Are you a Spotify user? Have you found yourself wanting or needing to block another user?

Until recently if you found yourself in that situation you had no choice but to contact customer support and have them block the user for you. Apparently it’s become a big enough and common enough issue that the company decided to put that power into the hands of individual users.

If you ever need to block another user on the platform here’s how you go about it:

• The first step is to go to the user’s profile page. Just beneath their username and profile photo but above their public playlist (right next to the “follow” button) you’ll see three dots.
• Click those three dots and choose the “Block” option that comes up on the menu. Note that on mobile devices it will be labeled as “Block User.”
• From then on the user in question won’t be able to access your listening activity, your public playlists, your user page, or your profile. You may unblock any user you have blocked at any time.

The company had this to say about the recent change:

“At Spotify, we’re committed to delivering the best possible listening experience to our users. Privacy is something that is and always will be, enormously important to us and our block feature, which gives users more control, is the latest step towards that commitment.”

This builds on a feature that the company added back in 2019 which allowed listeners to block any artist they didn’t like and didn’t want to hear music from. The company has faced a slowly growing chorus of complaints from their user base about other members stalking them online.

It took the company a while to respond but respond they did. The new feature should be available by the time you read these words.

Twitter hasn’t had a very good relationship with auto-cropping. Images just haven’t historically displayed very well on the platform.

Fortunately that is soon changing. The company recently announced that it is dropping crop on the web altogether on both its Android and iOS apps.

It may seem like a small change but Twitter’s auto-cropping algorithm was at the heart of a controversy last year. That was when it was pointed out that there was evidence that the company’s auto-cropping algorithm favored white faces over black faces resulting in black faces getting cut out and white faces displayed more prominent.

Research into the issue revealed a minor bias but the issue wasn’t as serious as was being described. The company nonetheless decided to disable the feature and now it seems that it’s going away for good.

The coolest aspect of the change is that rather than getting a clumsily cropped image preview of your tweet viewers will get to see the entire image. That matters especially if you’re in the habit of posting memes which often lose much of their punch and impact if you can’t see the whole thing. Worse is that relatively fewer people are likely to click on your tweet to see the complete image if it’s cropped in such a way that it’s hard to tell what it is.

We applaud Twitter’s decision here. They weren’t very good at auto-cropping anyway. Abandoning the feature makes the platform richer and more interesting. That’s the kind of thing that attracts users and advertising dollars. So kudos to Twitter all around.

It’s also great from a marketing perspective. So if your business leverages the power of Twitter there’s even more to smile about. You won’t have to worry that your image heavy advertisements and branding tweets are getting cropped in inconvenient ways.

If you have an Android device be aware that there’s a new strain of malware out there. Called MasterFred this new malware utilizes well-constructed fake login overlays in order to steal the login and credit card information for Twitter Instagram and Netflix users.

A sample of the code was submitted to VirusTotal in June of 2021 when the malware was first spotted in the wild.

Independent analyst Alberto Segura shared a second sample online a week ago with the note that the malware he sampled was used against Android users in Turkey and Poland.

Avast Threat Labs got their hands on the sample and discovered APIs provided by the built-in Android Accessibility Service were utilized to display the malicious overlays.

Avast Threat Lab had this to say about their research:

“By utilizing the Application Accessibility toolkit installed on Android by default, the attacker is able to use the application to implement the Overlay attack to trick the user into entering credit card information for fake account breaches on both Netflix and Twitter.”

While not new or innovative it is a clever bit of code relying on elements native to the device under attack to help the malware accomplish its mission. That’s not to say that MasterFred isn’t innovative in other ways however. For instance it uses a dark web gateway called Onion.ws to deliver the login and credit card information it steals to its command and control server.

Note that briefly MasterFred was found on the Google Play store embedded in a legitimate app. That app was removed but given its presence there (however temporarily) it stands to reason that the hackers are also pushing their malware out to third party app vendor sites as well.

Stay vigilant. MasterFred certainly won’t be the last threat we see this year.

A new report by Barracuda was recently published. It revealed that the vast majority of baiting email attacks conducted this year were done via G-mail accounts.

The firm surveyed 10,500 different organizations and found that more than a third (35 percent) of them received at least one bait attack email in September 2021 alone.

That’s disturbing but perhaps it would be of benefit to back up a step. The term “Bait Attack” signifies a sub-class of phishing where hackers and scammers attempt to glean basic information about a particular person or organization. They then use that information for a more targeted attack in the future.

Essentially it’s a simple attack where if it is successful it will lead to a more complex attack in the future. That would be an attack that’s more likely to succeed given the earlier success.

Of significance is that these emails don’t contain links that point to the outside world. They don’t have attachments so there’s nothing in the email that would raise any red flags. These messages sail right through even the most robust security systems because they’re not harmful in any way. In fact sometimes they don’t contain any text in the body at all.

The goal here is to illicit a response. So if there is text it will likely be simple, clear, and to the point. It could perhaps be even as simple as “Please confirm that this is indeed your email address.”

If the recipient responds the sender learns a number of important details. These details include the fact that the email account is correct and active, that the recipient is at least somewhat likely to open unsolicited emails from unknown senders, and that the company’s spam filter didn’t block the email that was sent. From the perspective of a hacker that’s a treasure trove of information.

As to why they have a preference for Gmail over other email providers that ultimately comes down to legitimacy. Google is a respected name. Hackers can leverage that respectability by using a Gmail account and often fly under the radar.

There’s nothing specific to be done with this information beyond warning your employees to stay vigilant and resist the temptation to respond to unsolicited emails from unknown senders.

The internet has been around for a while at this point and it has brought to mind an issue we’ve never had to deal with until now.

What happens to your digital “stuff” when you die? Does it just go away? Does it simply become inaccessible?

In the here and now the answer has been yes. That’s exactly what happens.

Unless your family and loved ones have access to your accounts and know your passwords there’s simply no way they can access your data after you have died. That matters because there are very few people who make use of the traditional family photo album. Most of us keep our family photos online and usually on the cloud.

Apple understand that and they’re making some small but important changes on that front. In the near future Apple will allow you to pass on your iCloud data to your chosen people when you die. The most recent iOS update contains the first step along that path containing a new “right of survivorship” element.

The new Digital Legacy program was announced earlier this year (2021). With the new program users will be able to designate up to five people as Legacy Contacts. In the event of your death the people you have listed as Legacy Contacts will be able to access any data and personal information you have stored in the iCloud.

To activate Digital Legacy provisions users on the Legacy Contact List will need to provide proof of death and an access key to access your information. Those changes will be available as of iOS 15.2. There has been no word from Apple about when a comparable feature will be available for macOS. With the direction the company is moving in you can bet we’ll be hearing about it soon.

Kudos to Apple for making the change. This brings them into alignment with moves that Facebook and Google have already made.

One of the things that has allowed social media platforms to grow so quickly and utterly dominate the internet is the fact that they’re free to use.

They’re not completely free however because users are required to give up a lot of personal information. The bottom line is that there’s no monetary cost involved which makes them attractive.

Twitter is attempting to break that mold. The company recently announced the roll-out of Twitter Blue in the US, New Zealand, Australia, and Canada. Twitter Blue is a premium service priced at $2.99 a month which is functionally similar to the Twitter you’re currently using with a few key upgrades and enhancements.

Twitter Blue Includes:

• An “Undo Tweet” feature that allows users to take a Tweet back if they decide maybe they shouldn’t have posted it after all–provided you make use of the function within sixty seconds of posting the Tweet to begin with
• No advertising for stories accessed through the site
• Customizable pages
• Customizable feeds

Twitter had this to say about the new service:

“We’ve been listening to and learning from the most passionate and vocal people on Twitter as to what will make their experience more customizable, more friction-less, and simply put — better. We’re invigorated by the feedback we’ve received so far. The work continues and there’s a lot more to build, but in the meantime here’s the latest look inside Twitter Blue.”

It’s a bold idea but it’s also a risky move. With so many social media alternatives out there it’s unknown how well a Twitter subscription service will be received. One thing that could make it more attractive is a better and more robust moderation system but there will no doubt be at least some users who are sufficiently invested in Twitter to try it out.

In the long run the market will survive. The best outcome for Twitter is of course broad based acceptance of the idea. That will lead to other platforms doing something similar. Worst case is that users will be so put off by the notion that they’ll abandon Twitter altogether. That will almost certainly prevent others from even experimenting with paid versions of their services. Time will tell.

If you use Exchange Server to handle your company’s email then you’re probably already aware that a critical security flaw has been discovered that puts the server at risk.

The issue is being tracked as CVE-2021-42321 and impacts both Exchange Server 2016 and 2019.

Even worse is that Microsoft reports that this issue has been found being exploited in the wild. It is important to note that the security flaw only impacts “on-premises” Exchange Servers including those in Exchange Hybrid mode. So if you use Exchange Online you are not at risk.

It has been a tough year for Microsoft Exchange Server.

Beginning in March of this year (2021) the company faced a massive wave of attacks that were apparently launched by a number of state-backed threat actors. This first wave relied on ProxyLogon exploits and where they were successful they deployed cryptominers, ransomware, web shells, and other malware strains. They infected as many targets as they could reach.

A bit later in July a new wave of attacks began targeting the US EU and the UK. Ultimately the blame for these attacks was laid at the feet of China. These attacks relied heavily on Windows PetitPotam exploits and sought to deploy LockFile ransomware on infected systems.

Exchange Server Admins have been feeling the heat this year. The good news is that the wave attacks mentioned above seem to have abated and there’s a fix available for the most recently discovered issue.

If you run an Exchange Server either on-site or in Hybrid Mode save yourself some time and headaches by downloading and installing the latest patch as soon as possible. There’s no need to make more work for yourself than is necessary and you certainly want to do all you can to minimize your risk.

Open-source applications don’t get much in the way of protection.

However in recent years Microsoft has taken steps to change that and especially as it relates to Linux.

A few months back the company expanded those protections by adding endpoint detection and response (EDR) to Defender for Endpoint.

More recently Microsoft added that capability for Azure Defender customers as well. There is a fair amount of cross-pollination here because Linux distributions dominate virtual machine OSes on the Azure Cloud. That means these moves are very much in Microsoft’s best interests.

Note that in order to make use of Defender’s enhanced capabilities you’ll need to be running Microsoft Defender for Endpoint version 101.45.13 or later.

Microsoft had this to say about the changes:

“The complete set of the previously released antivirus (AV) and EDR capabilities now applies to these newly added Linux distributions. [Threat and vulnerability management] coverage will be expanded with Amazon Linux and Fedora in coming months.

With behavior monitoring, Microsoft Defender for Endpoint on Linux protection is expanded to generically intercept whole new classes of threats such as ransom sensitive data collection, crypto mining and others. Behavior monitoring alerts appear in the Microsoft 365 Defender alongside all other alerts and can be effectively investigated.

Behavior monitoring provides effective measures against ransomware attacks which can be achieved using a variety of legitimate tools (for example, gpg, openssl) while carrying similar patterns from OS behavior perspective. Many of such patterns can be picked up by the behavior monitoring engine in a generic way.”

Future enhancements will include the ability to monitor and protect against ransomware threats via machine learning techniques.

This is big news for anyone using a Linux distribution. It’s good to know that a company with vast resources like Microsoft is working to keep open-source OSes safe. Kudos to Microsoft for that.

If you spend a lot of time browsing the Windows Store you may have noticed something unexpected. You can now download Mozilla’s Firefox browser from that source.

Previously Mozilla was unable to upload its browser to the Windows Store because Microsoft’s policies required that all browsers on their platform had to use the engine provided by Windows.

Recently the company changed that policy and stripped out that requirement. That makes sense given that Microsoft rebuilt their own Edge browser using Chromium as a base. The Redmond Giant accepted Opera on the Windows Store back in September of this year (2021) and more recently added Firefox.

A Mozilla spokesman had this to say about the addition:

“Previously, if you were on Windows and wanted to use Firefox you had to download it from the internet and go through a clunky process from Microsoft. Now that Microsoft has changed its Store policies, choosing Firefox as your desktop browser is even more seamless – and it comes with all the latest Firefox features.”

More choice for users is always a good thing. The inclusion of Firefox on the Windows Store gives Windows users easy and convenient access to a non-Chromium-based browser. Firefox is a good alternative well worth experimenting with because Mozilla has built a number of intriguing features into their browser that its larger competitors haven’t emulated yet.

Kudos to Microsoft for expanding the selection of browsers in the Microsoft Store and to both Opera and Firefox for their additions there. With any luck we may see a few additional niche browsers included as well.

If you haven’t considered Opera or Firefox take a few minutes to download both and give them a test drive. It’s not a terribly time intensive process and you may be pleasantly surprised.