Recently one of the biggest companies on the web got a name change when the Facebook CEO announced that the company would henceforth be known as ‘Meta.’

Here’s what you need to know:

First and foremost nothing at all will change about the company’s iconic social media platform. It will still be known as Facebook.

What is changing however is the fact that the name change seeks to expand the width of the corporate umbrella to cover a broader range of initiative as the company seeks to build the ‘Metaverse.’

What exactly is the Metaverse?

It’s a fair question. The name first appeared in a dystopian science fiction novel several decades ago and has since wormed its way into the public consciousness. In a nutshell it is what the internet could be. An all-encompassing platform that merges the real world with the digital. A place where everyone goes to work, play, and shop. They do not do this by navigating through a series of disconnected websites using a cumbersome keyboard as an interface. They do it by creating avatars and navigating through a rich and detailed virtual world where everything is possible.

Instead of getting into your car and rushing off to work you put on your VR headset and move your avatar to your digital office.

When the work day is done you transport yourself to one of the sprawling virtual shopping complexes and virtually stroll through the aisles. There you can add products to your inventory which places an order for them in the real world to have them shipped to your home.

If you want to play a game you move your avatar over to one of the genre specific gaming portals where you can dive into a fantasy realm, sci-fi realm, or whatever your preferences happen to be.

Needless to say we’re a very long way from turning that ambitious vision into a reality. The name change is a clear indicator that big companies are throwing a lot of money at the idea. What comes of it remains to be seen.

Microsoft recently reported on the existence of an unusual phishing campaign designed primarily to harvest the passwords of unsuspecting victims.

One of the things that makes the campaign so unusual is the fact that it appears to be built by using bits of code copied and pasted from the work of other hackers. Call it a “FrankenPhishing Campaign” if you will.

Microsoft borrowed from the story of The Island of Doctor Moreau and has dubbed this campaign “TodayZoo”. While it may be crude and cobbled together from the work of other it has been both large and successful enough to gain attention.

The campaign does a surprisingly admirable job of impersonating Microsoft’s own brand. The campaign makes use of a technique called “zero point obfuscation” which makes use of HTML text written in a font size of zero designed to evade human detection.

This tool is a simple and almost crude plan and yet it has proved to be surprisingly successful. Users get an email that appears to be from Microsoft. The body of the email indicates that the user’s Microsoft 365 account has been compromised and the user’s password must be reset.

The email contains a link but of course the link only points to a dummy version of the password reset page. The moment the user enters his or her login credentials all they’re doing is handing them over to the people who orchestrated the phishing campaign.

Note that most phishing campaigns that work this way collect the login credentials on one site then forward them onto some other. In this case the people behind the campaign are simply storing the credentials on the site that collects them.

All of this points to a group of enthusiastic amateurs. It’s an audacious campaign and they will undoubtedly learn from it an improve. Odds are excellent that this is not the last we’ve heard from this group.

Researchers from Microsoft have reported the discovery of a new variant of macOS malware called WizardUpdate.

The new version should worry all Mac users because it has been upgraded to incorporate enhanced evasion and persistence tactics that will make it more difficult to track, locate and ultimately stop.

WizardUpdate is also known as UpdateAgent and it is based on code that is distributed via download repositories. That is where it masquerades as a legitimate software. Although the researchers found no direct indication of how this new variant is distributed it follows that the group behind the code would use similar if not outright identical techniques.

WizardUpdate has had a short but interesting history. It was first discovered in November 2020. In its earliest incarnation the code could do little more than collecting and exfiltrating basic system information. That proved to be but a simple test. Since its initial release WizardUpdate has seen numerous upgrades.

The latest build includes the following capabilities:

• To grant admin permissions to regular users
• To leverage existing user profiles to execute commands
• To modify PLIST files using PlistBuddy
• To bypass Gatekeeper by removing quarantine attributes from downloaded payloads
• To grab the full download history for infected Macs by enumerating LSQuarantineDataURL String using SQLite
• And to deploy secondary payloads downloaded from cloud infrastructure

Microsoft had this to say about the newly discovered strain:

“UpdateAgent abuses public cloud infrastructure to host additional payloads and attempts to bypass Gatekeeper, which is designed to ensure that only trusted apps run on Mac devices, by removing the downloaded file’s quarantine attribute.”

“It also leverages existing user permissions to create folders on the affected device. It uses PlistBuddy to create and modify Plists in LaunchAgent/ LaunchDeamon for persistence.”

WizardUpdate by any name is a scarily capable malware strain and Mac users should be on high alert.

Are you in the habit of not upgrading your Windows OS on a regular basis?

If you are then when you get around to it you may find that you’ve got a rather long backlog of updates to apply. The process can take quite some time and involve a number of system restarts to complete them.

What you may not realize is that Microsoft is aware of the time consuming nature of their updates and they’ve worked hard to make the process more efficient. In part they do this by regularly reviewing Windows updates and marking them for expiration which removes them if they’ve been superseded by newer updates. Christine Ahonen is a Program Manager at Microsoft and recently shined a spotlight on this issue.

Ahonen had this to say on the matter:

“Microsoft produces two to three updates per supported Windows platform monthly. Many of these updates, however, are cumulative and include all earlier updates that have been published for that platform.”

“By expiring older, redundant packages you get better performance, shorter scan times, a faster user experience, and reduced risk of deploying older updates, which have been superseded with newer, more secure ones.”

Ahonen adds that some older Windows updates may never be evaluated and even if they are they may never meet all of the criteria to be marked for expiration. Also note that security-only updates are designed to address specific issues and are rarely if ever cumulative so these will almost never get marked for expiration.

A significant number of Microsoft’s software engineers are currently hard at work on Windows 11 and one of the back end features they’re experimenting with is something called the “Update Stack Package”.

The Update Stack Package is described as:

“The Update Stack Package will help ensure that your PC has the highest likelihood of successfully installing new updates with the best and least disruptive experience available. The cumulative update size in Windows 11 is approximately 40 percent smaller than the same set of quality and security updates would have been packaged for Windows 10.”

It’s an interesting bit of insight about a process that few people spend time thinking about and now you know!

Google has taken another step in a long series of steps designed to improve the lives of everyone who uses their ecosystem of products.

In this case the company has added a new feature to Google Calendar. Called “Focus Time” and it’s an event setting that seeks to help people block out time free from distractions.

If a user has blocked out a segment of time and marked it as “Focus Time” any invitations sent to you regarding video conference calls and the like will automatically be declined. The new feature also comes with a check box that will allow Calendar to automatically decline any incoming meeting requests if they’re set to occur during the time you’ve blocked out.

Naturally if your boss or your boss’ boss wants you to attend a meeting (virtual or otherwise) you’ll get contacted in some other way and informed that you need to be there. Focus Time can’t do anything about that but it does send a clear and unmistakable signal to your friends, colleagues and co-workers that you’re busy. That is all during a certain and clearly defined block of time and that fact alone is bound to cut down on distractions.

Google had this to say about the new feature:

“With the changes to our working environments in the past year, having more chats and meetings makes it more difficult for people to carve out time for their core individual work. With the new focus time feature, we hope to make it easier to create dedicated time for thinking and core work.”

The new feature is already in the process of being rolled out. However at present it’s only available on a limited selection of Workspace plans.

Of significance it is not currently available to customers with any of the following:

• Google Workspace Essentials
• Business Starter
• Enterprise Essentials
• Frontline
• G Suite Basic and Business

If you have a plan different from those listed above you may already see the new feature. If not you will soon. Check it out at your next convenience.

In a bid to further bolster security Microsoft has recently announced the roll-out of end to end encryption for one to one Microsoft Teams calls. Teams already encrypts user data both in transit and at rest and it allows IT admins to establish automatic transcription and recording of all video calls.

Microsoft had this to say about the recent change:

“We’re rolling out this preview of E2EE for unscheduled one-to-one calls today. When both parties in a one-to-one call turn on E2EE, the communication between those two parties in the call is encrypted from end-to-end. No other party, including Microsoft, has access to the decrypted conversation.”

“With this release only the real-time media flow, that is, video and voice data, for one-to-one Teams calls are end-to-end encrypted. Both parties must turn on this setting to enable end-to-end encryption.”

By default the new feature is disabled but IT admins will be able to toggle the new feature on either for the organization as a whole or for specified user groups.

If you are an admin here’s how you make end-to-end encryption calls available:

• Sign into the Teams Admin Center and head to “Other Settings”
• Then navigate to “Enhanced Encryption Policies.”
• From there name your new policy and then for end-to-end call encryption and select the users who can turn it on. Save these settings.
• Finally once you’ve finished creating the new policy assign it to users, groups or your entire company.

Users will need to be running the latest Teams update and will need to turn on end-to-end encryption in their Teams settings.

Users can do this by following these simple steps:

• At the top right of your Teams window select your profile picture or the ellipses next to it.
• Select Settings then Privacy.
• And finally turn on end-to-end encrypted calls by toggling the switch.

It’s an excellent addition. Give it a try at your next convenience.

YouTube has long been a hunting ground used by hackers and scammers to push all manner of hoaxes, scams and malicious code onto unsuspecting users. A security researcher known only as Frost is working for Cluster 25.

Frost has reported a significant uptick in the number of malware campaigns orchestrated from YouTube.

Overwhelmingly these campaigns are pushing Trojans onto the PCs and smart devices of their victims.

Frost has identified what appear to be two clusters of malicious activity occurring simultaneously. One of these is pushing the RedLine trojan and the other is pushing Racoon Stealer.

Literally thousands of videos and channels have been made in the conduct of these two campaigns. Based on Frost’s personal observation the campaigns are adding 100 new videos and 81 channels every twenty minutes.

He had the following to say about the identified campaigns:

The videos in question cover a wide range of topics. The hackers behind the campaigns tend to favor videos about software cracks, how to guides that outline how to get around software licenses, cryptocurrency, software piracy, game cheats and VPN software.

The videos are at least vaguely helpful and contain a link that the video’s authors claim is to a tool that will help the viewer on his or her quest related to the topic of the video. Naturally the link is nothing of the sort and clicking on it will install malicious code on the viewer’s device.

The problem has gotten serious enough that YouTube’s owner Google made a formal statement about the matter.

Google’s statement reads in part as follows:

“We are aware of this campaign and are currently taking action to block activity by this threat actor and flagging all links to Safe Browsing. As always, we are continuously improving our detection methods and investing in new tools and features that automatically identify and stop threats like this one. It is also important that users remain aware of these types of threats and take appropriate action to further protect themselves.”

The moral of the story is simple: Be very careful about any links you click.

Internet ads are annoying. People tend to go to great lengths to avoid them if possible which is why ad blocking software and browser extensions are so popular.

One of the more popular options is AllBlock which is a Chromium extension that is widely promoted on YouTube and Facebook. The extension touts its ability to prevent pop up ads and speed up a user’s browsing experience.

Unfortunately researchers at Imperva have recently discovered that the extension is actually injecting hidden affiliate links onto any device running the extension. These links exist solely for the purpose of generating commissions for the developers of the ad blocker.

If you have AllBlock on your smart device or PC it is quietly injecting redirects to affiliate links on every browser tab you have open. Worse is that the extension was coded with some fairly advanced evasion techniques. One of the techniques includes the ability to clear the debugging console every 100ms and excluding the largest and most popular Russian search engines.

As of the writing of this piece the extension was still available on the Chrome Web Store. Based on the ongoing research the Imperva researchers believe that this script is just one of many currently in use by the group behind the malicious code.

An evaluation of IP and domain evidence points to this as being part of the Pbot campaign which has been active since at least 2018. What we may be looking at then is the tip of a very large iceberg.

Frustratingly the AllBlock extension has great reviews. It is very highly rated because it is legitimately good at what it does. Unfortunately it’s advertised function isn’t all that it does which is what makes this extension so problematic.

This underscores an important and distressing point. Sometimes even if you do your due diligence you can wind up installing something dangerous. Now is a good time to review all of the extensions you use and delete any you don’t absolutely need.

Early adopters who are rushing to embrace and experiment with Windows 11 and that use Brother brand printers may experience printing problems.

Microsoft recently posted a help article on their website explaining that if you own a Brother printer and have upgraded to Windows 11 you may lose your ability to print if your printer is connected via a USB cable.

Brother reports that this is a pervasive issue impacting nearly one hundred different printer models (which is just about all of them). What’s even worse is that even if you have a model that will print after upgrading to Windows 11 you may receive an error message prompting you to use the “USB Connection Repair Tool” or stating that you “Cannot Print to the USB Printer.”

In these cases however Brother notes that simply clicking past the error messages will allow you to print successfully in most cases.

This is a complex issue that’s still under investigation. Given that the issue only seems to be impacting Brother printers the fix will almost certainly come from Brother itself. The root cause of the problem is currently under investigation. At this point Brother has yet to announce a timetable for a fix.

While it is not yet known exactly what’s causing the issue we do know at this point that USB connected Brother printers are shut out of a wide range of Windows 11 utilities.

These Utilities Include:

• Device Settings Tool
• Paper Size Setup Tool
• Distributed Print Tool
• Special ID Setting Tool
• Wireless Setup Wizard
• P-Touch Editor 5.4
• Date Software
• Transfer Manager
• Transfer Express
• Template Settings
• And the Printer Setting Tool

For the time being Brother recommends connecting your printer via some means other than USB until the company can get to the bottom of it. This will almost certainly not be the last wrinkle users encounter as Microsoft continues development of their new OS. Stay tuned.