You should backup your data. You should have multiple backups of your data. You should have multiple rotating or rolling backups of your data. You should have multiple rotating or rolling backups of your data saved to different types of backup media. Ideally, you should have multiple rolling or rotating backups of your data saved to different types of backup media including off-site backups.
Evidently, a PBS station didn’t follow any of these rules. Instead they handed their data to a third-party, said “Here, we’ll pay you to store it for us,” and now they’re screwed because the company went defunct.
Le sigh. Lawrence brings the hammer down on their IT organization:
Nor can this PBS station plead poverty: “2022 their gross income was [about] $13.5 million expenses 12.8 million. Their net was 3/4 of a million. So the net that is what they got to keep after paying all the employee salaries, after paying the directors 700,000 bucks.” Yeah, they could afford a local backup solution.
TP-Link is facing legal action from the state of Texas for allegedly misleading consumers with "Made in Vietnam" claims despite China-dominated manufacturing and supply chains, and for marketing its devices as secure despite reported firmware vulnerabilities exploited by Chinese state-sponsored actors.
The Lone Star State's Attorney General, Ken Paxton, is filing the lawsuit against California-based TP-Link Systems Inc., which was originally founded in China, accusing it of deceptively marketing its networking devices and alleging that its security practices and China-based affiliations allowed Chinese state-sponsored actors to access devices in the homes of American consumers.
Anyone who has ever ordered something from Amazon that looked like a good deal, only to discover that the photos weren't exactly depicting what you got - you know that the People's Republic of Chine (a.k.s. PRD, a.k.a. Red China a.k.a. West Taiwan) has a very different (dare we say "predatory") concept of truth in advertising than we do on these shores.
Me, I wouldn't buy one of these things on a dare. FYI, they are something like 60% of the market because they're cheap.
OldNFO has an important post about how Microsoft is moving very aggressively to a 100% online subscription licensing model. This is important enough that I won't excerpt any of this; instead, you should go read the whole thing. It's not too long, but if you care about the security of your home network (especially the whole who has access to my data and can I even know thing), go read. I'll wait.
What this means is that you don't own any Microsoft software. Sure, you may think that because you paid them money (most often when you bought your computer - some of that purchase price went to Microsoft in the form of a license fee for Windows). But you actually don't own "your" copy of software. At all.
Rather, you have the right to run the software on your computer. That may not seem like a big difference, but it is. The license agreement (you know, the one you didn't read before you clicked "I Agree") allows Microsoft to change the terms of the agreement at any time, at their pleasure.
Microsoft has just done this in a big, big way. Key new stuff in Windows 11 is:
AI integrated with your operating system
Online presence is critical for lots of Windows now (e.g. AI)
Windows will nag you until you put all your data online (OneDrive) whether you want to or not.
The proper technical term for that first bullet point is that your Windows operating system is essentially now an "AI Agent" which if you are a regular reader you know is very, very bad security juju.
Combine this enormous security hole with the requirement to essentially be online 100% of the time (bad security) and the liklihood that OneDrive will slurp all your data to some Internet black hole in a Microsoft data center, Windows is simply unsecurable.
Yes, I know that is inflammatory, but there is simply no way that you can get assurance that your security is sane. I say that as someone who has spent decades inn Internet Security (and particularly in security assurance). Not to put too fine a point on it, but I don't think that I could get decent assurance that things aren't going "bump in the Net". For most of the readers here, it's not even worth trying.
So what do you do, assuming that you are not a tech nerd like me?
Interestingly, Microsoft has just flipped the technical script on this. It used to be that it was easier to stay on Windows than to move to alternatives like Linux. Now that's out the window, at least if you want to protect your data from that OneDrive vacuum cleaner and whatever the AI agent will do to you.
This is really slick. The Linux equivalent of the Windows Start Menu lets you try all the apps (I use the Office apps which are every bit equivalent to Word and Excel, etc, and will save files in Microsoft format like .DOCX).
Take a few weeks poking around, you will likely see that it's not a big learning curve.
This post is the fourth in a series on how to make your home network harder to attack. Here are links to posts one, two, and three.
Now you might think the question in the post title is a bit strange - after all, these are you devices, so you'd think that they're all trustworthy. You'd be wrong. There are at a minimum two different categories of trustworthiness:
Your main computing devices. These are computers (duh) such as laptops and desktop computers, servers (a future post will talk about why these can be useful to you, and your cell phones (which are nothing but tiny hand held computers).
Now I've been in security for long enough that I get a bit twitchy about mobile phone security (I'll address this in a future post as well). However, that ship has sailed and even a security nerd like me won't bother making a separate network just for these. So they're computing devices for this discussion.
Then there's everything else. It's surprising how any Internet-connected thingies there are these days. Ring doorbells, Nest thermostats, online appliances (fridges, washing machines, etc). At this point the Borepatch from four years ago would have told you to just walk away from all this nonsense. Don't Internet-enable anything in this category.
Today's Borepatch sighs and tells you that this is coming to a home near yours. It's here in my home. No, not the thermostat (which was installed by the previous owner and which I have not connected to the WiFi). However, the TVs all come with streaming apps for Netflix, Prime, and Youtube (among dozens of others). And The Queen Of The World reminds me that the kids like to stream when they come and visit. She likes it when they come and visit, as do I. And so we have to do something for these devices.
Fortunately, you don't need any new kit to do this. If you remember from the last post on water tight compartments, you don't own the Internet box from your network provider. Basically, you can't trust it, so you install a new firewall box running DD-WRT. It's trustworthy because you own it and have your own software and configuration on it.
All of your main computing devices connect to it's WiFi. All of the other devices (doorbells, thermostats, TVs, appliances) connect to the WiFi from your network provider's box.
What you've done is to put a firewall between your computing devices and your untrusted devices. It doesn't matter if your TV gets hacked because it can't get through your DD-WRT firewall to your computers.
Likewise, your TV is at least somewhat protected from the outside world because it's behind the firewall in your network provider's box.
This post is the third in a series on how to make your home network harder to attack. Here are links to posts one and two.
Post two introduces the concept of a Firewall which is a device that lets you connect to the Internet without letting the Internet connect to you. Firewall technology comes embedded in your Internet provider's device like a Cable TV modem. A recent article does a comparison on a number of these devices.
If you look at the device it will look a lot like this:
The red colored connection goes out to the Internet, the yellow ones go to your devices (as does the Wifi). This one has a connection for a landline telephone as well (ask your parents, kids).
Installing the device is really simple - red (labeled "WAN") goes to the outside which is untrusted, and yellow/WiFi go to your own devices which are trusted.
Except nothing is as simple as that. Your Internet provider actually owns the firewall device, it's not really yours. Some providers run their own WiFi network for other subscribers who happen to be passing by - Verizon is notorious for this, and you will often find all sorts of WiFi networks called "VerizonXYZ" or some such.
So who is outside the firewall, and who is inside? The question may sound pedantic but it's terribly important. Fortunately there is something you can do about this.
Ships used to sink all the time but this is pretty rare these days. One major reason for this is that they are divided into compartments which are watertight - if the ship hits a rock (or, like the Andrea Doria gets rammed by another ship) only one compartment will flood and the ship can likely make it to port.
USS South Dakota under construction
The network security analog of this idea is to use more than one firewall. Don't trust your provider's firewall? (and you really shouldn't) Buy your own and hook it up to your provider's firewall. The red (WAN) port on your firewall gets connected to the internal (yellow) connector on the provider firewall. Now anyone that the firewall lets in can't get past your firewall.
And it really is your firewall, although you'll have to buy it with cash money. But your devices connect to your firewall's yellow network connections, or to your firewall's (NOT your provider's firewall) WiFi.
Now you don't have to trust your provider because their device doesn't have access to your internal "watertight compartment".
Linksys, Netgear, and TP-Link are low cost options, running $30 - $70 or so.
The first thing you should do is replace your firewall's operating system with dd-wrt:
DD-WRT is a Linux based alternative OpenSource firmware suitable for a great variety of WLAN routers and embedded systems. The main emphasis lies on providing the easiest possible handling while at the same time supporting a great number of functionalities within the framework of the respective hardware platform used.
Here's a step by step tutorial on how to install dd-wrt on a Netgear device:
[UPDATE: Rick T in the comments says to check the dd-wrt website before buying a device, to make sure that the software supports that particular hardware.]
Why go to this hassle? Product longevity. Consider a $60 Netgear device. The profit margin on this to Netgear is probably $5. You can't pay for a lot of enhancements or security bug fixes with that. DD-wrt is an open source project with a bunch of passionate contributors. I like my chances on having a viable, supported software five years down the road with them. Not so much the device manufacturers.
So now you have a device you can trust for the long term. We're not done yet, because there's all sorts of new tech evil that people want to use - Ring doorbells, Alexa, etc. That's tomorrow.
Forget about the Internet and security for a moment - you already own something with a firewall. Your car has one between the engine and the passenger compartment, even if your car isn't a sweet 1969 Dodge Charger.
The firewall in your car is designed to contain engine fires to the engine compartment, not letting the flames spread to the passengers. Firewalls have been around cars for a long, long time - certainly since the 1930s, and probably a lot longer.
Now back to the Internet and security. Internet firewalls are designed to keep bad things (and Bad Guys) out of your network, so they don't burn down all your devices. Yes, I stretched that metaphor, but that's exactly where the name came from.
An old Internet wag once described a firewall as a device that "keeps the bad guys out while letting the good guys out". That's a really good description. Internet firewalls have been around for basically as long as there has been an Internet, say from around 1990. The technology is very well understood, and very mature. That's the good news.
The bad news is that there are a million ways to set up your firewall so it's more full of holes than Swiss cheese. This post will try to help you avoid this.
More good news: your Internet Provider almost certainly has a firewall capability in hte box that gives you Internet access. For example, if you get Internet via cable TV, you have not only a cable box that changes channels, you have a separate box that gives Internet. That thing has a firewall built in, so yay.
You an check this yourself via a web site that I've linked to a number of times over the years, Steve Gibson's Gibson Research. You should see something that looks like this:
Green is good.
So what went on when you ran that? There are a bunch of Internet services like web, email, and so on. Each uses a "port" - email is 25, web is 80, there are a bunch of others. What Gibson's app did was to try to connect to all of these posts on your IP address. Ideally, your firewall (like mine) dropped these connections in the trash can.
So from a first cut, your firewall is letting you out onto the Internet (so you can read this, hello!) but keeping the Bad Guys out.
But the devil is in the details of how we (and our devices) use the Internet. The next post in this series will explore this: Secure Your Home Network: Can (and should) you trust your devices?
This is the beginning of a new series about what (mostly) non-technical readers can do to lock down their home networks to a decent level of security. I need to start with some caveats here:
It's pretty easy to protect yourself from "script kiddies" (Bad Guys who just use canned exploits without knowing much (or anything) about you or your home network. Hopefully the posts in this series will make you, if not impervious to, at least unreasonably difficult for these attackers.
It's harder to protect yourself from a knowledgeable and determined attacker. Someone with skill, time, and motivation to attack you is a dangerous opponent. Hopefully the posts in this series will increase the required time, skill, and motivation needed for these Bad Guys to succeed. Basically, it raises the cost for them to attack you which is A Good Thing.
At the end of the day, you can't protect yourself from NSA or FSB (the KGB successor organization). Or the Chinese, who are quite active and skilled. Even keeping them from sniffing out your traffic is really, really hard. If you think that any of these organizations are likely to want to access your computers, then you should unplug from the 'Net right now. Not kidding.
So if you're interested in this kind of thing, and are willing to spend a nominal amount of time and money to raise the bar on your home network security, follow along on this series of posts.
Tomorrow's post: What is a Firewall and why do you care?
For years I've touted (and recommended) Linux, the Free Open Source Software (FOSS) that is the heart of Internet servers, Internet routing nodes, and Android. I have a lot of experience with Linux, having run it since kernel version 0.99 back in 1994 or so. Slackware on 25 pounds of 3.5" floppy disks FTW.
One question that comes up regularly is what non-technical people can do. While Linux has become a lot easier to install and run, there are still the occasional weirdnesses that some up, link the Brave Browser's refusal to print to anything other than PDF. This means that if you live in a Linux world, you regularly have to come figure out workarounds.
And thus, the questions. It's pretty easy for someone like me with 30 years of Linux experience* (good Lord, can it really be that long???), but for everyday folks who don't dig kernel versions and package dependencies, it's a daunting prospect.
As it turns out, there is a ton of high quality FOSS software for Windows and Mac users, and as your current computer ages and falls out of support, these can be a great way to extend the life of your computer.
I highly recommend this article from The Register on where to find high quality, non-malware FOSS packages. It's very long and information-rich, so if you have an aging computer and you really don't want to load Linux on it, it's worth 10 minutes of your time.
Strongly recommended for normal computer users. Techie users will stay with sudoapt-get install foo but that just sort of proves my point.
About the only thing you won't get for your old Windows or Mac computer are security updates once the OS is end of life. That's a big issue these days, and while it is possible to lock down a (say) old Windows OS to minimize your risk, it probably takes more tech savvy that installing Linux. But if you are still getting security patches, FOSS can help you adapt to your apps demanding you upgrade the OS.
* Interestingly, each year for the last 20 years has been "This is the year of Linux", and it really hasn't because the workarounds haven't ever gone away. I'd argue that the only place where Linux is truly easy to use is Android, because Google invested a ton of money smoothing it out.
Agentic browsers are too risky for most organizations to use, according to analyst firm Gartner.
The firm offered that advice last week in a new advisory titled “Cybersecurity Must Block AI Browsers for Now,” in which research VP Dennis Xu, senior director analyst Evgeny Mirolyubov, and VP analyst John Watts observe “Default AI browser settings prioritize user experience over security.”
Gartner’s fears about the agentic capabilities of AI browser relate to their susceptibility to “indirect prompt-injection-induced rogue agent actions, inaccurate reasoning-driven erroneous agent actions, and further loss and abuse of credentials if the AI browser is deceived into autonomously navigating to a phishing website.”
The authors also suggest that employees “might be tempted to use AI browsers and automate certain tasks that are mandatory, repetitive, and less interesting” and imagine some instructing an AI browser to complete their mandatory cybersecurity training sessions. [Highlighting mine - Borepatch]
The highlighted bit is a very clever way to get attention from IT departments. Not only will it irritate the IT Security team but it will focus the Risk Management team on potential loss of SOC2 compliance. This is a very Gartner way of getting eyeballs from the CISO and CIO. Like I said, clever.
Cloud security vendor Zscaler says customers of Google’s Play Store have downloaded more than 19 million instances of malware-laden apps that evaded the web giant’s security scans.
Zscaler’s ThreatLabz spotted and reported 77 apps containing malware, many of them purporting to be utilities or personalization tools.
Sneer all you want at Apple, they take security for iOS much more seriously than Google does for Android.
Zscaler noted that the software requires users to grant it elevated permissions before it can cause harm, but attackers are hiding it in legitimate-seeming apps to fool users, and the technique is obviously working.
Probably the best thing you can do is refuse permissions for new apps. Heck, I don't even let most apps have access to location data.
And quite frankly, I don't have many apps installed. That's probably the best way you can deal with this sort of nonsense.
Walter emails with a question that probably will have broad interest:
BP -
Long time reader question here:
I need to replace my long-in-tooth NetGear WiFi router and could use a suggestion on what are the best routers to consider; I need both 2.4 and 5 Ghz to support existing equipment. Square footage = ~1.8K, rough footprint 56X32 on one level; the existing (centrally located) NetGear covers all of it well without repeaters or mesh, meets all speed requirements, is currently supported by 100 meg coaxial cable but 1 gig fiber is a month or so away, house is pre-wired to each room with coax in the next couple of weeks, and since the router also supports the security system high security is a strong consideration.
Expert suggestions?
Well, I am not really an expert, but I play one on TV so here goes. I will start with some high level recommendations and then get more specific with some actual device suggestions (note: I do not have any commercial interest with any of these vendors). Lastly, I will end with some generic WiFi security suggestions and pointers to old posts here.
Recommendation #1: Do NOT select any device from TP-Link (which are generally the least expensive options). These are Chinese and there is a nasty habit of Chinese companies putting back doors in their commercial hardware. The US Government is considering banning these because they don't trust them any more than I do.
Recommendation #2: Use open source software on your device. There is a long history of WiFi routers having security bugs that never get fixed because they are end of life (I posted about this ten years back so this is a persistent problem in the industry). Profit margins are razor thin and so you will end up with an orphaned device. I recommend OpenWrt which has been around since forever and has great hardware support. Yes, this means putting new software on your brand new device. You will only go through this pain once and you never have to worry about unpatched security bugs.
Recommendation #3: Look for commercial WiFi routers that come with OpenWRT pre-installed. This will save you a step. Turris Omnia is one option (and they have a pretty interesting Distributed Adaptive Firewall security feature). OpenWrt One is another. There is one from TakTikal but it seems to be out of stock.
Recommendation #4: If you want to go with a more commercial device and flash your own software, I'd recommend Linksys and Netgear because they have great OpenWrt support. Here are some recommended devices. At this point you will be selecting on feature/function. Walter had some specific needs that you might not, so there's something for everyone here.
Recommendation #5: Once you are set up, make sure you have secured the configuration. WiFi encryption is almost certain to be on by default, but change your dang password (duh!). One thing I recommended in that post (and still recommend today) is to write the router password on a piece of paper and tape it to the bottom of the device (note: don't tape it over ventilation holes). Yes, writing down passwords is usually double plus ungood security but face it - anyone who gets physical access to your device can do a factory reset and take it over anyway. Your front door lock now becomes an excellent WiFi security feature and you never have to worry about forgetting the password.
Lastly, read this post from sixteen (!!!) years ago. Secure your damn WiFi router.
I know that a bunch of you are in the tech biz, so if you have anything to add, drop it in the comments.
The Surveillance State is bringing people together. In this case Apple (iOS) and Google (Android). You will now be able to send end-to-end encrypted messages from iPhones to Android devices and vice versa. It's kind of like what Signal and Telegram do.
You already have that capability with Apple devices sending to other Apple devices, and Android to Android. This new capability now makes it a big, happy, (more) secure world.
You will need to go into your device settings and enable Rich Communication Services (RCS) protocol. But yay for cross vendor cooperation and interoperability.
If you are at version lower than 128, you need to update Firefox immediately or all sorts of things will break. The crypto certificate it uses to authenticate basically everything is about to expire so pretty much everything will fail authentication.
Bad things will result.
You can find out what version you are running by going into Settings and scrolling down to the Updates section. The current Firefox version looks to be 136, but if you are 128 or higher then you're fine. If your version is lower than this then click on the "Check for Updates" box.
Owners of older models of D-Link VPN routers are being told to retire and replace their devices following the disclosure of a serious remote code execution (RCE) vulnerability.
Most of the details about the bug are being kept under wraps given the potential for wide exploitation. The vendor hasn't assigned it a CVE identifier or really said much about it at all other than that it's a buffer overflow bug that leads to unauthenticated RCE.
This bug is so serious that the vendor is not releasing any details about it at all, because this will help the Bad Guys create exploits. There will not be a patch because all of these devices are End-Of-Life.
Microsoft has released a fix for a severe vulnerability in this month's Windows Update. The problem here is that a Bad Guy sending a specially crafted IPv6 packet can run code on your computer. Basically it's a spammer's/hacker's dream, and now there is demonstration code in the wild to do this.
If you run Windows 10 or 11, this is probably bad news for you. Here's what you need to do:
If the site in the link above can reach you with IPv6, you need to run Windows Update. Go to the Start Menu and type "Windows Update" in the search bar which will take you right to the update program.
I must say that I was surprised about my IPv6 connectivity. But this is a really nasty bug, so get patching.
Password manager 1Password is warning that all Mac users running versions before 8.10.36 are vulnerable to a bug that allows attackers to steal vault items.
...
Think you might be vulnerable? No mitigations were provided by 1Password, so patching up to version 8.10.36 is your only shot at securing those credentials.
Password Managers are great security tools because they make it easy to have very strong passwords (basically, random gobledy gook) for your online accounts. They remember these passwords so that you don't have to.
But they're not magic, they're software. That means that even they can get security bugs. If you use 1Paddword on Mac, make sure you upgrade it to 8.10.36 which fixes this.
If so, you need to replace it right away. There is a critical vulnerability which allows a Bad Guy to dump user accounts and passwords - basically, this lets him take over the box. Because the routers are End Of Life (EOL) there will never be a software update to fix this.
Fortunately, home WiFi routers are pretty cheap these days.
I used to run D-Link in the past (I'm pretty sure I had one at FOB Borepatch, back in the day) but those are long gone now. If you have one then run, don't walk to get a replacement.
Microsoft is not giving up on its controversial Windows Recall, though says it will give customers an option to opt in instead of having it on by default, and will beef up the security of any data the software stores.
Recall, for those who missed thedumpster fire, wasannouncedon May 20 as a "feature" on forthcoming Copilot+ Windows PCs. It takes a snapshot of whatever is on the user's screen every few seconds. These images are stored on-device and analyzed locally by an AI model, using OCR to extract text from the screen, to make past work searchable and more accessible.
Theultimate goalfor Recall is to record nearly everything the user does on their Windows PC, including conversations and app usage, as well as screenshots, and present that archive in a way that allows the user to remind themselves what they were doing at some point in the past and pull up relevant files and web pages to interact with again. The archive can be searched using text, or the user can drag a control along a timeline bar to recall activities.
But security testers have raised doubts about the safety of recorded information and have developedtoolsthat can extract these snapshots and whatever sensitive information they contain. The data is for now stored as an easy to access non-encrypted SQLite database in the local file system.
"Dumpster fire" doesn't even begin to describe it. It's easy to imagine all sorts of ways that this would violate laws (e.g. storing healthcare PII unencrypted is a HIPAA violation).
Never mind what sort of reindeer games hackers might get up to - after all, Windows has historically been so difficult for viruses and malware to invade, amirite?
If you're still using Windows, you should configure it to opt out of Recall. Or upgrade to Linux. All the cool kids are.
_under_construction,_1_April_1940.jpg)
