

If you are in the list, you IMMEDIATELY need to change your MSS password. You can do this by going to PASSWORD REMINDER at your MSS login page and keying in your username and email address. A new password will be sent to your registered email in a few seconds.

This is a MASSIVE data breach and should be taken very very seriously. If someone uses one of the 4,897 accounts leaked, they will have access to the company’s firewall config, VPN forwarding, custom online rules and WAN setup.

The CIA announced their DDI program: an in-house bureau focused on tech

While going through my backlog of reading material, I found an article from FCW (The Business of Federal Technology) that pointed out the CIA has a “new” digital directorate that “brings together cyber, IT, and open source intel.”

Called the Directorate for Digital Innovation (DDI), it’s an in-house bureau “devoted to giving officers around the world better IT tools to do traditional cloak-and-dagger work.”

Bear in mind this is just the official announcement of the CIA’s DDI program. This little baby has been running around for some time now and is just now announcing they’re ready to go outside and play.

The CIA says their new info ops center is not “an alternative NSA” and is composed of three segments: “an open source center; a center for handling cyber threats and operations; and the agency’s IT enterprise”.

I’m sure the DDI is going to be an “active” bureau despite all the delicate phrasing in the article, but I really hope the inward-facing DDI is more than a glorified help desk and has some enforceable executive tech behind it. By enforceable executive tech, I mean getting agents up to date with modern security practices with the authority to make upgrades and training more than “suggestions” or optional “time-for-a-promotion” courses.

Exhibit A: Grand poo-bah CIA Director John Brennan was OK with using AOL for his AGENCY EMAILS and his AOL account got hacked by a script kiddie amateur.

Yeah, there’s obviously some BIG changes that need to be made internally. From waaaay up high at that.

Good luck DDI.

The article on FCW can be found here.

On Tuesday October 6, an epic court decision concerning online data came to pass and nobody said peep

On Tuesday October 6, one of the biggest mind-shifts in online data and technology this decade finally came to pass via an EU court ruling. This ruling will have serious repercussions for both US consumers and all US intelligence agencies, and nobody over here has said peep about it.

The headline says it all… “EU ruling means Facebook and Google can’t send data to the US”

HA!! This is wonderful! This is titanic! This is… well, kinda hard to explain.

OK, supposing you move into a new neighborhood. Walking in the door, you meet a fellow named “Bo” who lives across the street in a funny looking house.

For the most part, Bo seems friendly. He mentions he has a cousin in another far away city named “Luke” who also sounds just as friendly.

A few months into living in the city, Bo makes a copy of your house key and takes it to Luke.

Luke uses the key to open your front door to your home and takes your TV.

Luke gives your TV to Bo.

When you confront Luke, he says since he lives in another city the local laws in your town do not apply to him and he wasn’t breaking any laws in his town. Luke also says Bo gave him the key directly and said he could do whatever he wanted with whatever he found inside. Luke insists he has no idea what he was doing was wrong. You need to take it up with Bo.

When you confront Bo, he says he didn’t steal your TV and never touched your TV. Bo says he had no idea Luke was going to do what he did, and is shocked you have the nerve to accuse your neighbor of such a terrible thing. You need to take it up with Luke.

Ridiculous, right? A cheap shell game from two obvious criminals no police officer, DA or judge would let fly.

Here’s the catch – the part of Bo and Luke are being played by the US government and certain governments in the EU. They were (NOTE: probably still are) doing the exact same thing with our data.

The US gave access to overseas intelligence agencies to eavesdrop on our conversations and bypass encryptions, and then the overseas intelligence agencies told the US agencies what information they found.

Technically the US didn’t steal the information or eavesdrop on our conversations. Technically the overseas intelligence agencies didn’t break any of their own laws in the process.

Finally, with this EU court ruling, part of this “technically” foolishness was brought to a screeching stop.

This epic win for privacy and the upholding of constitutional law is all thanks to Austrian lawyer Max Schrems, who brought the lawsuit “against Facebook in 2013 for participation in US mass surveillance.”

I’m going to have to add Max Schrems to my Christmas card list. Like, forever.

Now, companies’ (and probably certain governments’) “ability to pool data from both sides of the Atlantic for analysis will be affected”.

Will this ruling actually change anything?

Maybe.

The last two paragraphs in the article are the best…

“The ruling basically says US surveillance cannot be allowed to override our fundamental rights, but US law says surveillance must override fundamental rights… The EU court is largely saying that indiscriminate gathering of data is enough to interfere with fundamental rights, and therefore you shouldn’t be able to do it.”

“US companies that obviously aided US mass surveillance may face serious legal consequences from this ruling when data protection authorities of 28 member states review their cooperation with US spy agencies”.

Where to find your BitLocker key for Windows 10 or Surface pro

Hopefully you will never ever need to know this, but in case you ever have to re-format or “refresh” your Windows 10 and/or Surface Pro device, you’re going to need to know where to find the BitLocker key for your device.

To find your BitLocker key, just go to…

https://onedrive.live.com/recoverykey

Log in with the SAME Microsoft ID you used for your Windows 10 or Surface Pro device. In a few moments, a list of all your BitLocker recovery keys will show up. Choose the BitLocker key that corresponds with the hardware you are repairing and you’re set.

Unfortunately, if you are ever asked for your BitLocker key, it means you’re in the process of restoring the former Windows 10 or Surface Pro device from zero, so you won’t be able to copy and paste the BitLocker key directly – you will have to type in the 48 character code manually across devices.

If you’re using AVG anti-virus, you need to uninstall it ASAP

AVG antivirus was a decent antivirus application for Windows. Decent as in “there’s nothing else free that doesn’t stink quite so bad”.

The application did an OK job of keeping viruses out, but it’s main strength was the 100% free price tag.

Earlier this month, though, AVG announced that if you continue to use their application on your PC, they NOW have the rights to “sell your search and browser history data to advertisers” if you’re using their application.

In very plain English, if you are currently running AVG antivirus on your PC…

  • AVG antivirus is ACTIVELY WATCHING WHERE YOU SURF
  • AVG antivirus is ACTIVELY WATCHING WHAT YOU SEARCH FOR
  • AVG antivirus is collecting ALL METADATA in your web browsers (cookies, history, etc)

AVG said it doesn’t matter what browser you use on your PC. If you’re still using their product, you automatically agree AVG can take your personal information and sell it to whatever advertisers they can find to do whatever they want with.

AVG said, quite bluntly, they’re doing this to make money.

Such a nice buncha people. So super nice. I wanna take a nice baseball bat to these nice people’s heads they’re so nice.

The other BIG problem is even after you uninstall their antivirus application, AVG has not provided a way to delete the data they already collected on you, and they’re not providing any way for you to look up what they took from your PC.

There’s a big story on both Wired and SMH about this mess.

If you have AVG antivirus on your PC, it’s time to uninstall it and find a replacement. I currently recommend ESET for “premium” antivirus and the built-in-to-windows Microsoft Defender for “free” antivirus.

Some observations on the Amazon Dash buttons

The Amazon Dash buttons are interesting little creatures. You can order them directly from Amazon.com, and depending on what model you get, you can order your favorite pantry-or-cleaning item with just the touch of a button.

Setup is easy. First, launch the mobile app on your Apple or Andriod phone and go to the DASH DEVICES – MANAGE DEVICES in the app options.

01 Amazon Dash IMG_7725

The next step is a basic greeting and tells you what’s about to happen.

02 Amazon Dash IMG_7726

The next step is the part that made me ring the BLOOOOG POOOOOOST alarm. You proceed by searching for your local WiFi and selecting it like you would from any WiFi selection screen and then key in your password for the WiFi. But under the password box is an option for Amazon to REMEMBER your WiFi password by saving it to Amazon.com. Not locally… TO AMAZON.

03 Amazon Dash IMG_7727

In the hopes this wasn’t really as bad as I thought it was, I looked at the brief legaleese embedded in the app.

04 Amazon Dash IMG_7723

According to #1, saving your WiFi to Amazon is for Dash devices now, but they plainly state it will roll out to other devices “soon”. On #3, Amazon says they intend to save your WiFi password on their servers in an encrypted file and “won’t share with third parties without your permission”.

Wait, why are we even talking about sharing my WiFi login and password with third parties at all?

The next part is even better… cherry on top with whipped cream better!

05 Amazon Dash IMG_7724

Rule #5 states in the event you change your WiFi password or want to completely delete your WiFi information from the Amazon servers, you CANNOT DO IT FROM THE APP. You must CALL IN to their toll free number and ask for this to be done.

How’s them apples?

Back at the setup window, if you leave the “save the WiFi password” option unchecked and proceed with the setup, the next window will tell you to press and hold the dash button until the light on the dash button turns blue.

06 Amazon Dash IMG_7728

Easy enough. Hold down the big button and the light sure does turn blue!

07 Amazon Dash IMG_7733

After the light on the dash button turns blue, you are instructed to place the dash button near the SPEAKER of your phone to complete the setup.

08 Amazon Dash IMG_7737

Once you do that, your phone emits a combination of R2D2 sounds meeting the old modem screech sounds. After just a few seconds of that, the app will say the dash button is ready to use.

09 Amazon Dash IMG_7741

You can then proceed to order the specific button-click action that happens when you click the Dash button. In this example, these are the options on what to order when you click the Gatorade button.

10 Amazon Dash IMG_7739

Once you pick what the default button action is, you’re finally done.

OK, now hold on a second. The dash button relied on AUDIO feedback from the phone to activate. The dash button had to be near the phone speaker for the setup to work. Not just on the same WiFi network or in Bluetooth range… right next to the phone’s speaker.

That means there’s a tiny microphone in every dash button.

A microphone that is always on and connected online, regardless of whether you are ordering anything or not.

Hmmmm. So to sum up…

* Amazon has your WiFi information on their servers that you can’t delete yourself
* Third parties are mentioned specifically in the section about your WiFi password and WiFi name
* There’s a live microphone always connected to the internet on every one of these things

Neat.

Right off the top of my head, I think a better option for clicky-ordering in the pantry would be something like the Jetson’s cartoon – a app for a tablet that allows the consumer to specify a field list and what each button will order. Something like an “open” slate app for the Kindle or iPad where we choose what products fill each individual button slot. Make it as 10×10 grid, add some solid artwork, and done!

As for the Dash Buttons I just ordered, since I can’t think of a single reason for a microphone to be embedded in a device that orders Gatorade and Mac and Cheese, I think they’re going in an aluminum foil lined tupperware bin until further notice.

How to fight unsolicited texts if you have AT&T iPhone service

Have you ever received an unsolicited text on your iPhone from some scumbag trying to sell you something?

01 Text Scumbags IMG_7701

There’s a great way to fight this if you have AT&T. Forward it to their unsolicited legal department! When AT&T receives enough notices about a specific phone number or text block, they will take action on behalf of their subscribers!

First, PRESS DOWN on the original scumbag message until a pop-up appears and choose COPY.

02 Text Scumbags IMG_7702

Now to back to your main text listing and make a NEW TEXT MESSAGE to the number 7726

03 Text Scumbags IMG_7703

Click and HOLD DOWN in the field you usually type things and choose PASTE and then SEND the message. In a few seconds, you will receive the confirmation AT&T has received this message and needs just one more thing to apply the big boot of justice to these internet roaches.

04 Text Scumbags IMG_7704

Now go BACK to the scumbag text message and choose DETAILS in the upper right corner.

05 Text Scumbags IMG_7705

Once this window opens up, click on the I icon in the upper right corner.

06 Text Scumbags IMG_7706

Press and HOLD DOWN on the scumbag’s phone number and choose COPY when the pop-up appears.

07 Text Scumbags IMG_7708

Go alllll the way back to the message sent to 7726 and PASTE the phone number.

08 Text Scumbags IMG_7709

That’s it!! You have just helped take one more dirtbag off the internet!

On a related note, since I have started doing this about three weeks ago, my unsolicited text messages on my AT&T cell phone have gone from about three per day to ZERO.

How to remove the Windows 10 upgrade icon in the taskbar

If you have the big Windows icon for the upcoming Windows 10 upgrade in the lower right corner of your taskbar and want to get rid of the icon…

  • Press CONTROL-ALT-DELETE to pull up the Task Manager
  • Click on the PROCESSES tab
  • Highlight GWX.EXE and press the END PROCESS button. 
  • If you have GWXUX.EXE in the process list, highlight that as well and press the END PROCESS button.
  • Close Task Manager

Dear Microsoft : In the future, add a simple right-click EXIT or REMIND ME LATER option. People didn’t take too well to forced U2 albums, and I expect this wont go over any better.

A suggestion for White House drone security

On the FCW Federal Technology website, there’s a story about Congress looking for inter-agency cooperation on drafting a drone policy. 

The reason for this sudden concern on drones is because a few weeks ago, some idiot crashed their drone on the White House lawn. The best part is that the secret service had no idea it happened and had nothing in their tactics to prevent it from happening again.

So now congress wants the Department of Homeland Security to come on down and make a “comprehensive strategy to combat the potential threat of domestic drones” and pull in “the Defense Department and, perhaps, the Energy Department” into this mess as well.

Here’s my favorite part of the article…

Todd E. Humphreys, an assistant professor at the University of Texas Cockrell School of Engineering, offered one possible remedy.

“For especially sensitive sites like the White House, we could deploy a network of infrared cameras set up to detect and track an incoming drone by looking for the thermal signatures of its warm batteries and motors,” he said. “And this network of sensors could be used to guide an always-ready squadron of interceptor drones that could capture the intruder in a net and carry it off.”

Seriously. Capture a flying object. In a net. That’s the plan.

All we need now are a few Scooby Snacks and we’re good!

How about this real cheap and slightly more-effective three-step solution… First, bring in a dozen more Secret Service agents with military sharp-shooter backgrounds specifically as White House perimeter security. Give them all VEPR-12s. Have them WALK around the White House lawn with these 10-12 round semi-auto AK-style shotguns and the standing authority to shoot down anything that flies near the White House. As an extra bonus, they can double as ground support to prevent any fence-jumper from making it all the way into the FRONT DOOR of the White House. You know… that whole “protect the president” merit badge the Secret Service gets to wear every so often.

Second, infrared isn’t going to pick up diddly-squat in the DC summers. They need to go with sonics – set up a wide perimeter “gunfire locator” around the White House. These things are pretty cool and are already in place in DC. Add to the gunfire detectors the RPM of drone engines in the list of things to report and triangulate. Once the system picks up the sound of a drone engine, the exact location and direction can be relayed to the ground security and the target can be eliminated if necessary.

Third – since that one particular drone made it all the way to the White House lawn, GPS and WiFi blockers need to be set up as well. I’m talking zero WiFi and GPS signals in a very VERY wide area around the White House to keep drones out and/or confused long enough to take them down.

Runaway drones are a high-tech problem with a very low-tech solution. A decent drone costs anywhere from $2,000 to $6,000. A single 00 buck round costs $1. Make it permanent “drone season” around the White House, get the serial numbers from any of the parts left intact from a downed drone, track the purchaser through those serial numbers, and once they’re found, pop them with a $2 million “idiot” fine.

Of course there’s an option “B”… hire a buncha good old boys, set them up with some federal duck blinds and a couple of cases of beer around the White House and offer them a reality TV series… “Drone Dynasty”.

CloudOn merging with Dropbox

In a midnight press release, CloudOn announced they are merging with DropBox.

CloudOn was one of the earlier iPad apps for cloud storage, but it never really caught on like their competitors did. In the press release, CloudOn stated they are starting off 2015 by “joining the Dropbox team”.

The bad news is that effective immediately, no new accounts can be created on CloudOn, and on March 15th, “the CloudOn app and service will no longer be available.”

In an email sent to existing CloudOn subscribers there are two links intended for “any inconvenience caused by the discontinuation of our service”. One link is for activating an additional 1GB to DropBox storage for free, and another link is for 3 months free and 1 TB of space for DropBox pro accounts.

I chose the additional 1GB option and immediately saw my existing DropBox storage space increase.

CloudOn Dropbox Boost

 

Thanks CloudOn!

You can see the full press release on their website. If you are an existing CloudOn subscriber, check your email for the offers to switch to DropBox.