If you’re a Mac user and you also use Zoom be sure to check to see what version of Zoom you’re running. Recently a bug in the Mac version of the software was found that could cause your computer’s microphone to remain on even after leaving a meeting.

Mac Zoom users have been complaining about the issue since December of last year (2021).

The company responded quickly and explained that the issue was a bug and trying to quell suspicion that it was intentional. Given Zoom’s past issues with privacy violations, convincing their user base that it was a bug and unintentional was more difficult than it should have been. However the company got to work and have now fixed the issue as of version 5.9.3 which was released in January.

It should be noted that this was the company’s second attempt to fix the problem. The first attempt was released in December (the same month that the issue was reported) but the fix found in version 5.9.1 didn’t work for everyone.

With the release of version 5.9.3, the company also issued the following statement:

“Zoom has determined that this bug did not result in audio data being transmitted back to Zoom’s platform. As always, we recommend users make sure their Zoom client is updated to the latest version.”

It’s a shame that the company had to issue such a statement but the simple truth is that they did it to themselves with their previous fast and loose policies relating to the privacy of their users.

Considering the suspicion this bug was greeted with and the fact that the company had to bend over backwards here to convince their users that it was a genuine mistake is proof that Zoom still has some work to do to regain the trust of their user base.

In any event check your version number and update as soon as you’re able if you haven’t done so already.

Recently, Microsoft announced that they were adding support for Android Apps to Windows 11. The company first began testing that new functionality back in October of last year (2021).

Now, the public preview has been unveiled in the US, allowing users to run some Android apps acquired from the Amazon store right from their Windows 11 desktop.

For the most part, the apps available from the Amazon store are games designed for children but there are a few productivity apps also available.

If you want to venture beyond the Amazon App store, several developers and power users have already created ways of installing apps from the Google Play Store. That is along with various methods to sideload apps in Windows 11 which greatly extends and expands the App functionality.

If you’re already running Windows 11 you can start taking advantage of the new capabilities today although you will need to first launch your Microsoft Store app.

Once you do, go to “Library” and “Get Updates.”

This will download and install the latest version of the Microsoft Store App. Once that’s done, you’ll be able to install the Amazon Store app which is the trigger to also install the Windows Subsystem for Android.

This isn’t the only new Windows 11 feature available today. If you’re an early adopter you’ll also be able to play around with the newly redesigned Windows Media player and get a first look at the re-vamped Notepad application.

Microsoft had this to say about their most recent update:

“As today’s release shows, we’re committed to delivering experiences into Windows 11 that enrich and inspire people’s lives. Over time, you’ll see us release new features into Windows 11 for end users more frequently in addition to our annual update.

We will leverage the variety of update mechanisms we have in place including servicing and Microsoft Store updates. Our goal is to deliver continuous innovation, providing you with the best experiences year-round.”

These are exciting changes indeed. Grab the latest and start experimenting today!

Do you have a WordPress site? Do you use the PHP Everywhere plugin?

If so, you’re not alone. More than 30,000 site owners have installed it. It’s an excellent plugin that dramatically enhances websites using it, because it allows webmasters to place PHP pretty much anywhere on the page to display dynamic web content.

Wordfence is a global team of WordPress security analysts, threat researchers, software engineers, and support staff. Unfortunately, researchers at Wordfence have recently discovered not one, but three critical security issues with the plugin’s design that allow hackers to remotely execute code by abusing the plugin, on sites running version 2.0.3 and below.

To execute the attack all a hacker needs to do is be granted a subscriber or contributor level account on your site which is generally easy for them to do.

The three flaws are being tracked as CVE-2022-24663, CVE-2022-24664, and CVE-2022-24665.

The Wordfence crew discovered the flaws on January 4, 2022. To their credit the plugin’s authors responded quickly and released an update on January 10th 2022, which addresses the issue. Although they disclosed that the fix required a substantial rewrite of much of the plugin’s code.

Although the security flaws have been patched, unfortunately many admins aren’t as good as they could be when it comes to keeping plugins up to date. Based on stats gleaned from WordPress.org only about half of the 30,000 worldwide installs of the plugin are running the latest version.

Note that if you are using the Classic Editor on your site you’ll need to uninstall the plugin and find some other solution for PHP code embeds because the Classic Editor is being phased out and the update to PHP everywhere no longer works with it.

If you use the plugin be sure to verify that you’re using the latest version. Kudos to the plugin authors for their rapid response.

We have recently learned that Puma Sportswear was impacted by a data breach in the waning days of 2021.

It’s important to note that Puma’s networks were not attacked directly. The attack was made against Kronos which is one of the company’s North American workforce management service providers.

In a recently filed data breach notification it was disclosed that the still unidentified attackers stole a variety of personal information belonging to Puma employees and their dependents from the Kronos Private Cloud. In addition, they deployed ransomware on the Kronos network.

The investigation into the breach is ongoing but it presently appears that nearly half of Puma’s employees were impacted. Kronos sent a letter to all impacted individuals. Unfortunately, the letter was terse and contained little in the way of actionable information.

The letter states:

“On January 7, 2022, Kronos confirmed that some of your personal information was among the stolen data. We notified PUMA of this incident on January 10, 2022.”

All impacted individuals have been offered two free years of Experian IdentityWorks, which includes credit monitoring, identify theft insurance, and identity restoration.

This is the second hacking incident involving Puma in recent months. Back in August of 2021 the company’s network was breached and source code for an internal application was stolen and put up for sale on the Dark Web.

The company stressed that no customer data was compromised and that the stolen information was connected solely to the company’s employees.

This attack underscores the risks and dangers inherent in our increasingly interconnected world. A data breach on a trusted vendor’s network can impact your company in ways you never even imagined. That means no matter how much you spend on your own IT security, you may still be vulnerable if one of the vendors you rely on doesn’t take security as seriously as your firm does.

Do you use Microsoft Teams and do you have an older PC that struggles with Teams video meetings? If so there’s good news. Microsoft has recently upgraded Teams and halved the power used by Teams video meetings to make life easier on people with older hardware.

Of course, even if you’ve got newer hardware this is still very good news because odds are excellent that the video meeting that you’re participating in isn’t the only thing you’re doing on your PC. Anything that Microsoft can do to make Teams less resource intensive means you’ll have more resources for other uses.

Robert Aichner is a program manager at Microsoft Research.

Aichner had this to say about the recent improvements:

“We’re committed to ensuring great calling and meeting experiences for users on low-end hardware as well as those on high-end workstations and high-resolution monitors.

One of the factors we’ve addressed is the difference in power requirements for different customer profiles by ensuring Teams meetings are as energy-efficient as possible, regardless of setup.”

Video meetings rely on three power-intensive processes: Capture, encoding and rendering.

Again, per Aichner:

“Isolating and optimizing each of these processes enabled us to reduce power consumption up to 50% for energy-intensive scenarios such as having over 10 users in a meeting when everyone has their video turned on.

A simple 3×3 video grid once required nine distinct rendering operations. By combining the streams and composing them into a single video, we have been able to consolidate operations in video rendering and significantly reduce the power requirements for each device used.”

The company made major improvements by redesigning how Teams handles grid videos with multiple participants.

Microsoft has stiff competition in the arena where Teams is operating, and there are several viable alternatives, which is why Microsoft is spending so much time and applying significant resources to the task of continually improving Teams.

So far it is working. Microsoft has an impressive product indeed, in teams and these recent changes are excellent.

There are two new forms of malware spreading rapidly among people with Android devices according to researchers at ThreatFabric. This latest campaign involves the FluBot malware (also known as Cabassous) and the Android banking trojan called Medusa. What’s disturbing about this most recent spate of attacks is that both forms of malware share the same basic infection tactics and delivery infrastructure.

FluBot is one of the most notorious strains of Android malware and can steal passwords, banking details, and other sensitive information from infected devices. It also gains access to the user’s list of contacts and uses SMS messages to spread to other devices.

FluBot’s success has encouraged imitators. Although Medusa was not created by the same group that authored FluBot, Medusa’s authors are following in FluBot’s footsteps.

In the case of Medusa it began life as a keylogger. It has been upgraded and can now take screenshots and collect data about how the device is used. Medusa’s authors have even gone so far as to deliver their malicious payload by using poisoned apps bearing the exact same names that FluBot’s controllers use.

The researchers at ThreatFabric had this to say about the matter:

“Despite the fact that Medusa is not extremely widespread at the moment, we do see an increase in volume of campaigns and a sufficiently greater number of different campaigns.

Powered with multiple remote access features, Medusa poses a critical threat to financial organisations in targeted regions.”

The single best thing users can do to minimize the risk of infection by either of these forms of malware is to install apps from the Google Play store or other authorized and trusted vendors only. Never install an app via a direct link or from some other website that offers it. It just isn’t worth the risk.

According to researchers at HP, there’s a new threat to worry about. Hackers have recently begun disguising malware as Windows 11 upgrades and are using them to target Windows 10 users who are anxious to move to Microsoft’s latest OS. This new campaign begins like many others with an email informing the recipient that if they click the link provided in the email, they’ll be taken to Microsoft’s website where they can get a free copy of Windows 11.

Victims who click the link will be taken to a site that is a very good and convincing replica of the legitimate Microsoft website. Only a careful inspection of the URL will reveal that something is amiss and most users don’t pay much attention to URLs so this is quite likely to go unnoticed.

Once on the site, the victim will be prompted to download the file that promises to be Windows 11. It is nearly 800 MB in size so at that point it still seems legitimate.

Unfortunately, if the victim runs the downloaded file they seal their fate as it will install malware on their system.

At present, the most common malware deployed via this campaign is RedLine Stealer which steals stored passwords, cookies, saved payment card information, and cryptocurrency wallet information. So if it lands on your system or finds its way into your company’s network it can deal significant damage with long lasting consequences.

The worst part of all this is that Microsoft has unintentionally made the issue worse than it needs to be. There are a great many Windows 10 users who cannot get Windows 11 from official distribution channels due to hardware incompatibilities. That has created an enormous opportunity for hackers around the world and they are wasting no time exploiting that opportunity.

Hackers will attack absolutely anybody. No one is safe and nothing is sacred. Not even football is safe.

The most recent high-profile attack was made against the San Francisco 49ers according to BleepingComputer which got confirmation from the 49ers.

According to the information disclosed by the 49ers they are in the process of recovering from an attack by the BlackByte ransomware gang which caused a “temporary disruption” of parts of the 49ers IT infrastructure.

Currently we have few details. We do not know for example whether the BlackByte gang was able to successfully deploy their ransomware. We cannot confirm the gang’s claims that they stole data from the football organization.

Their official disclosure statement reads in part, as follows:

“The San Francisco 49ers recently became aware of a network security incident that resulted in temporary disruption to certain systems on our corporate IT network. Upon learning of the incident, we immediately initiated an investigation and took steps to contain the incident.

Third-party cybersecurity firms were engaged to assist, and law enforcement was notified.

While the investigation is ongoing, we believe the incident is limited to our corporate IT network; to date, we have no indication that this incident involves systems outside of our corporate network, such as those connected to Levi’s Stadium operations or ticket holders.

As the investigation continues, we are working diligently to restore involved systems as quickly and as safely as possible.”

While the BlackByte gang isn’t particularly active, security professionals have been aware of their activities since July 2021. They have taken down their share of relatively high-profile targets and are certainly not to be ignored.

The lesson here is simple. No matter who you are you are not safe. The hackers don’t care and they will come for you. Stay vigilant out there because 2022 is just getting started.

It’s no secret that supply chain issues have impacted a variety of different industries. Apple has been somewhat less impacted than others.

Leveraging this and their massive infrastructure and marketing budget, they have flexed their corporate muscles and gained market share.

According to statistics gathered by data analytics firm Kantar, Apple accounted for slightly more than half of all smartphone sales in the US in 2021. They claimed 51 percent of the total sales for the year which is a 2.7 percent increase from 2020.

Apple lost ground in Australia, Japan, and Great Britain. Sales surged in Germany (up 5.6 percent to 30.9 percent of the market. Sales were also up 2.2 percent in France to 26.7 percent of the French market, up 1.3 percent in Italy to 19 percent of the market and up an impressive 9.1 percent in China, to 25.7 percent of the market.

The increase in the Chinese market alone more than made up for the losses we mentioned and the company is forecasting strong demand going forward for the iPhone 13.

Bear in mind that when looking at these figures, we’re comparing Apple’s iPhone sales to the entire Android ecosystem. That’s how utterly dominant the company is in the smartphone market, and that’s amazing.

It gets even better for Apple because their next generation iPhone SE is generating a tremendous amount of industry buzz and excitement. It will likely allow Apple to widen their lead on the Android ecosystem.

If you’re a fan of Apple and their products, this is great news indeed. It’s hard to believe that the company was at one time verging on bankruptcy.

Even if you’re not a fan of Apple, you must admire the company. Their customers are more than just customers. They are diehard fans of not only the company itself, but of every product the firm makes. Anyone in any industry would kill to have customers half as loyal as Apple’s.