By now you’re almost certainly aware of the Log4j Java issue.

It’s a serious and fixable flaw relating to java logging.

Recently the United States Federal Trade Commission (FTC) has issued a chilling warning to anyone who hasn’t yet fixed the flaw and protected against the vulnerability.

The FTC’s statement reads in part as follows:

“The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future.

Failure to identify and patch instances of this software may violate the FTC Act.

The Log4j vulnerability is part of a broader set of structural issues.  It is one of thousands of unheralded but critically important open-source services that are used across a near-innumerable variety of internet companies.

These projects are often created and maintained by volunteers, who don’t always have adequate resources and personnel for incident response and proactive maintenance even as their projects are critical to the internet economy.

This overall dynamic is something the FTC will consider as we work to address the root issues that endanger user security.”

The FTC has already made it clear that they’re not playing around with this issue either. Not long ago in 2019, they hit Equifax with a staggering $700 million fine because of customer data exposure.

The FTC clearly has the muscle to make this threat stick. So if you haven’t already installed the remedy for Long4j, do it now before you lose track of it. Keep an ear to the ground for other similar issues.

Fines of the sort that the FTC is threatening are enough to rock any business back on its heels. So don’t take any chances. Stay vigilant out there. It’s going to be an interesting year.

If you’re managing a company of any size and interested in copying from some other firm’s playbook, Apple is almost always a good choice. Even the folks at Google seem to think so.

The search giant recently announced a plan to tighten the integration between Android/Chrome and Windows to create a seamless and hassle-free user experience.

One important first step down that road is Google’s introduction of “Fast Pair.” Working with Acer, HP, and Intel, the company is aiming to make it quick and easy to pair your Windows PC with your Android phone.

Once the link between the two has been established users can then easily set up Bluetooth accessories, sync text messages across interconnected devices, and even share files using the company’s “Nearby Share” feature. Development is already well underway, and the company reports that users should see this new functionality appearing on select PCs later this year (2022).

The company is also extending the Fast Pair concept beyond just desktop PCs and is hoping to bring that same kind of functionality to a wide range of wearables, cars and even things like TVs and other smart devices. For example, if you own a Chromebook it is already capable of detecting your Fast Pair-enabled headphones when you turn them on, allowing you to connect them with a single click.

That ties in with Google’s vision of Ambient Computing. Ultimately the goal will be to tie all of your smart devices together to create a seamless whole that’s easy to use and vastly more convenient than the world we live in today.

It will undoubtedly be a long road. Apple has a head start on everyone but all of the major tech companies are moving in that direction. It won’t be long before our already highly connected world is even more tightly integrated than it is today and that is a very good thing.

It's the dawning of a new year and the hackers of the world have been busy. This time it's US Cellular caught in the crosshairs.

The company recently reported that their billing system was hacked and they sent breach notification letters to more than four hundred impacted individuals.

US Cellular is the fourth largest carrier in the United States. Only 405 of the company's customers seem to have been affected which makes this attack quite small in terms of scope and scale. That's small consolation if you're one of the unlucky US Cellular customers to have received a notification in the mail.

The company had this to say about the incident:

"On December 13, 2021, UScellular detected a data security incident in which unauthorized individuals illegally accessed our billing system and gained access to wireless customer accounts that contain personal information.

Information in customer accounts include name, address, PIN code and cellular telephone number(s) as well as information about wireless services including service plan, usage and billing statements.

Sensitive personal information, such as Social Security number and credit card information, is masked within the CRM system. At this time, we have no indication that there has been unauthorized access to your UScellular online user account."

If you haven't received a notification in the mail from US Cellular then it's most likely that your account record was not compromised. Out of an abundance of caution, you may want to reset your account password and be on the lookout for suspicious emails targeting you. Now you may be more likely to be on the receiving end of phishing emails for a time.

Kudos to US Cellular for their rapid response. Sadly we'll probably be seeing a lot more of this kind of thing in the year ahead.

Thank Trevor Spiniolas' sharp eyes if you own an iPhone. The independent security researcher recently discovered a critical security flaw in iOS that impacts all version from 14.7 to 15.2.

If exploited, this flaw can turn your fancy phone into a very expensive paperweight, so it's one to take seriously.

Trevor discovered that by changing the name of a HomeKit device to a large string of characters, it would cause the iPhone to crash. In his case Trevor used a string half a million characters long for testing.

Unfortunately, there's no easy way out if this should happen to a user because of course the new device name is backed up to the iCloud. So if the user tried to restore the iPhone it would pull the relevant information from the Cloud, hit the renamed device, and trigger the error again.

Spiniolas has publicly disclosed his findings, so Apple is aware of the issue. Initially the company promised a fix before the end of 2021 but they've since come back with a revised timeframe of "early 2022." For now, if you run afoul of this issue you don't have many good options.

Spinolas recommends the following steps for impacted users:

Restore the affected device from Recovery or DFU Mode
Set up the device as normal but do NOT sign back into the iCloud account
After setup is finished, sign into iCloud from settings. Immediately after doing so disable the switch labeled "Home." The device and iCloud should now function again without access to "Home" data.
It's a bit of a process with more hoop jumping than many people will care for. However, the steps outlined above will get the job done and give you your phone back. Here's hoping Apple doesn't hesitate in terms of the fix.

A new threat has appeared on the horizon. Even if the name is not familiar to you this malware strain is bad news indeed.

Called RedLine it is an information-stealing malware that specifically targets popular web browsers including Opera, Microsoft’s Edge browser, and Chrome.

Unfortunately, many people have come to rely on their trusty web browser to store and remember their passwords for them. RedLine takes advantage of this and the group behind the code has found a way to crack the browser open and grab the passwords stored within.

Even worse is that RedLine isn’t just isolated to a single gang or group of cyber criminals. Instead, it is being offered as a commodity on the Dark Web. That means anybody with about $200 USD can buy a copy and start harvesting the credentials of anyone they infect.

While it is true that passwords stored inside web browsers are encrypted, RedLine can programmatically decrypt those passwords if they are logged in as the same user which is very much the case here. RedLine runs as the user who was infected which means that all of their passwords are open to the person controlling the malware.

Although it is highly convenient the bottom line is that it’s dangerous to have all of your passwords stored inside your web browser. If you insist on going that route, then your best bet by far is to enable two-factor authentication on every website you visit frequently that offers it. That is so at least if your passwords are compromised the hackers who gain access to the information still can’t easily access your accounts.

Given how RedLine is being marketed on the Dark Web we can expect to see a surge in attacks using the malware in the months ahead. It’s going to get a lot worse before it starts getting any better.

Recently digital media giant Shutterfly was hit by a major ransomware attack.

The attack disrupted broad swaths of the company’s services including those offered under their GrooveBook, BorrowLenses, and Lifetouch brands.

According to a report received by BleepingComputer, Shutterfly was targeted by the Conti gang. That group was able to encrypt more than four thousand of the company’s devices and 120 VMware and ESXi servers.

Like so many ransomware attacks in recent months the Conti gang did not start encrypting files immediately upon breaching the Shutterfly network. Instead they lurked for a time while quietly exfiltrating files to a server they control.

The Conti gang has created a private Shutterfly data leak page that contains screenshots of the data the group allegedly stole prior to launching the encryption phase of their attack. The purpose is to use the stolen files as leverage to prompt the company to pay the ransom demanded. The ransom in this case is reportedly in the millions of dollars.

Based on the screenshots on the data leak page it appears that the Conti gang made off with legal agreements, merchant account info, and a wide range of login credentials for corporate services.

The company has released a brief statement about the matter that reads as follows:

“Shutterfly, LLC recently experienced a ransomware attack on parts of our network. This incident has not impacted our Shutterfly.com, Snapfish, TinyPrints or Spoonflower sites. However, portions of our Lifetouch and BorrowLenses business, Groovebook, manufacturing and some corporate systems have been experiencing interruptions. We engaged third-party cybersecurity experts, informed law enforcement, and have been working around the clock to address the incident.

As part of our ongoing investigation, we are also assessing the full scope of any data that may have been affected. We do not store credit card, financial account information or the Social Security numbers of our Shutterfly.com, Snapfish, Lifetouch, TinyPrints, BorrowLenses, or Spoonflower customers, and so none of that information was impacted in this incident. However, understanding the nature of the data that may have been affected is a key priority and that investigation is ongoing. We will continue to provide updates as appropriate.”

Based on the above there’s little for users of those services to do at present. Out of an abundance of caution if you do use the impacted services you will probably want to change your password right away.

The great thing about standards is that they provide a standard. A common framework that the manufacturers in any given industry can design around. That’s amazing when everything works the way it’s supposed to but sometimes the system goes haywire.

Sometimes things just don’t work out as planned.

Take the world of HDMI. The HDMI standards are a mess. That’s particularly true of the HDMI 2.1 standard. That is only haphazardly supported by the major television manufacturers, cable makers and the manufacturers of the devices required to set up gaming systems on modern televisions.

Essentially the problem is that bad standard means spotty support for it. Spotty support means an increase in consumer frustration. Unfortunately, the new 2.1a standard probably isn’t going to help and may actually make things worse.

The hallmark of this new standard is the addition of something called Source-Based Tone Mapping or SBTM for short. It’s a new HDR feature that offloads a portion of the HDR tone mapping to whatever the source of the actual content is (your computer, your Xbox, or whatever).

This tone mapping is done in tandem with whatever your TV itself is doing which should be a good thing. Since the workload is being divided it should get done more quickly. It could also help existing HDR setups work better and more effectively by removing the need to have the user manually calibrate their screens. Doing that can be a lesson in frustration.

Unfortunately, in practice most users won’t get access to the new feature unless they update their equipment. This is because support for HDMI2.1a will only be available on existing devices via firmware updates that most manufacturers are slow to provide if they provide them at all. Even worse is that SBTM is listed as an optional feature. This means that relatively few manufacturers will prioritize support for it.

Again, standards are wonderful things when they are well designed and broadly embraced. That’s definitely not the case here and that’s a real pity.

There are strange events swirling around LastPass. LastPass is a popular password safe and identity protection service.

Recently Twitter exploded with reports from around the world of people who received a notification from LastPass regarding a string of suspicious login attempts. Most of them came from countries other than the ones the impacted users lived in.

Naturally this led to speculation that LastPass had been hacked and some portion of the passwords stored by their massive user base were stolen. This created something of a panic because LastPass and similar sites are considered one of the last safe refuges where passwords are concerned.

The company responded that there was no evidence that LastPass servers had been breached but questions persisted. If that was the case, then why did the company send out notifications to users regarding suspicious login attempts? The company’s investigation into the matter continued.

Recently LastPass issued another update which reads as follows:

“As previously stated, LastPass is aware of and has been investigating recent reports of users receiving e-mails alerting them to blocked login attempts.

We quickly worked to investigate this activity and at this time we have no indication that any LastPass accounts were compromised by an unauthorized third-party as a result of this credential stuffing, nor have we found any indication that user’s LastPass credentials were harvested by malware, rogue browser extensions or phishing campaigns.

However out of an abundance of caution, we continued to investigate in an effort to determine what was causing the automated security alert e-mails to be triggered from our systems.

Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved.

These alerts were triggered due to LastPass’s ongoing efforts to defend its customers from bad actors and credential stuffing attempts. It is also important to reiterate that LastPass’ zero-knowledge security model means that at no time does LastPass store, have knowledge of, or have access to a users’ Master Password(s).

We will continue to regularly monitor for unusual or malicious activity and will, as necessary, continue to take steps designed to ensure that LastPass, its users and their data remain protected and secure.”

It seems that it was a false alarm. Even though it was a false alarm, if you are LastPass user you should enable two-factor authentication as soon as possible to minimize your risk.

If you’re one of the early adopters of Windows 11 then you may have already experienced the latest bug that crept into the mix as of build 21H2.

Apps that utilize Win32 APIs to render colors on some HDR (High-Definition Range) displays may not work as expected.

HDR displays are noted for their rich incredibly broad color range which usually results in more vivid colors displayed than standard dynamic range (SDR) displays. In this instance though things aren’t going according to plan.

Microsoft recently published information about the bug on the Windows Health Dashboard:

“This is frequently observed with white colors, which could display in bright yellow or other colors. This issue occurs when certain color-rendering Win32 APIs return unexpected information or errors under specific conditions.”

This latest bug joins several other high-profile issues that the company is in the process of working their way through. These include an Intel audio driver issue that is causing Blue Screens of Death, assorted printer issues and system freezes, at least one issue impacting the Windows Remote Desktop, and a wide range of others.

On the other hand, the company is making progress. Recently they isolated the root cause of an issue that prevented certain apps from opening after being repaired or updated using the Windows Installer System Tool (previously known simply as “Windows Installer.”)

Making something new is an iterative and risk-laden process. It is one that Microsoft is well-acquainted with having traveled down this road many times before. There are going to be problems along the way and that’s inevitable. It simply can’t be avoided when dealing with a project as large and complex as this one.

We have complete confidence that Microsoft will get it done. The result may not be perfect, and it will surely not please everyone. The company will certainly move their globally dominant OS a few more steps in the right direction, though.