A new study recently published by the digital identity firm Beyond Identity contains a number of surprises relating to passwords and password security. This is information that IT professionals and small or medium-sized business owners should be aware of.

While it is not a rigorous and scientific study the results of the company’s survey are beyond surprising.

Here’s a quick overview:

First fully one in ten people surveyed felt confident that they could guess a co-worker’s password by browsing through their social media accounts. Second and nearly as surprising is the fact that just over half of those surveyed (50.1 percent) share at least some of their passwords with others with video streaming accounts leading the pack here.

Nearly as many people (44.9 percent) share passwords to their music streaming platforms. The thing that is somewhat disturbing about this is that more than one in four of those surveyed (25.7 percent) share their banking passwords.

A surprising percentage of people (22 percent) try at least occasionally to guess a co-worker’s password. Nearly as many people (19.9 percent) try to guess their boss’ password.

When these attempts are made 39.2 percent of the time the person attempting the guess uses personal information they know about the person. In addition 18.4 percent of the time the person attempting to guess will check the other person’s social media pages and use the information there to inform their password guesses.

43.7 percent of these attempts are made to try and get into the target’s email system while 32.6 percent are attempts to guess phone passwords.

We find these statistics to be as stunning as they are illuminating and they serve to highlight areas of weaknesses that likely exist in your own organization.

The good news is that there are a number of easy things you can do to better secure your passwords including the use of two-factor authentication and strong password generation apps. You should absolutely take steps like these because as this report shows your passwords probably aren’t nearly as secure as you imagine them to be.

Since the start of the Covid-19 pandemic online dating sites have seen a tremendous surge in memberships. People are seeking romance online since in person dating was sharply curtailed by lock downs. Naturally this proved to be an irresistible lure to scammers around the world. So much so that the FBI has recently issued a warning concerning confidence fraud which are increasingly targeting people who are looking for love online.

The surge in these types of scams have very real costs that impact those who fall victim to them in two main ways:

According to FBI statistics these scams have cost their victims more than $113 million since the start of 2021 but the financial cost is just the beginning. Since these scams are designed to play with the emotions of their victims there’s a very real emotional cost as well.

To execute the scam the scammers begin by creating fake profiles on online dating websites and begin conversing with potential matches in the dating site’s ecosystem.

Once a potential victim is on the hook and lured by the prospect of romance the scammer will invent a story about a sudden crisis. This inevitably moves the conversation to asking for money to help a sick family member or to help cover travel expenses to facilitate an in-person face to face meeting. Naturally there is no crisis and no meeting will ever take place. The entire point of the story is to try and convince the victim to part with his or her money.

In terms of protecting yourself against such scams the FIB Advisory recommends the following:

• Never send money, trade, or invest per the advice of someone you have solely met online.
• Do not disclose your current financial status to unknown and un-trusted individuals.
• Do not provide your banking information, Social Security Number, copies of your identification or passport, or any other sensitive information to anyone online or to a site you do not know is legitimate.
• If an online investment or trading site is promoting unbelievable profits, it is most likely that–unbelievable.
• Be cautious of individuals who claim to have exclusive investment opportunities and urge you to act fast.

It’s excellent advice. Be sure your employees are aware of the current trend and on their guard against it.

For the last several years, industry experts have been sounding the alarm about password security. We’ve known for quite some time that one of the biggest weak spots in corporate security is the fact that employee passwords are notoriously weak. Millions have been spent on security education. Seminars have been held on the dangers of using weak passwords and using the same password across multiple websites.

Endless rounds of training courses have been held trying to ram the point home.

The result? Not much has changed. According to a recent survey conducted by Google, two out of three users surveyed are still holding firm, using the same bad password habits they were before all the money and time was spent trying to convince them of the errors of their ways.

It gets worse though, if you can believe it. A staggering 69 percent of survey respondents gave themselves an A or B grade for their ability to protect their online accounts, with 59 percent indicating a belief that they were better than the average person when it comes to keeping their accounts safe.

Other highlights of the survey include gems like:

• Less than a quarter of respondents said they use a password manager
• Only two thirds of respondents say they regularly update their OS and applications, even though 80 percent said they understood that such updates were crucial in terms of keeping their systems safe
• Only 32 percent of respondents could successfully identify all three of the following terms: phishing, two-factor authentication and password manager.

It’s a surreal landscape of results that reveals an enormous amount of wishful thinking, and of course, it’s an absolute bonanza for hackers around the world. With this data in mind, it’s a safe bet that 2019 will be another record-breaking year where successful data breaches are concerned. Brace for it.

GSuite has added an important new bit of functionality in the form of Android App Management, which comes in two basic flavors. There are some things you can do using the company’s basic app management console, but to get access to the full range of features, you’ll need to set up an advanced account. It’s a significant and most welcome change indeed, enabling a whole host of new features. Here’s the quick breakdown.

Using the basic app management feature, admins can now:

• Maintain a device inventory
• Enable basic password enforcement
• Gain access to mobile reports
• Enable hijacking protection
• Perform remote account wipes on company devices
• Create a list of apps that can be installed on work devices

The advanced management console allows all of the above plus:

• Standard and strong password enforcement
• Device approvals
• Strategic blocking of devices
• Remote device wipes
• iOS App management
• Android work profiles which allow you to create different allowed apps on a per profile basis
• Device audits and alerts
• Establish device management rules and security policies
• Bulk enrollments for company-owned desktops and Android devices

In addition to that, Admins will now be able to remotely install apps on any user device and prevent users from uninstalling apps. You even have the option to create your own web or private apps as needed. This is huge because a private app does not need to be run through the same checks and security protocols as an app that’s destined for an appearance on the Play Store account, which means you won’t even have to create a Play Store Console account if you don’t already have one.

GSuite just keeps getting better and better. Kudos to Google for the latest changes. Managing your company’s digital assets has never been easier.

An independent security researcher named Henze has discovered a potentially devastating macOS exploit that's been dubbed Keychain, and he has posted a video demonstrating it in action. Henze has discovered other vulnerabilities in the past, so Apple was quick to take note. Here's the problem, though: he's frustrated that Apple's Bug Bounty program only applies to bugs found in iOS and doesn't include macOS.

So, he's decided not to provide the company with the full details of the newly discovered flaw. Based on the video, we know that the exploit does not require admin privileges, nor does it matter if Access Control Lists have been established. Rumor has it that it can even defeat a system that has System Integrity Protection enabled.

Apparently, the exploit is capable of accessing anything in both the "login" and "System" keychains, but the iCloud chain is apparently not affected, given that it stores data in a different way.

Apple has made no formal statement about the exploit, so it's unclear if a fix is in the works. Even if it is, there has been no indication of a timeframe when it might be ready for rollout.

In the meantime, however, users can protect themselves from this type of an attack by locking the login Keychain with an additional password. This, however, is not the default configuration and is highly inconvenient.

Is it worth it? The short answer is maybe. As of now, the exploit has apparently not been used in the wild. Given the presence of the video, it's incredibly likely that hackers will be able to glean enough information to reproduce it, build an attack around it and begin using it. How long that takes is anyone's guess, so in the immediate future, there's probably no need to worry about it. However, the more time that passes without a fix, such a step might be more worthwhile.

Several months ago, Facebook announced a new feature that would be coming soon to Messenger.

Initially, the company didn't set a timetable for the often asked for delete functionality, but it recently made its way into the code base and is now ready for use. Granted, it's got limitations, but is a big step in the right direction that was long awaited.

The new feature allows you to delete messages from a conversation after you've sent them. This is in the event that you had a change of heart about the message you sent, or in cases where you sent a message to the wrong person.

On your smart device, deleting a message is as simple as tapping it and selecting either the "Remove for You" or "Remove for Everyone" options that now appear on the menu. However, there's a catch: You've only got a ten-minute window to decide to take it back. After that, it's part of the permanent record. In addition, people may take screenshots of your message before you can delete the text.

The feature is modeled after an Admin-level power that CEO Mark Zuckerberg has. While he can set his messages up to expire over time, your powers are a good deal more limited. It's still a useful feature indeed, although the company has received some flak for what many see as unfair, preferential treatment. They're accused of giving company higher-ups more powers than the rank and file users of the system.

As for Zuckerberg, he's unapologetic that his powers are greater than the one rolled out to the general user base, citing an increase in security concerns on the heels of the Sony Pictures email hacks that occurred in 2014.

While most people see it as a weak justification, there's little that can be done. Here's hoping that the company eventually expands the functionality of the new feature. In the meantime, it stands as a good start.

Given the rate of increase in the number of hacking attacks, it was predicted early on that 2018 would be another record setting year. That came with more hack attempts and more successful attacks than were seen in 2017. Sadly, that prediction proved to be correct.

What few people had anticipated, however, was how big of an increase we'd see.

While the number of attacks generally increased throughout 2018, few areas saw more explosive growth than BEC, which stands for Business Email Compromise attacks. Those hacks accounted for a mind-boggling 476 percent surge between the fourth quarter of 2017 and the fourth quarter of 2018. To give that number some context, by comparison, the number of email fraud attempts against businesses also increased by by just 226 percent over the same period, which while staggering, is paltry by comparison.

BEC attacks therefore win the dubious honor of being the fastest growing security risk on the current threat matrix, and the most likely type of attack that businesses are likely to experience.

These are, at their core, social engineering attacks that target specific employees of a firm, typically in the company's finance department. The goal is to convince them that they're dealing with a vendor the company regularly does business with and convince them to send large sums of money. This is typically via wire transfer to accounts that, at first glance, appear to be legitimate vendor accounts, but which of course are controlled by the attackers.

While less sophisticated attacks rely on poisoned files or URLs to do their damage, these attacks rely on trust and psychology. As such, they're significantly more difficult to spot, which is one of the many reasons they can be so devastating. By the time the victims realize what has happened, it's far too late.

Vigilance is the only real way to combat this form of attack, so be sure your employees understand the risks and that they are are on their guard. Lastly, verify any significant transfer of funds in person. Better to be safe than sorry.

Google has a new extension for its Chrome browser, and it's one you should strongly consider getting for all of your devices at home and in the office.

The extension is called 'Password Checkup,' and has exactly one purpose. It securely checks your logins against a breach database in real time as you're logging onto the various websites you use daily.

Note that the plugin checks both passwords you enter manually and those stored in Chrome's password manager.

It's a brilliant feature, although not without risks. After all, it opens up the possibility that during the check procedure, your password could be detected by a hacker monitoring your device. Even so, the risks of that happening are quite small, while the benefits gained via getting real time information about whether your passwords have been compromised is too big to ignore.

The central issue is this: Over the past several years there have been scores of high-profile data breaches that have seen literally billions of user ID's and credentials exposed, most of which wind up for sale on the Dark Web. Worse, most users are blissfully unaware of the fact that their credentials have been compromised. This extension changes that, giving you an opportunity right then and there to change your password.

The development team is constantly updating the massive database that the extension uses to check for compromised passwords, and they've got plans to extend the use of the API's capabilities down the road. They're even shopping for suggestions from Google's vast user base on how best to use it in future projects.

Overall, despite the fact that the new extension opens up potential for abuse, the availability of the new capability is hailed as a great step toward better security. Grab a copy today.

AT&T is getting some pushback for what most industry insiders are calling a misleading indicator. It has started to appear on many new smartphones including both Androids and iPhones. With the latest update, a growing number of customers are now seeing a "5G E" indicator on their 4G phones, which leads to a momentary surge of excitement, leading customers to believe they're using 5G technology.

The indicator actually stands for 5G Evolution. It's still 4G technology. It does have some enhanced features not found on other 4G devices, including 256 QAN, 4×4 MIMO and three-way carrier aggregation. Even so, it's a far cry from being 5G technology, which isn't slated to roll out until sometime in 2020.

AT&T defended the move with the following statement:

"5G Evolution is our first step on the road to 5G. It is now live in over 400 markets with more to come, and soon our most popular smartphones will start displaying the 5G E indicator to let you know when 5G Evolution coverage is available."

Both users and the company's competitors have widely mocked the indicator. Customers expressed a range of emotion that spans from frustration to outrage. For the time being at least, AT&T is sticking to its guns and shows no signs of backing away from the indicator. In fact, AT&T Communications CEO John Donovan dismissed the complaints by saying simply "Our competitors are frustrated."

They're not the only ones. Although at this point, it's unclear what (if any) backlash the company will face courtesy of unhappy customers.

Honestly, although the move is ham-fisted and a bit deceptive, AT&T isn't likely to lose many, if any customers over the issue. It is something of a public relations black eye. Long story short though, don't be fooled by the new indicator. 5G is still quite some distance away.